Singapore's IMDA published its Model AI Governance Framework for Agentic AI in January, and a recent arXiv paper on a "recomputable trust protocol" for autonomous agents lays out what's actually in it. The headline mechanism is what the framework calls an Agent Identity Card: a standardized disclosure format that spells out what an agent can do, what it can't, which domains it's authorized to act in, and when it has to escalate to a human. The framework introduces a graduated autonomy taxonomy — four tiers, with governance obligations that get stricter as an agent is granted more independent decision-making power. Instead of a blanket "is this agent safe" question, the model asks what tier an agent operates at and applies proportional identity, oversight, and audit requirements accordingly. A related paper describes it directly: the framework requires each agent to carry a verifiable digital identity and an audit trail of which agent acted under whose authorisation. This puts Singapore ahead of most jurisdictions on a specific point: rather than regulating AI outputs after the fact, it's trying to regulate the identity layer agents present before they act. The framework frames this as agent identity management — each agent gets a traceable identity linked to a human accountable party, with human users granting permissions rather than agents acquiring capabilities unilaterally. Context matters here. IMDA isn't creating a binding statute — the framework is voluntary, part of a pattern where Singapore prefers layered, sector-specific guidance over a single AI Act. It follows the 2024 Model AI Governance Framework for Generative AI and builds on IMDA's original 2019 governance model. NIST's Center for AI Standards and Innovation launched a comparable effort in February, and its concept paper diagnoses the same underlying gap other researchers keep flagging: agents today are typically provisioned as generic service accounts, with no dedicated identity, authorization, or accountability controls attached to the fact that they're autonomous rather than human-operated. What makes the Agent Identity Card notable isn't the concept of an ID for software — that's old news in access management — but the fact that a national regulator is proposing a standardized, disclosure-based format for it, tied to a tiered autonomy scale rather than a single yes/no permission gate. Whether vendors adopt the format voluntarily, or whether it becomes a de facto requirement for doing agentic business with Singapore-regulated entities, is the open question. IMDA has explicitly called the framework a living document and is soliciting implementation case studies, which suggests the Identity Card format itself may still shift before anyone builds infrastructure around it.