Model AI Governance Framework for AI: What Businesses Must Know Before Deploying

What Will You Learn?

If you are piloting AI agents, or about to, here is what matters most before you switch anything on.

KEY STAT: Key points at a glance

Singapore published the world’s first governance framework built specifically for AI agents on 22 January 2026, and refreshed it in May 2026 after industry feedback.

The guidance is organised around four questions: is this task suitable, who is answerable, what stops the agent technically, and are our people equipped.

Agents raise the stakes because their mistakes land in the real world. A bad sentence is annoying. A bad transaction is expensive.

The most important practical shift is to constrain agents through permissions and access control rather than by asking them nicely in a prompt.

Oversight only counts if it is real. Watch for automation bias, the drift towards approving whatever a reliable-looking agent proposes.

Governance is a speed advantage, not a tax: Gartner expects more than 40% of agentic AI projects to be cancelled by the end of 2027, partly for weak risk controls (Gartner, 25 June 2025).

What Is the Model AI Governance Framework for Agentic AI?

The Model AI Governance Framework for Agentic AI is a practical, non-binding governance guide for any organisation deploying AI agents, whether built in-house or bought from a vendor.

It was developed by Singapore’s Infocomm Media Development Authority (IMDA) and announced by Minister for Digital Development and Information, Mrs Josephine Teo.

Singapore launched it at the World Economic Forum in Davos on 22 January 2026, describing it as the first framework of its kind anywhere in the world.

International coverage agreed, with Computer Weekly calling it the world’s first governance framework for agentic AI.

Source: Infocomm Media Development Authority

Crucially, it is a living document. IMDA published Version 1.0 in January 2026, then released an expanded Version 1.5 in May 2026 after incorporating feedback and case studies from more than sixty companies.

SINGAPORE INSIGHT: Why Singapore moved first

Singapore has spent close to a decade building a reputation for AI governance that is usable rather than aspirational: guardrails that hold without smothering innovation.

The agentic framework is the newest layer in that approach, sitting alongside the country’s AI Safety Institute and its chairmanship of the ASEAN Working Group on AI Governance.

For businesses here, that means the guidance is unusually concrete and locally grounded, rather than imported wholesale from another jurisdiction.

How the framework builds on Singapore’s earlier AI governance

The agentic framework did not appear out of nowhere. It is the third instalment in a clear lineage.

• 2019 to 2020: Model AI Governance Framework (traditional AI). Singapore released its first Model Framework in 2019 and a second edition in 2020, focused on AI that makes predictions from historical data.
• 2024: Model AI Governance Framework for Generative AI. IMDA and the AI Verify Foundation added nine dimensions for generative AI, covering issues such as hallucination, content provenance, and accountability.

Source: Verify Foundation

• 2026: Model AI Governance Framework for Agentic AI. The newest framework extends those foundations to AI that plans and acts autonomously (IMDA).

The through-line is consistent. Familiar principles such as transparency, accountability, and fairness still apply, but they have to be translated into practice for systems that now take real-world action.

Who the framework is for

The framework is aimed at organisations that deploy agentic AI, and it deliberately covers two paths.

• Businesses are building their own agents in-house, using tools, memory, and planning around a language model.
• Businesses are adopting third-party agentic solutions, where visibility and control are more limited.

That breadth matters for Singapore’s economy, where a large share of adopters are SMEs and lean teams buying agentic features inside software they already use, rather than engineering agents from scratch.

Whichever path you are on, the framework’s value is the same: a shared vocabulary and a structured checklist for the decisions you were going to have to make anyway. If you are mapping your broader adoption plan, our guide to an AI roadmap every growing business needs pairs naturally with this framework.

Understanding Agentic AI Before You Govern It

You cannot bound a risk you do not understand, so the framework starts by explaining what actually makes an agent tick.

I don’t treat this as academic because the parts of an agent map directly to the places where things go wrong.

The anatomy of an AI agent

An agent is a software system built on a language model, with extra components that let it plan and act over multiple steps toward a goal you set.

The framework describes the core building blocks in plain terms.

Source: IMDA, Model AI Governance Framework for Agentic AI, Version 1.5

Here’s the pattern I want you to notice. The components that make an agent powerful (its tools, its memory, its autonomy) are exactly the components that create new risk.

If you want a deeper mental model of how these pieces fit together, our explainer on how agentic AI works and the frameworks you can apply complement the governance view here.

Action-space versus autonomy

The framework offers two ideas I’d genuinely ask you to memorise, because almost every governance decision flows from them.

• Action-space is the range of things an agent can do, decided by the tools it can use and the permissions on those tools. A read-only agent has a small action space; an agent that can write to a production database has a large one.
• Autonomy is how much freedom the agent has to decide its own steps, determined by its instructions and the level of human involvement.

Risk climbs as either dial turns up.

A high-autonomy agent with a large action space (for example, one that can browse the web, write code, and deploy it unsupervised) is the riskiest combination, and the framework treats it accordingly.

WATCH OUT: The computer-use agent warning

The framework flags a fast-emerging category worth watching: agents whose main tool is simply a computer and a browser.

Because such an agent can click, scroll and type the way a person does, it inherits almost every action a person could take, without anyone having to define those actions as tools.

That flexibility quietly widens its action-space, which is why it warrants tighter limits and closer supervision than a narrowly scoped agent.

Where do the new risks come from

The risks in agentic AI are mostly familiar. Agents are software built on language models, so they inherit both classic software vulnerabilities and model-specific problems such as hallucination, bias, and prompt injection.

What changes is how those risks show up, because now they end in actions. The framework groups the possible harms into five types.

Multi-agent systems raise the stakes further. When several agents interact, new failure modes appear.

• Agent sprawl, where agents proliferate without central management, creates an untracked shadow workforce.
• Miscoordination and conflict, where agents interpret the goal differently or optimise against each other (imagine a refund agent and a revenue-protection agent at war).
• Cascading effects, where one hallucinated figure early in a chain snowballs into a big downstream mistake.

None of this means agents are unsafe to deploy, and I want to be clear about that. It means they must be deployed deliberately, which is precisely what the four dimensions are designed to help you do.

Dimension One: Assess and Bound the Risks Upfront

The first dimension is about doing your thinking before the agent is live, not after.

It has two moves: choose the right use case, then design limits that shrink the damage if something goes wrong.

Choosing suitable use cases

Not every task should be handed to an agent. Some are better served by plain, deterministic automation.

The framework frames risk as a function of likelihood (how probable a failure is) and impact (how bad it would be).

It then lists concrete factors that push it up.

The practical takeaway, in my experience, is a habit, not a form: Before deploying, score each use case honestly against these factors, and be willing to conclude that some tasks are simply not ready for an agent yet.

CASE EXAMPLE: Dayos: Tiering IT tickets by risk

Dayos, an enterprise AI automation company headquartered in Singapore with operations in the United States, replaced its internal IT service management platform with an agentic ticketing system. Its deployment is documented as a case study in the updated framework.

Before switching anything on, it scored every ticket type against three questions: how badly would a mistake hurt, could the action be undone, and is meaningful human oversight realistic at that volume.

Those scores produced graded autonomy. Low-severity, fully reversible work such as password resets runs automatically, with periodic audits. Moderate-severity work is diagnosed by the agent but executed only after an engineer approves. The highest-severity actions stay entirely in human hands.

That is the first dimension working exactly as intended: autonomy is rationed according to what a mistake would cost.

Bounding risk through design

Once you have a suitable use case, you shrink the risk by designing limits into the agent from the start.

The framework recommends bounding three things.

• Access to tools and systems. Apply least privilege: give the agent only the tools and data it genuinely needs. A coding assistant with curated documentation may not need open web search at all.
• Autonomy. For process-driven work, give the agent a standard operating procedure to follow rather than freedom to invent every step.
• Area of impact. Build in ways to take an agent offline quickly, and run high-risk tasks such as code execution in self-contained environments.

PRO TIP: Bound by design, not by prompt

If you take one thing from the whole framework, I’d make it this: A limit that lives in a prompt is a request, and a limit that lives in your access layer is a rule.

Do not tell an agent to avoid a tool. Remove its permission to call that tool, so the question never arises.

Prompt-level instructions can be forgotten, overridden or argued around. System-level controls behave the same way on the worst day as on the best one.

CASE EXAMPLE: Bank of Singapore: bounding autonomy in private banking

Bank of Singapore, the private banking arm of OCBC, has deployed an agentic tool called the Source of Wealth Assistant (SOWA) inside its Know-Your-Customer workflow. This is a confirmed production deployment, announced by the bank itself.

Relationship managers previously read hundreds of pages of financial statements, tax notices, property records, corporate filings and payslips to write a single Source of Wealth report. The bank reports that preparation time fell from around ten days to roughly one hour.

The bounding is the interesting part. The agent extracts, structures, synthesises and flags gaps. It does not decide. Relationship managers review and refine every draft before it reaches internal compliance under the bank’s anti-money-laundering framework.

It is a strong illustration of a high-value use case kept firmly inside safe limits: real autonomy on the assembly of evidence, zero autonomy on the judgement.

Giving every agent an identity

For humans, we manage risk with identity: logins, permissions, and audit trails. Agents need the same, and this is an area the framework flags as still maturing.

The recommended practice is that every agent should have an identity that is:

• Unique, with its own cryptographically verifiable credential.
• Accounted for, tied to a supervising agent, a human, or a department.
• Scoped and least-privilege, with permissions that are time-bound, non-transferable, and never greater than those of the human who authorised it.
• Centrally catalogued, so you can find, audit, and retire agents and avoid agent sprawl.

One rule of thumb is worth repeating: an agent should never be able to do more than the person it acts for. If a staff member cannot access a dataset, neither should their agent.

SINGAPORE INSIGHT: Residual risk is normal, and must be owned

The framework is refreshingly honest that careful design never gets you to zero. Something always remains.

That leftover is residual risk, and the job is not to eliminate it but to decide, deliberately, whether you can live with it.

For Singapore boards and senior management, that decision should be documented and owned by a named person, not absorbed quietly into a project sign-off.

Dimension Two: Make Humans Meaningfully Accountable

Agents may act on their own, but accountability does not transfer to them. The humans and organisations behind an agent remain responsible for what it does.

The word I’d underline here is meaningful. A human who blindly clicks “approve” is not oversight; they are a rubber stamp.

Allocating responsibility across teams and vendors

Agentic AI has a value chain, so accountability has to be allocated across it: model developers, platform providers, tooling providers, system builders, deployers, and end users.

Within your own organisation, the framework suggests mapping responsibilities across four groups.

When agents come from external vendors, the framework is blunt about the gaps. Third-party agents can be opaque, so you should clarify obligations in contracts, demand transparency on capabilities and data handling, and evaluate their security controls before you trust them.

If a vendor can’t show you scoped credentials and logging, I read that as a signal to scope the use case down, not to proceed on faith.

CASE EXAMPLE: PwC Singapore: accountability by role

PwC Singapore’s AI Factory built an agentic system that drafts the research and analysis sections of internal reports using three coordinated agents.

Rather than leaving accountability vague, it named the roles: a use-case owner confirms the business need and responsible use, a technology risk function advises on controls, the AI Factory builds and monitors, and subject-matter reviewers approve every output.

The rule communicated to staff is deliberately unambiguous. Anything the system produces is a first draft that supports professional judgement, never a substitute for it.

Source: IMDA, Model AI Governance Framework for Agentic AI, Version 1.5 case studies; summarised in Rajah & Tann Asia.

Designing for meaningful human oversight

Continuous human review of every agent action does not scale. So the framework asks you to be selective and design oversight where it counts.

Define significant checkpoints that require human approval, especially for:

• High-stakes actions, such as decisions in healthcare or legal contexts, or anything that creates liability.
• Irreversible actions, such as deleting data, sending communications, or making payments.
• Outlier behaviour, such as an agent reaching outside its normal scope.

Just as important is the form of approval. Keep requests short, contextual, and honest about the risk, and match the input to the stakes: a simple approve or reject for routine actions, an edited plan for complex ones, a written justification for high-risk ones.

WATCH OUT: Automation bias is the silent failure

IMDA names the problem directly, describing automation bias as “the tendency to over-trust an automated system that has performed reliably in the past” (MDDI and IMDA, 22 January 2026).

The remedy the framework proposes is to audit oversight the way you audit anything else, using measurable signals.

Two are easy to instrument: the human override rate, where an unusually low number suggests rubber-stamping, and approval response time, where suspiciously fast approvals suggest nobody is really reading.

This is where agentic governance meets a human-skills challenge and why the framework repeatedly stresses training. Oversight only works if the overseer has the domain expertise to spot when the agent is wrong.

CASE EXAMPLE: Tencent and X0PA: oversight that respects the human

Tencent’s CodeBuddy coding agent grades its approval requests to match the risk. Reading a file needs nothing, editing a file needs approval for the session, and shell commands or network calls need approval every single time. It also translates complex commands into plain language before asking.

X0PA, an AI recruitment company, keeps humans at the two moments that matter most, shortlisting and final selection. Recruiters see explainable match scores, and are trained specifically on where the agent tends to misread non-linear career histories.

Both are solving the same problem: make an approval cheap to give well, so that oversight stays genuine instead of becoming fatigue.

Source: IMDA, Model AI Governance Framework for Agentic AI, Version 1.5 case studies.

Getting oversight right is as much about people as technology, which is why many Singapore teams pair agentic rollouts with structured upskilling. Our guide to implementing AI in your organisation without the tech overwhelm is a useful companion for building that internal capability.

Dimension Three: Implement Technical Controls and Processes

The third dimension is where, to my mind, governance becomes engineering. It covers the controls you build in, the testing you do before launch, and the monitoring you run afterwards.

Building controls into design and development

Agents need controls beyond those for a simple chatbot, because they have new components (planning, tools, protocols) and a larger attack surface.

The single most useful distinction the framework draws, and the one I come back to most, is between two kinds of control.

• Structural, rule-based controls operate at the system level through fixed logic. For higher-risk actions, prefer these. Blocking a tool at the access-control layer beats instructing the agent not to use it.
• Model-based or prompt-layer controls rely on the model behaving as told. They are useful for fuzzy risks such as detecting harmful content, but they are less reliable and inconsistently applied.

Add runtime controls on top, such as rate limits and input validation, because static safeguards set at design time cannot catch everything an agent meets in the wild.

PRO TIP: MCP can be a governance layer, not just plumbing

Many agents connect to tools through the Model Context Protocol (MCP), usually thought of as connectivity.

Because MCP sits between the agent and your systems, it can double as a governance checkpoint.

Consider using it to filter sensitive data, log every agent-to-system interaction, and whitelist only trusted servers.

CASE EXAMPLE: Terminal 3 and Cyber Sierra: controls that hold

Terminal 3 runs a payroll agent that handles sensitive salary and bank data. It keeps that data inside a hardware-secured environment the agent never sees, routes every action through hardware checks against a pre-authorised budget, and records each step on a tamper-proof ledger.

Cyber Sierra, a Singapore governance-risk-and-compliance company, built an agent that answers security questionnaires. To curb hallucination, it added reflection steps where the agent critiques its own output and a structured knowledge graph that only surfaces current, non-expired documents.

Both cut risk through architecture, not wishful prompting.

Testing agents before deployment

Testing a chatbot means checking its answers. Testing an agent means checking its actions, which is a harder problem.

The framework asks you to test for new dimensions.

• Task execution: can the agent complete the task accurately, end to end?
• Policy compliance: does it follow the SOP and escalate for human approval when required?
• Tool calling: does it call the right tools, with the right inputs, in the right order?
• Robustness: how does it handle errors and edge cases?

Test the whole workflow, not just the final output. Test agents individually and together, since multi-agent behaviour brings emergent surprises. And test repeatedly, because agent behaviour is stochastic: the same input will not always produce the same result.

CASE EXAMPLE: Google and the Singapore Government: testing computer-use agents

Google, CSA, GovTech, and IMDA ran a joint sandbox to test computer-use agents on public-sector tasks such as automated quality assurance and social-assistance applications.

The exercise surfaced practical lessons: use realistic data and environments, log the agent’s reasoning at every step, and specifically test for indirect prompt injection, where a malicious website hijacks the agent.

In one case, the agent over-shared personal details it should have withheld, a failure that only detailed step-by-step logging could catch.

Monitoring and change management after launch

Pre-launch testing sets a baseline. It does not cover everything, because agents adapt to a changing world. So the framework leans heavily on continuous monitoring and staged rollout.

• Roll out gradually. Start with trained users, whitelisted tools, and low-risk internal systems, then widen as confidence grows.
• Monitor continuously. Log agent actions, set alert thresholds, use anomaly detection, and keep audit trails immutable.
• Fail safe. When approval infrastructure breaks or a novel action appears, deny by default rather than let the agent proceed.
• Manage change. In complex systems, a small tweak can cascade, so define triggers for a change review and size the review to the risk.

CASE EXAMPLE: GovTech: a phased rollout of coding assistants

From October 2025, GovTech rolled out agentic coding assistants (Windsurf and GitHub Copilot Agent Mode, later Claude Code) using a deliberately phased approach.

The first phase contained the blast radius: internal employees only, no external tool connections, and low-risk systems only.

While that ran, GovTech built central logging, a managed connection framework for approved tools, and red-teamed its guardrails before widening access.

It is a textbook illustration of empowering teams early while growing controls in step with capability.

Dimension Four: Enable End-User Responsibility

The final dimension recognises a truth that, in my experience, technology-led governance often forgets: safe deployment depends on the people using the agent, not only the people who built it.

The framework splits end users into two groups with different needs.

For users who simply interact with an agent, focus on transparency. Tell them clearly that they are dealing with an agent, what it can and cannot do, how their data is used, and who to escalate to if it goes wrong.

For users who build agents into their work, layer on education and training, covering how to instruct agents, how to spot common failure modes such as hallucinations, and how to exercise real oversight.

WATCH OUT: The quiet risk: losing your tradecraft

The framework raises a subtle danger it calls tradecraft loss.

As agents take over entry-level tasks, the basic skills that staff once learned by doing them can quietly erode.

That becomes a business-continuity risk: when the agent fails or is unavailable, will anyone still know how to do the work by hand?

The remedy is deliberate: identify the core skills of each role and keep training people in them, even where agents are prevalent.

CASE EXAMPLE: Workday and Ant International: informing and empowering users

Workday makes its HR and finance agents clearly identify as AI, publishes factsheets on what each agent can and cannot do (it will summarise candidates, but not make hiring decisions), and shows the reasoning behind sensitive recommendations.

Ant International goes further on the build side, letting users describe agentic workflows in plain language, review the plan before it becomes code, and rely on built-in verification steps that catch cascading errors.

Both treat users as responsible partners, and give them the information to act like one.

For Singapore employers, I’d frame this dimension as a reminder that agentic AI is a workforce programme as much as a technology one. Exploring the agentic AI tools quietly transforming how businesses operate with your team is a sensible way to build shared literacy before you scale.

A Pre-Deployment Checklist for Singapore Businesses

The four dimensions are comprehensive, but I know that on a busy Monday you need something you can actually run through. Here is a practical distillation.

Before you build or buy

1. Write down the specific task, and ask honestly whether it needs an agent or whether plain automation would do.
2. Score the use case on impact and likelihood using the framework’s risk factors, then decide if the residual risk is acceptable.
3. Confirm you can answer: what is the worst thing this agent could do, and how quickly could we stop it?

As you design

1. Apply least-privilege to every tool and dataset, and enforce limits with system controls, not prompts.
2. Give each agent a unique, catalogued identity whose permissions never exceed its authorising human’s.
3. Define the human approval checkpoints for high-stakes, irreversible, and outlier actions.

Before you launch

1. Test the full workflow, including tool calls and reasoning, across varied and realistic data, and run it more than once.
2. Red-team for prompt injection and tool misuse, especially if the agent touches external systems.
3. Confirm your fail-safe: the agent denies action by default when approvals are unavailable.

After you go live

1. Roll out gradually, starting with trained users and low-risk systems.
2. Monitor continuously, track override rates and response times, and keep immutable logs.
3. Train and retrain users, and protect the core manual skills the agent might otherwise erode.

How the Framework Fits Singapore's Wider AI Governance Landscape

The agentic framework is powerful, but it does not stand alone. It sits inside a wider Singapore governance ecosystem, and understanding that context helps you comply with everything that applies to you.

Several instruments interlock.

• The Model AI Governance Framework family. The 2019 and 2020 frameworks for traditional AI, the 2024 framework for generative AI, and now the 2026 framework for agentic AI form one continuous approach.
• AI Verify and the Global AI Assurance Pilot. IMDA and the AI Verify Foundation provide testing tools and, from February 2025, a pilot codifying norms for the technical testing of AI systems.
• The MAS AI risk guidelines. For financial institutions, the Monetary Authority of Singapore has consulted on proposed guidelines on AI risk management, setting regulatory expectations that extend to generative and agentic AI (see also this legal summary).
• The CSA guidance on securing AI. The Cyber Security Agency of Singapore has published guidelines and a companion guide on securing AI systems, including material on the security risks specific to agentic AI, which the framework draws on directly (see also Computer Weekly’s coverage).
• PDPC personal-data guidance. The Personal Data Protection Commission’s advisory guidelines on the use of personal data in AI recommendation and decision systems remain relevant wherever agents touch personal data.

SINGAPORE INSIGHT: Regional and global reach

Singapore is not governing agentic AI in isolation. It leads the ASEAN Working Group on AI Governance and works through its AI Safety Institute with other countries.

For businesses operating across Southeast Asia, aligning to this framework is a sensible bet on where regional norms are heading.

If security governance is your entry point, it is worth reading this alongside our explainers on the Cybersecurity Act in Singapore and the NIST Cybersecurity Framework in plain English, both of which share the framework’s risk-based logic.

Common Pitfalls to Avoid When Deploying Agentic AI

Reading the framework is one thing. Avoiding the traps that sink real projects is another. Here are the mistakes I see most often.

Falling for agent washing

Source: Gartner press release, 25 June 2025

Not every product badged “agentic” truly is. In its 25 June 2025 press release, Gartner estimated that only around 130 of the thousands of vendors marketing agentic AI are the real thing, and named the rest agent washing. Scrutinise vendor claims, and ask for evidence of genuine autonomy and genuine controls.

Trusting the prompt to keep you safe

A prompt instruction is a request, not a rule. If a limit matters, enforce it structurally so the agent cannot cross it even if it wanted to.

Building one all-powerful agent

A single agent holding broad access is a large and tempting target. Prefer several narrowly scoped agents with separate permissions, so that compromising one does not hand over everything.

Rubber-stamping approvals

Human-in-the-loop is worthless if the human always clicks yes. Audit your override rates, and design approval requests that make the risk genuinely visible.

Skipping the residual-risk decision

Some risk always remains. Deciding it is acceptable is a real, accountable choice that a named person should own, not a box that quietly goes unticked.

Treating governance as a one-off gate

Agents change as their environment changes. Governance is a loop of assess, deploy, monitor, and re-assess, not a single sign-off before launch.

PRO TIP: Turn the pitfalls into questions

Before your next agentic deployment, ask five questions in a review meeting:

Is this vendor genuinely agentic? Are our limits structural or just prompts? Have we split high-risk powers across agents? Are our approvals real or reflexive? And who owns the residual-risk decision?

If you cannot answer all five confidently, you are not ready to deploy.

These habits also protect your wider security posture, which is why agentic governance belongs inside, not beside, your broader plan. Our guide to the cybersecurity roadmap every Singapore organisation needs shows how the two fit together.

Conclusion

Agentic AI is the most capable, and the most consequential, form of AI most Singapore businesses will deploy this decade.

The temptation, and I’ve watched teams give in to it, is to race ahead and wire agents into live systems because a demo looked impressive, which is precisely how a promising pilot becomes an expensive incident.

The wiser move, and the one I think the evidence supports, is to deploy with intent, and Singapore has handed you an unusually clear map for doing exactly that.

The Model AI Governance Framework for Agentic AI takes a daunting question, how do we deploy this safely, and turns it into four decisions you can actually work through: assess and bound the risk before you build, keep humans meaningfully accountable rather than nominally in the loop, enforce your limits through architecture instead of instructions, and equip the people who will use the thing every day.

Do that, and governance stops behaving like a brake. It becomes the reason you can move quickly with confidence, while others stall inside the 40% of agentic AI projects Gartner expects to be cancelled by the end of 2027 (Gartner, 25 June 2025).

The organisations that will win with agentic AI aren’t, in my view, the ones that adopt it first. They’re the ones that adopt it responsibly, and keep their own judgement sharp while the technology keeps moving.

If you want to move from understanding this framework to confidently building and governing agents inside your own organisation, the natural next step is structured, practitioner-led training. Enrol in Equinet Academy’s Agentic AI Course to work hands-on through how agents are designed, bounded, deployed and supervised.

It is the logical bridge between the governance principles in this article and the practical skill of putting safe, well-bounded agents to work. If your team needs the broader foundation first, the Certified AI Practitioner (Business & Work Applications) programme is the sensible starting point.