What the governance plane is actually authorizing
Authorization decisions in agentic systems are not what they appear to be. From the governance plane’s perspective, a PreToolUse hook fires, the agent’s current tool parameters are visible, and the decision looks well-informed. Approve or deny. The governance plane has done its job.
What the governance plane has not seen is the memory state that produced the tool call. What the agent retrieved in the prior turn. What it inferred from that retrieval. What constraints it is operating under — or believes it is operating under — based on what has accumulated in its context. The tool call is the output of a process the governance plane did not witness. Authorizing the tool call without witnessing that process is not governance of behavior. It is governance of declared intent at the moment of a single action.
This is the consistency problem in its simplest form: the governance plane and the execution plane have access to different versions of the agent’s context. The execution plane has the full accumulation. The governance plane has whatever was surfaced to it — which, absent deliberate instrumentation, is the tool name and its parameters at the moment of interception. Nothing more.
It is worth being precise about what kind of failure this is. Traditional governance planes were built around access and authorization: who can do what, under which conditions. They were not designed for behavioral-state continuity — for verifying that the context an agent is operating on at turn forty is consistent with the context the governance plane authorized at turn one. That is a different control domain. The consistency problem lives there, not in the access layer. Recognizing the distinction matters because it shapes the instrumentation required to address it.
A governance plane that can only see tool calls is authorizing actions it cannot situate in the behavioral history that produced them. The agent’s memory — what it retrieved, inferred, and accumulated — is the context that makes any individual tool call meaningful or anomalous. Without that context, the governance plane is pattern-matching on surface behavior while the underlying state remains invisible.
What compaction does to governance
Every agentic session that runs long enough will compact its context. The mechanism is architectural necessity: the context window has a fixed limit, and as the session accumulates tool calls, retrievals, and reasoning traces, older content must be cleared to make room for new input. Anthropic’s Claude Code architecture documents this clearly: older tool outputs are cleared first, then the conversation is summarized if needed to stay within the context budget.
The compaction event itself is not the governance problem. The governance problem is that compaction is invisible to callers outside the execution loop. Recent SDK discussion has surfaced this directly: output behavior can shift after compaction even when no explicit policy was lost. Vocabulary use, topic focus, and response patterns can change silently. The governance plane authorized a session with a specific behavioral baseline. After compaction, that baseline may have shifted — and the governance plane has no instrumentation to detect it.
The write-time compression failure
The research literature has named a deeper version of this problem. When memory is compressed at write time — when the system must decide what to retain before it knows what future queries will require — specific constraints get lost to generic summaries. A named compliance constraint becomes a general policy note. A specific retrieval instruction becomes a broad behavioral directive. The precise becomes approximate.
This is not an occasional summarization error. It is the structural consequence of any fixed-budget compression system operating under uncertainty. As MemArchitect (arXiv:2603.18330) identifies, current agentic memory architectures treat memory as a passive append-only log, lacking mechanisms to enforce governance at compression boundaries. When the agent cannot trace a specific constraint from its compressed memory, neither can the governance plane. The authorization decision that follows is made against a context that has silently degraded from the one that was approved.
The provenance-aware tiered memory framework (arXiv:2602.17913) frames this as the difference between lossy and verified memory: systems that compress irreversibly produce unverifiable omissions. When an agent cannot trace the original constraint, that is a structural risk, not an occasional error.
Fixed-budget compression forces irreversible retention decisions under uncertainty. Specific constraints become generic summaries. The governance plane cannot verify that a constraint it authorized is still operative in the agent’s working memory — because the agent itself may no longer be able to trace it. The authorization proceeds. The constraint is gone.
The memory witness feed
Hooks close this gap — but only if they are understood as instrumentation, not just interception.
The PreToolUse event fires after the model creates tool parameters and before the tool executes. At that moment, the hook handler receives the tool name, the tool input, the session ID, and event-specific context. This is the instrumentation point. The governance plane can, at this moment, receive a feed of the memory state that produced the tool call — not just the call itself. What the agent retrieved in the prior turn. What context it is currently operating on. What constraints are visible to it.
The PostToolUse event fires after the tool returns. What the tool produced is now part of the agent’s accumulated context. This is the second instrumentation point: where the governance plane can witness what the execution plane just added to memory.
Together, PreToolUse and PostToolUse define what this post calls the memory witness feed: the hook-instrumented stream of execution-plane state that makes governance decisions traceable to the memory context that produced them. Without this feed, the governance plane is authorizing actions it cannot situate in the behavioral history that generated them.
But the tool-call hooks alone are not sufficient. Compaction boundaries remain invisible without a third instrumentation point. The PreCompact hook — which fires before context is irreversibly summarized — is where the governance plane can witness what is about to be lost. Without instrumentation at this boundary, every compaction event is a governance blind spot: the behavioral baseline shifts, and the governance plane continues authorizing against the session it knew before, not the one running now. The SessionStart and SessionEnd hooks extend this visibility across session lifecycle boundaries — the handoff points where memory state initializes and finalizes.
What the memory witness feed requires
The feed is not automatic. It requires deliberate architectural choice at each instrumentation point: what state to surface, how to represent it, where to persist it, and how the governance plane consumes it. Three requirements follow.
Selective surfacing. Not all memory state is equally relevant to governance decisions. The memory witness feed should surface the state that is decision-relevant at the moment of each hook event: active constraints, recent retrievals, context that conditions the current tool call. Surfacing everything produces noise; surfacing nothing leaves the governance plane blind. The design decision is which memory state the governance plane needs to see at each instrumentation point.
Compaction witnessing. The PreCompact hook surfaces the memory state that is about to be irreversibly modified. A governance plane that receives an attested memory state at each PreCompact event has a verifiable record of what existed before compression. It can compare what was preserved against what was authorized. It can detect when specific constraints were summarized into generic approximations. Without this, compaction is structurally invisible to governance.
Session continuity. SessionStart and SessionEnd hooks establish the governance frame for each session. At SessionStart, the governance plane witnesses the initial memory state the agent is operating on. At SessionEnd, it witnesses what the session produced. In multi-session or multi-agent architectures, these are the handoff points where memory state crosses boundaries. Without instrumentation at these points, the provenance chain has gaps.
The consistency problem is solvable. The memory witness feed is the architectural mechanism. But solving the consistency problem does not solve the sovereignty problem — what happens when memory state can be shaped before the governance plane observes it. That is the argument Post 2 builds.
