Memory makes agents useful. It also makes them vulnerable across sessions. When memory writes are not governed actions, contamination planted in a low-privilege session can activate in a high-privilege one — invisible to per-action evaluation at every step.
Multiple conversations. Multiple governance proposals. All of them pull governance away from the only place it can be enforced: the action boundary. The drift is not accidental — it is the industry's default.
Prompt injection is treated as a model safety problem. It is actually a governance failure. The injection succeeds at the model layer — but the action it produces should never have executed. The missing control is not a better filter. It is an enforcement boundary.
The governance debate stalls because policy, security, and monitoring use the same word for different problems. Separating the vocabulary reveals a gap none of them address: whether a specific action is permitted to execute, right now.
A common misunderstanding in AI systems: initiating a process is not the same as authorising every action that follows.
When governance is embedded in the agent framework, it is governed by the framework's lifecycle — not yours. Framework upgrades change governance behaviour. Framework removal eliminates governance entirely. Independent governance infrastructure survives the framework.
Governance decisions must be deterministic: same inputs, same decision, independently verifiable. If the evaluation depends on anything outside the canonical action, delegation, and policy, the decision cannot be reconstructed — and unreconstructable decisions are not governance.
Identity tells you who is acting. Delegation tells you what they are authorised to do, by whom, until when, and within what scope. Confusing the two is the root cause of the confused deputy problem — and autonomous AI systems reproduce it at scale.
Content filters evaluate what the model says. Governance evaluates what the system does. When the regulator asks for proof, the difference between the two is the only thing that matters.
The modern AI stack has a model layer, a tool layer, and a memory layer. Between intent and consequence — where an independent governance plane must exist — there is nothing but embedded constraints. The control plane is missing.
Software used to wait for instructions. Now it acts. When systems produce consequences autonomously, governance must precede execution — or it does not exist.
