100+ contributors from 13 countries defined global AI safety research priorities. 10 foundational principles for agentic risk management, each mapped to evidence procedures.
Who this is for: AI platform engineers, safety teams at GPAI model providers, compliance officers adopting consensus standards, Singapore-based AI deployers, regulators tracking international safety norms, and assessors evaluating agentic AI governance.
About the Consensus: The 2026 Singapore Consensus is the outcome of the second International Scientific Exchange on AI Safety. It builds on the 2025 report by adding a fourth pillar (Societal Resilience) and a dedicated companion report on agentic risk management. Contributors span frontier AI developers, government safety institutes, academia, and civil society across 13 countries.
The Consensus organizes AI safety research into four pillars. The 2026 edition adds Pillar 4 (Societal Resilience) and expands agent-specific guidance across all pillars.
| Pillar | Focus | SWT3 Coverage |
|---|---|---|
| 1. Capabilities and Alignment | Understanding and steering model behavior. Preventing misalignment at the training level. | AI-DRIFT.1 detects behavioral deviation from validated baselines. AI-SAFE.1 records safety boundary state. |
| 2. Robustness and Adversarial Resilience | Defending against adversarial inputs, prompt injection, and evasion attacks. | AI-SAFE.1 and AI-ROBUST.1 record safety and robustness testing evidence. |
| 3. Systemic Safety | Safety of interconnected AI systems. Multi-agent coordination risks. Cascading failures. | AI-CHAIN.1 traces agent-to-agent interactions. AI-MULTI.1 records multi-agent stability. |
| 4. Societal Resilience NEW IN 2026 | Preparing societal systems for AI failures and misuse. Institutional capacity to detect and respond. | AI-INCIDENT.1 records institutional detection and response. AI-HITL.1 records human oversight capacity. |
The companion report defines 10 foundational principles organized into three lifecycle phases. Each principle maps to one or more SWT3 procedures that produce evidence of adherence.
| # | Principle | Phase | SWT3 Procedures |
|---|---|---|---|
| 1 | Least Privilege | Design | AI-ACC.1 |
| 2 | Traceable Identity | Design | AI-ID.1 |
| 3 | Auditability | Design | AI-AUDIT.1 |
| 4 | Validated Deployment | Testing | AI-MDL.1 |
| 5 | Adversarial Resilience | Testing | AI-SAFE.1, AI-ROBUST.1 |
| 6 | Multi-Agent Stability | Testing | AI-CHAIN.1, AI-MULTI.1 |
| 7 | Runtime Assurance | Operation | AI-GRD.1 |
| 8 | Interruptibility | Operation | AI-HITL.1 |
| 9 | Legibility | Operation | AI-EXPL.1, AI-TRANS.1 |
| 10 | Human Oversight | Operation | AI-HITL.1, AI-HITL.2 |
The Consensus requires that AI agents are granted only the permissions they need to accomplish their assigned task, and no more. This is the same principle that governs human access control in enterprise systems, applied to autonomous agents. AI-ACC.1 anchors record every access control decision, making it verifiable that the agent operated within its authorized scope.
Assessor Tip
Verify AI-ACC.1 anchors show default-deny access control. Query for the agent's permission set and compare against its actual access patterns. If the agent accessed resources beyond its defined scope, or if the permission set is broader than what the task requires, that violates least privilege. The Consensus explicitly requires minimum necessary permissions.
The Consensus requires that each agent in a multi-agent deployment has a traceable identity that persists across sessions and interactions. Without identity, there is no accountability -- you cannot determine which agent did what. AI-ID.1 anchors bind a unique agent identifier to every witness record the agent produces.
Assessor Tip
AI-ID.1 anchors must uniquely identify each agent in a deployment. Check that agent_id values are consistent across sessions and that no two agents share an identifier. The Consensus requires identity to persist across sessions -- if an agent's ID changes between restarts, traceability is broken.
The Consensus requires that agent behavior can be audited after the fact by parties who were not involved in the operation. AI-AUDIT.1 anchors provide cryptographic integrity verification of the evidence chain. Any party with the original factors can verify that anchors have not been tampered with, using the public verification endpoint or the open-source SDK.
Assessor Tip
Auditability means independent verifiability. Use the public verification endpoint to confirm a sample of anchors without contacting the operator. If verification passes, the evidence is trustworthy. If it fails, the chain has been compromised. The Consensus requires evidence to be independently verifiable -- self-reported compliance logs do not satisfy this principle.
The Consensus requires pre-deployment validation confirming that the model entering production is the same model that passed safety evaluation. AI-MDL.1 anchors record model version identifiers and weight hashes, creating a verifiable link between the evaluated model and the deployed model.
Assessor Tip
AI-MDL.1 anchors prove the deployed model matches the approved hash. Compare the model hash in production anchors against the hash recorded during evaluation. If they differ, the deployed model was not the one that passed testing. This is a critical finding -- it means the safety evaluation does not apply to what is actually running.
The Consensus requires demonstrated adversarial resilience through red teaming and robustness testing. AI-SAFE.1 and AI-ROBUST.1 anchors record safety and robustness test events, proving that adversarial testing occurred and documenting the results.
Assessor Tip
Query AI-SAFE.1 and AI-ROBUST.1 anchors for red team testing events. The Consensus requires demonstrated resilience, not just a passing evaluation. Look for: frequency of adversarial testing, coverage of attack scenarios, and whether any FAIL anchors were generated during testing. A system with zero FAIL anchors from red teaming either was not tested rigorously or is not recording honest results.
The Consensus requires stability guarantees for multi-agent systems -- that adding or removing agents does not cause cascading failures, and that agent-to-agent interactions remain predictable. AI-CHAIN.1 traces inter-agent communication. AI-MULTI.1 records multi-agent system state and stability metrics.
Assessor Tip
Multi-agent stability is tested, not assumed. Query AI-CHAIN.1 anchors for a representative period and look for: how many agents participated, whether any agents were added or removed, and whether handoff patterns changed. AI-MULTI.1 anchors record system-level stability. The Consensus requires that coordination does not degrade under scale.
The Consensus requires real-time safety monitoring during operation -- not just pre-deployment testing. AI-GRD.1 anchors record guardrail state at inference time, proving that safety mechanisms were active when the model was serving predictions.
Assessor Tip
Runtime assurance means guardrails are active in production, not just in testing. Query AI-GRD.1 anchors for the production deployment. If guardrail anchors exist during evaluation but disappear after deployment, runtime assurance is not being maintained. The Consensus explicitly distinguishes between testing-time and runtime safety.
The Consensus requires that agents can be interrupted by humans at any point during execution. This is not just a technical capability -- it must be exercised and verified. AI-HITL.1 anchors record human interrupt events, proving that the override mechanism works in practice, not just in theory.
Assessor Tip
Interruptibility must be exercised, not just designed. Ask: "Show me AI-HITL.1 anchors where a human interrupted an active agent execution in the last 90 days. How quickly did the agent stop?" If the interrupt capability has never been exercised in production, you cannot verify it works. The September 2026 OpenAI incident showed that automatic shutdown mechanisms can fail.
The Consensus requires that agent behavior can be understood by the humans responsible for it. AI-EXPL.1 anchors record explanations generated for model decisions. AI-TRANS.1 anchors record transparency disclosures made to affected parties. Together, they prove that the system's behavior was made legible to the relevant audiences.
Assessor Tip
Legibility serves two audiences: operators and affected parties. AI-EXPL.1 serves operators (why did the model do this?). AI-TRANS.1 serves affected parties (you are interacting with AI). Both must be present. A system with explanation anchors but no transparency anchors is legible to operators but not to users -- which may violate EU AI Act Article 50 or equivalent transparency requirements.
The Consensus requires that human oversight is not just possible but practiced. AI-HITL.1 records human oversight events. AI-HITL.2 records human override decisions where the human changed the model's output. The combination proves that humans are not just watching but actively governing.
Assessor Tip
The Consensus requires meaningful control, not passive monitoring. Look for AI-HITL.2 anchors (override decisions) in addition to AI-HITL.1 (review events). If HITL.1 exists but HITL.2 is consistently zero, humans are reviewing but never overriding -- which may indicate rubber-stamp oversight. Ask: "In the last 90 days, how many times did a human change a model output? What triggered those interventions?"
pip install swt3-aifrom swt3_ai import Witness
witness = Witness(
api_key="your-api-key",
agent_id="singapore-consensus-agent" # Principle 2: Traceable Identity
)
# Wrap your AI client -- runtime assurance (Principle 7)
client = witness.wrap(openai.OpenAI())
# Principle 1: Least Privilege -- record access decisions
witness.wrap_access(
resource="customer_database",
action="read",
decision="allow"
)
# Principle 8: Interruptibility -- record human override
witness.wrap_access(
resource="model_output",
action="override",
decision="allow"
)
# Flush -- Principle 3: Auditability
witness.flush()npm install @tenova/swt3-aiimport { Witness } from '@tenova/swt3-ai';
const witness = new Witness({
apiKey: 'your-api-key',
agentId: 'singapore-consensus-agent', // Principle 2: Traceable Identity
});
// Wrap your AI client -- runtime assurance (Principle 7)
const client = witness.wrap(new OpenAI());
// Principle 1: Least Privilege -- record access decisions
await witness.wrapAccess({
resource: 'customer_database',
action: 'read',
decision: 'allow',
});
// Principle 8: Interruptibility -- record human override
await witness.wrapAccess({
resource: 'model_output',
action: 'override',
decision: 'allow',
});
// Flush -- Principle 3: Auditability
await witness.flush();