Cequence Security has published a report developed with input from KPMG in Singapore, examining how organisations can govern and secure AI agents while they perform actions across business applications and APIs. Titled Agentic AI Runtime Security, Governance, and Control, the report argues that conventional identity checks and fixed permissions may not be enough when AI agents can complete multi-step tasks such as processing refunds, updating records or managing customer accounts. Its central recommendation is to evaluate agent behaviour continuously, checking each action against the agent’s defined role and authority.
Cequence and KPMG Focus on Real-Time Security for AI Agents
Enterprise AI is moving beyond systems that generate text, summarise documents or answer questions. Increasingly, organisations are deploying agents that can interact with applications, authenticate as users, retrieve information and carry out transactions. That shift creates a different security challenge: an AI system’s permissions must be evaluated not only when it is deployed, but also as it performs individual actions.
Cequence Security is putting that issue at the centre of a new report developed with input from KPMG in Singapore. Agentic AI Runtime Security, Governance, and Control examines how businesses can govern AI agents as they act across applications and APIs, particularly when their activities involve consequential operations such as issuing refunds, changing records or moving money.
The report draws on Cequence’s application and API traffic research, alongside a controlled study using a company-developed research prototype. Its central argument is that conventional identity verification and fixed access permissions do not necessarily establish whether an agent’s actions are appropriate for the task it has been assigned.
Agent Activity Is Becoming Harder to Distinguish
Cequence says its CQ Prime research team tracked more than 250,000 AI agent visits across five industries during one week in October 2026. About one in seven visits performed an activity on behalf of a customer, such as booking, purchasing, signing in or managing an account.
The company also describes a sharp increase in traffic from agents that did not identify themselves as agents. At a Tier 1 telecommunications carrier, such traffic reportedly rose from around 100 requests per day to as many as 32,000 within three weeks of a major consumer AI agent’s launch. The agents signed in as customers and passed multi-factor authentication.
That finding highlights a distinction between verifying a user’s identity and establishing the authority of an automated system acting through that user’s account. Authentication can confirm that a login has valid credentials, but it does not necessarily explain whether the activity is being performed by the customer, an authorised agent or an attacker using stolen credentials.
A separate marketplace example illustrates the risks of agent impersonation. Cequence says it observed more visits claiming to be Google-Agent than all genuine agent visits it tracked that week. Those requests went directly to the sign-in page and failed, which the company interpreted as possible bulk testing of stolen passwords under a trusted agent identity. The report says Google was not involved.
These examples are findings reported by Cequence, rather than independently verified measurements of the entire agent ecosystem. Nevertheless, they point to an emerging security problem for organisations exposing customer-facing applications and APIs to automated agents.
Why Fixed Permissions Are Not Enough
Traditional access control generally defines what an identity can access or which operations it can perform. Agentic systems complicate that model because an agent can execute a sequence of individually permitted actions that collectively produce an outcome outside its intended role.
An agent authorised to retrieve account information, for example, might also be able to initiate changes or transactions through connected tools. A permission granted at the beginning of a task may therefore be too broad if the agent’s subsequent actions change the context or increase the potential impact.
Cequence recommends giving every agent a clearly defined job, translating that description into enforceable limits. A separate control mechanism should then assess each action in real time, deciding whether it should be approved, escalated to a human or blocked.
The company also argues that a blocked action should not leave an agent without direction. The control layer should explain why the action was rejected and point the agent toward an authorised alternative. This is intended to preserve legitimate task completion without allowing an agent to bypass restrictions.
The approach places runtime governance outside the agent itself. That separation matters because an agent should not be the sole authority deciding whether its own actions comply with organisational policy.
Controlled Study Shows a Potential Governance Benefit
Cequence reports that its research prototype was tested under two configurations. In the first, agents operated with logins and fixed permissions. They attempted actions outside their assigned jobs in 44% of runs.
When the researchers introduced defined job boundaries and checked every action against those boundaries, the reported rate of out-of-scope attempts fell to 1%. Task completion increased from 76% to 95%, while token use declined by approximately 35% per run.
The results suggest that tighter controls do not necessarily require sacrificing task performance. However, the figures come from a controlled study using Cequence’s own prototype. They should not be treated as independently validated benchmarks or as proof that the same improvements will apply across different models, agent architectures and enterprise environments.
For security teams, the broader implication is that runtime controls need to balance risk reduction with operational continuity. Blocking every unfamiliar action may make agents ineffective, while granting broad permissions can expose systems to unintended transactions and data access.
Singapore’s Agentic AI Governance Push Adds Context
The report arrives as Singapore develops its approach to governing autonomous AI systems.
In January 2026, the Infocomm Media Development Authority (IMDA) introduced its Model AI Governance Framework for Agentic AI. The framework recommends assessing and bounding agent risks, establishing meaningful human accountability, implementing technical controls throughout the agent lifecycle and enabling end-user responsibility. An update in May added practical case studies and guidance on multi-agent systems, third-party agents and automation bias.
The direction closely aligns with the issues raised by Cequence and KPMG: organisations need to define what agents are allowed to do, establish checkpoints for human intervention and maintain controls as agents interact with business systems.
The wider security industry is also developing technical guidance. OWASP’s November 10, 2026 release of Securing Agentic Applications V2 addresses agent architectures, identity and access controls, runtime protection, supply-chain security and assurance testing. OWASP Gen AI Security Project
Together, these initiatives reflect a shift from treating AI governance primarily as a model-development concern toward controlling how deployed agents interact with real systems.
Cequence Builds Its Asia-Pacific Presence
The collaboration also supports Cequence’s regional expansion. The company says it has established its Asia-Pacific headquarters in Singapore, with a regional team that includes senior leadership in Australia. It plans to build local teams in the Philippines, Singapore and South Korea.
Its regional customers include NTT DOCOMO in Japan and Philippine Airlines. The company says its work with KPMG combines its visibility into application and API activity with KPMG’s experience in governance, risk, regulation and cybersecurity.
The report’s findings are scheduled to be presented to senior business, technology and policy leaders at a joint event at KPMG’s Singapore office on November 19.
As enterprises introduce agents into customer service, commerce, financial operations and internal workflows, security controls will need to account for more than whether an agent can authenticate. They will need to establish whether each action is appropriate, authorised and consistent with the agent’s assigned purpose.
For Cequence, that is the case for runtime security: governing what an agent does, not simply who or what it claims to be.
Market Landscape
Agentic AI security is becoming a distinct enterprise cybersecurity category as autonomous systems gain access to business applications, customer accounts, APIs and financial workflows.
Four developments are shaping the market:
- Runtime AI governance: Organisations are moving toward continuous evaluation of agent actions rather than relying exclusively on permissions established during deployment.
- Agent identity and authentication: Security teams must distinguish legitimate automated activity from impersonation, credential abuse and unauthorised agents operating through customer accounts.
- API security: APIs are increasingly important enforcement points because agents use them to retrieve information, update records and initiate transactions.
- Human accountability: Enterprises need clear approval checkpoints, audit trails and escalation procedures for actions with significant business consequences.
Singapore is emerging as an important market for this discussion. IMDA’s Model AI Governance Framework for Agentic AI provides guidance on limiting agent autonomy, establishing human accountability and implementing technical controls across the agent lifecycle.
The competitive landscape includes application and API security providers, cloud security platforms, identity vendors and specialist AI security companies. Cequence’s positioning is focused on protecting applications and APIs while monitoring agent activity at runtime.
The opportunity will depend on whether security platforms can provide visibility and control across agents built internally, supplied by third parties or acting on behalf of customers.
Top Insights
- Cequence and KPMG examine how organisations can govern AI agents as they execute consequential actions across applications, APIs and customer accounts.
- Cequence tracked more than 250,000 agent visits across five industries in one week, with roughly one in seven performing customer activities.
- The report recommends defining specific agent responsibilities and checking every action through an independent runtime control mechanism.
- A controlled Cequence prototype study reported fewer out-of-scope actions and higher task completion after introducing job boundaries and action-level checks.
- Singapore’s agentic AI governance framework reinforces the need for bounded autonomy, meaningful human oversight and technical controls throughout deployment.
Power Tomorrow’s Intelligence — Build It with TechEdgeAI
