Where Governance Can Actually Reach
Agent memory isn't one thing — it's four distinct surfaces, each carrying different privileges, each failing differently, each needing its control in a different place. Here's the map: every door, and where the lock goes.
I once sat down to answer what I thought was a simple question about my own production system: how many places can it remember something?
I expected a short list. I was maintaining the system daily. I had built most of it. And I still got the count wrong on the first pass — because I was counting stores when I should have been counting surfaces. A store is a database. A surface is any place where something written earlier changes behavior later. Count that way and the list gets honest fast: the notes an agent keeps during a run. The records that persist between runs. The documents the system retrieves and treats as ground truth. And the quietest one — the things one agent writes that another agent reads and trusts.
Four surfaces. Different lifespans, different audiences, different privileges, different ways of going wrong. And in most production systems I’ve seen, they share exactly one governance property: none of them has any.
The two previous articles in this series established the problem — behavior has moved out of the prompt and into memory, and the review process didn’t move with it. This one is the map. Because the fix is not “govern the memory,” any more than the fix for building security is “lock the building.” The fix is knowing how many doors you have, what each one opens onto, and which lock fits which door.
You can't lock doors you haven't counted.
The Four Surfaces
Surface one: working state. The agent’s own notes during a run — the living plan, the record of what was tried and what failed, the current understanding of the task. This is the surface that made long agent runs possible, and it rewrites itself continuously by design. Its saving grace is a short lifespan: when the run ends, so does most of its authority. Its danger is velocity — by hour six, this document is steering, and nobody has read it since hour zero.
Blast radius if it goes wrong: the run. Bounded, but a long run can do a lot of confident wrong work before anyone looks. Where the control attaches: checkpoints. Working state should be diffable at defined moments — not reviewed line-by-line in real time, which defeats the purpose of autonomy, but snapshotted at decision boundaries so there is a baseline, and a bad turn has a visible “before.” Treat it like configuration in motion: versioned at the moments that matter.
Surface two: persistent stores. Records that outlive the run — decisions, learned facts, institutional knowledge the system consults tomorrow and next month. This is the highest-privilege surface in the stack, because persistence is privilege: the longer a memory lives, the more future behavior it silently shapes, and the more work gets built on top of it. This is where my phantom file lived — a claim compressed into a fact, written once, trusted for weeks.
Blast radius: every future session that retrieves it, plus everything built on those sessions. Compounding, not bounded. Where the control attaches: the write, not the read. By the time a bad record is being retrieved, you’re in cleanup. The control is a distinction enforced at write time: an assertion — something the system claims — is not a verified fact — something checked against the artifact it describes — and the two must carry different privileges. In my system, that single distinction is the control that has paid for itself most often. A record that says a deliverable is finished holds no authority until the deliverable itself has been confirmed to exist.
Surface three: retrieval corpora. The documents, knowledge bases, and reference material the system pulls in and treats as ground truth. Technically this is memory you gave the system rather than memory it wrote — but it behaves like memory: written once, trusted repeatedly, drifting quietly out of date. A stale policy document in a retrieval corpus is a stale belief with a citation. The system won’t just be wrong; it will be wrong with a source.
Blast radius: every answer that retrieves the contaminated document — and unlike a bad model output, these failures repeat identically until the source is fixed, because the root cause regenerates them. Where the control attaches: the corpus itself, on a schedule. Freshness has a half-life; contradictions between documents are findable; ownership of each source is assignable. Corpus quality is measurable, which means it can be audited like anything else that’s measurable — before the system trusts it, not after an answer goes wrong.
Surface four: inter-agent handoffs. The records one agent writes specifically for another agent to act on. This is the least-examined surface in production today, and the one I’d inspect first in any multi-agent system, because it’s where trust transfers without a signer. Agent A summarizes, compresses, concludes — and Agent B inherits the conclusion as input, stripped of the uncertainty it originally carried. Nothing malfunctioned. Meaning just eroded at a boundary nobody was watching.
Blast radius: the entire downstream chain — and it’s the hardest surface to trace after the fact, because each hop looks locally reasonable. Where the control attaches: the boundary. Handoffs need provenance — who wrote this, from what, with what confidence — carried with the record, so a downstream agent (or the human auditing it later) can distinguish “verified result” from “upstream summary.” The most dangerous memory in a multi-agent system isn’t the wrong one. It’s the confident one with no author on file.
The most dangerous memory in your system is the one another agent wrote.
Where Governance Can Reach — and Where It Can’t
Lay the four surfaces side by side and a pattern shows up that policy-first governance keeps missing: the controls live in different places, at different altitudes, and no single review board can hold them all.
Checkpointing working state is an engineering pattern — it lives in how the system is built. The assertion-versus-verification distinction is an evaluation discipline — it lives in what the system is allowed to trust, and it has to run continuously, not quarterly. Corpus auditing is a measurement practice with a calendar. Handoff provenance is an architectural requirement — it either exists in the record format or it doesn’t, and no policy memo can add it after the fact.
This is why I keep saying the governance gap is an architecture problem. In my own system — twenty-plus specialized agents across four architectural tiers — governance isn’t a layer that reviews the others from the outside. It’s placed where each surface actually is: verification disciplines sitting where trust decisions happen, architectural governance holding the map of which surface gets which control and why. Blast Radius Mapping is the discipline that draws that map — not “what could go wrong,” which produces a spreadsheet, but this surface fails, this is who inherits it, this is how long until we’d know. Once you’ve drawn it, the control placements stop being debatable. Each one has exactly one place it can work.
The inversion is the whole point: you don’t bolt governance onto the system. You put each lock on its door.
If you’re the one accountable, here is this week’s version of the honest position — and it’s the best one in the series so far.
You now hold the map. Four surfaces is not an overwhelming number; it’s an inventory-able number. You can walk your own stack against it this week: Where does working state live, and is it checkpointed anywhere? What can write to your persistent stores, and does anything distinguish a claim from a verified fact? When was your retrieval corpus last audited against reality? And when one of your agents hands a conclusion to another — is there an author on file?
Most teams can’t answer all four today. Neither could I, once. The point of the map isn’t to grade you. It’s that every one of those questions has a knowable answer and an attachable control — and the teams answering them now are doing it while it still counts as leadership rather than remediation.
Next week closes the series with the pre-flight version of exactly this: the questions worth answering before any agent with persistent memory touches production, and the free tool that walks you through them.
Until then, take the inventory. Count the doors before you shop for locks — because you can’t lock doors you haven’t counted.
This series applies The Comprehension Standard — AI doesn’t reach production until you can see, understand, and verify what it does — to the newest surface in the stack. If you want to assess where your own architecture stands, the Context Architecture Blueprint is free and MIT-licensed.
Wilfred Morgan
AI Systems Architect · Agentic AI Implementation