AmanTrue co-founder and CEO Evin McMullen
A passport is not a clever piece of paper. Anyone with a good printer and bad intentions can fake one. What makes it work is the government standing behind it, an authority that vouched for the holder and can withdraw that vouching the moment something goes wrong.
Evin McMullen has spent a decade thinking about that distinction. “Humans rarely trust each other directly; we trust the institutions that will hold someone to account if they lie,” says the co-founder and CEO of AmanTrue, who studied the anthropology of information systems at Yale before building digital identity products at Disco and Billions. AI agents, she argues, are being asked to earn trust the hard way, on their own merit. “That is like building in the void.”
Also Read: Southeast Asian tech leaders are learning to trust AI agents, but not with production
The timing of that argument is no accident. Singapore’s Infocomm Media Development Authority (IMDA) has rolled out a starter kit for testing AI agents, an accreditation scheme with five approved third-party testers and a frontier AI security taskforce. Its guidance examines what an agent does, which tools it touches and what sensitive data it can reach, not merely what it outputs.
Yet, as e27 has reported, nothing yet compels anyone to use accredited testing. And companies are already stuck. An Adobe survey of 461 Southeast Asian executives found that 18 per cent of AI proposals die at security review, while only 12 per cent of firms have an AI owner with budget authority.
AmanTrue, which launched a couple of weeks ago, is betting that the missing piece is not a better exam but a better passport.
Trust needs a chain of accountability
McMullen’s starting point is that agents are stochastic. “An agent cannot reliably earn trust behaving well in a demo,” she says. “The past is not necessarily prologue.” What agents need instead is what people already have: “someone accountable standing behind it, a clearly defined mandate, and a record of data and action that can be checked.”
That is the logic behind AmanTrue’s Agent Passport, a credential derived from the verifiable identity of whoever deploys the agent, and Border Control, a gateway that sits on the receiving system’s side and decides what an agent may ask and do.
An identity vendor arguing that testing is not enough is, of course, exactly what you would expect. McMullen concedes the point more readily than most. Pre-deployment testing, which she says Singapore does “unusually well”, catches whether a model reasons badly, misuses a tool or falls for a prompt injection. “A passport does none of that. It will happily identify a badly behaved agent.”
What identity covers, she argues, is the stretch after launch: who is accountable for a live agent, what it was authorised to do and proof of what it did, across systems the tester never saw. “Testing is about the agent’s competence before launch. Identity is about its authority and accountability after launch. You need both, and anyone who tells you one replaces the other is selling you half a solution.”
Whose border, whose rules
The harder test is cross-border, which in Southeast Asia is the default rather than the edge case. Picture an agent from a Singapore bank acting on a Malaysian insurer’s system, a scenario the region’s insurers are only beginning to confront.
In McMullen’s model, the receiving side is sovereign. “Border Control sits on the insurer’s side and enforces the insurer’s rules, not the bank’s.” The insurer chooses which issuers it trusts. When two registries disagree, she points to trust frameworks “built the way visa and correspondent-banking arrangements were built between countries over time”.
That analogy cuts both ways. Visa regimes and correspondent banking took decades of treaties, scandals and fines to mature. Agents are unlikely to wait that long.
Also Read: AI agents broke into 100 firms for pocket change. SEA’s online shops fit the target profile
On a subtler threat, an agent quietly firing hundreds of narrow yes-or-no questions to rebuild a record it was never meant to see, her answer is more concrete. Each field carries a rule, most probing questions are refused before they are answered, and every query is written to a ledger recording who asked, what was checked and which rule decided. “A flood of oddly specific questions from one agent is exactly the signal an audit or an anomaly check is there to catch.”
The answers that stayed vague
Not every question drew a straight reply. Asked why AmanTrue needed to be a company separate from Billions Network, McMullen offered a single line: “Different products, capabilities, users, and strategies.”
AmanTrue’s website names TikTok, Microsoft and HSBC as running technology the team built, while noting they are not AmanTrue customers. Asked how many paying institutional customers it has, and whether any are in Southeast Asia, the company said it “has not yet publicly disclosed our working relationships”.
On the Billions token, the answer was a firm no. AmanTrue does not depend on it and can run on a sovereign cloud, a national data centre or a client’s own servers. “We make independence a deployment fact, not a promise,” she said, adding that “any implication otherwise is a misunderstanding of our competence”. Banks and ministries will still ask, given the long-running debate over whether AI agents need crypto rails.
On the 2am scenario, a rogue agent and a revoked passport, no figure was offered. Revocation is enforced at the point of use, so the next check fails; how quickly depends on “the process of the issuer, the setup of the system, and the nature of the revocation protocol”. For a CISO who has read about the agent that lied, that latency is precisely the number they will want in writing.
AmanTrue also walks into a crowding field. Microsoft and Okta have extended their identity platforms to cover AI agents, card networks such as Visa and Mastercard are building protocols to authenticate agents that shop and pay, and “Know Your Agent” is fast becoming payments’ next compliance phrase. A newly launched specialist will have to show why a bank should not simply wait for its existing identity provider to add the feature.
Who signs the cheque
The Adobe numbers raise an awkward question for any vendor: if nobody owns the AI budget, who buys? McMullen calls that critique “half right”. Governance is a genuine bottleneck, she agrees, but the budget does have an owner: “whoever is accountable when an agent gets something wrong.” In a bank, that is the CISO and the chief risk or compliance officer; in government, the ministry that owns the service.
These are the people rejecting proposals at security review today. Her pitch is that provable actions give them a reason to say yes, and in doing so create the accountable owner the org chart lacks. “Rather than replace governance, the technology gives governance something tangible to enforce.” It echoes a wider regional shift, where AI governance is moving from promises to proof even as enterprises remain unsure who referees their agents.
Do not wait for the breach
Should Singapore make agent identity mandatory for regulated sectors? McMullen would not mandate a product, “mine included”. She would mandate an outcome: anyone deploying an autonomous agent against regulated systems must be able to prove which agent acted, on whose authority and what it did. The case for not waiting is blunt. Leaked personal or health data is something “you cannot un-leak”.
Also Read: Banks want AI agents to move money, as long as someone is accountable
She is candid about the conflict. “I have a commercial interest in that answer, so weigh it accordingly.”
That is fair advice. But her central observation holds regardless of who is selling the fix. Singapore has built a rigorous exam hall for AI agents. What it has not yet built is the border post, where every time an agent tries to act, someone checks whose name is on its passport.
The post AI agents need someone standing behind them, says AmanTrue CEO Evin McMullen appeared first on e27.