MAS AI Risk Management Guidelines: Why Financial Institutions Need Containment

A friend in Singapore told me he gets to Changi Airport about 30 minutes before his flight. He walks straight to his gate, clears security there, and boards. I let out an audible gasp.

I’d just spent a holiday in Singapore, so I can confirm the hype. Changi is the coolest airport I’ve been through. The indoor waterfall is the obvious showstopper, so let’s get that out of the way. Beyond it, travelers can wander between terminals, hang out at a bar, or let their kids burn off some energy.

What stayed with me, though, is where the real security check happens. In Terminals 1–3, it’s at the gate itself.

Many airports screen everyone once at the entrance, then trust the whole concourse. Changi puts the checkpoint at the destination. That’s the logic behind microsegmentation, and Changi has been applying it for years without calling it that.

Now swap the passengers for AI agents. They’re already inside the building, moving between systems, holding access to data, and acting on their own.

Singapore’s financial regulator has noticed. In its new Guidelines on Artificial Intelligence Risk Management for Financial Institutions, the Monetary Authority of Singapore (MAS) warns that compromised AI agents with access to internal systems could “exfiltrate sensitive data or execute malicious commands at scale.”

The guidelines expect firms to know where every AI system lives and who owns it. Then they point to the gate: network segmentation, environment separation, and least-privilege access.

That’s the real message for banks, insurers, and payment firms. Guardrails shape how an AI agent behaves. Containment decides how far it gets when a guardrail fails. MAS expects both, and the clock is already running.

MAS issued the guidelines on October 7, 2026. They take effect in two stages:

• October 7, 2027: oversight, AI identification, an AI inventory, and a risk rating for every use case
• October 7, 2028: life cycle controls, including technology and cybersecurity

They’re supervisory expectations, scaled to each firm’s size and how much AI it uses. That flexibility doesn’t lower the bar.

MAS AI guidelines read like a security checklist

The technology and cybersecurity controls will look familiar to any security team. Financial institutions should consider:

• Segmenting the network where AI is deployed (para 5.16(a))
• Separating environments and applying least-privilege access across the AI system, including its APIs, plugins, and third-party services (para 5.22(a))
• Controlling plugins and APIs so they can’t leak data (para 5.16(c))
• Locking down and logging access to AI systems, models, training data, and pipelines (para 5.23(d))
• Keeping a kill switch for high-risk AI (para 5.23(b))

The guidelines describe what to consider and leave the how to each firm. That’s where the hard decisions start.

Guardrails are the rules. The gate is the enforcement.

MAS takes guardrails seriously. Para 5.15 says testing for generative AI and AI agents should cover “the effectiveness of associated guardrails.” The guidelines also name prompt injection and data poisoning as security risks (para 1.10).

But a guardrail lives inside the system it’s meant to police. Guardrails catch most bad behavior, but some gets through. And an attacker’s input often reaches the guardrail at the same moment it reaches the model.

So ask the harder question: If an attacker took full control of this agent tomorrow, what could it reach? That answer is your real exposure.

The controls that hold up are the ones an agent can’t talk its way past. A gate doesn’t ask a passenger to behave. It simply doesn’t open for the wrong boarding pass. For an AI agent, that means enforcement outside the model: network policy and scoped access that apply no matter what the agent has been convinced to do.

A gate for every workload: microsegmentation for AI agents

What does a gate look like for an AI agent?

MAS names network segmentation and least-privilege access. Microsegmentation is how you enforce both, workload by workload. Every part of an AI system gets its own gate, including the application, the data it reads, the APIs and plugins it calls, and the systems an agent can reach. Compromise one, and policy decides how far it gets. Ideally, not far.

There’s a visibility piece, too. For AI agents, MAS suggests the inventory record “the tools and systems the agent can access” (footnote 25). You can’t write that down, let alone enforce it, if you can’t see how your workloads talk to each other. See first, then write the policy.

The Illumio Platform handles both halves. Illumio Insights gives security teams real-time, AI-powered visibility into how workloads communicate across data centers, clouds, and endpoints. Illumio Segmentation turns that visibility into policy that stops lateral movement. For AI workloads, the platform maps to the MAS guidelines in four places:

• See what your AI talks to. Illumio Insights maps the real connections between AI applications, models, data stores, and third-party services, including the ones nobody documented. That gives you a factual starting point for the 2027 inventory. It also helps surface shadow AI when an unfamiliar workload starts calling an external model or API.
• Limit what it can reach. Illumio Segmentation applies least-privilege policy around each AI component. A model can reach its training data, an agent can call the plugins it’s approved to use, and everything else is blocked by default. That covers segmenting the network where AI runs, separating environments, and keeping plugins and APIs from becoming a quiet exit for sensitive data.
• Shrink the blast radius. When a guardrail fails, policy keeps one failure to one incident. If a high-risk AI system needs to come offline fast, you can isolate it while the investigation runs. That gives the kill switch MAS recommends a backstop at the network level.
• Show your work. Supervisors will want evidence. Traffic flow records show which workloads connected to your AI systems, models, and data, and when. They also show red teams what a compromised component could reach. You can test containment as carefully as you test guardrails and keep the results on file.

Before the boarding call: 5 steps to prepare for MAS AI guidelines

The groundwork is due in 2027. The technical controls follow in 2028. Neither is far away.

1. Map what your AI connects to. Your 2027 inventory and risk ratings will need data sensitivity, system dependencies, and, for agents, what they can access.
2. Hunt for shadow AI. Footnote 22 points to network monitoring and data loss prevention for spotting unauthorized use.
3. Test containment alongside guardrails. Para 5.22(b) calls for penetration testing and red teaming across AI systems. Ask what a compromised component could reach.
4. Start where the risk is highest. MAS scales its expectations to risk, so put segmentation and least-privilege access around your highest-risk use cases first.
5. Check third-party AI and plugins. Para 5.16(c) calls for controls that restrict data exposure through plugins and APIs.

MAS AI guidelines come down to the gate

It’s tempting to read “guidelines” and a 2028 deadline as a problem for later. But the 2027 work already reaches shadow AI and AI embedded in vendor services. And when the AI comes from a vendor, accountability still stays with the institution.

Supervisors will measure firms against these expectations, and the Financial Stability Board has consulted on similar practices globally. Meanwhile, attackers won’t wait for a compliance date to go after the agents already inside your network.

Changi figured this out long before AI agents came along: know who’s on the manifest, and put the checkpoint at the gate. Financial institutions can apply the same logic to the agents already walking their concourse.

Aprenda como Illumio ajuda instituições financeiras contain breaches before they spread.