ContextNest, an open specification and reference implementation for governed AI-consumable knowledge vaults, and first empirical results from two controlled experiments suggest that context governance addresses failure modes retrieval quality alone is not designed to resolve.
Abstract
Autonomous AI agents increasingly depend on external knowledge stores, yet most retrieval pipelines provide relevance without durable guarantees of provenance, version identity, integrity, traceability, or point-in-time reconstruction. We formalize this as context governance and present ContextNest, an open specification and reference implementation for governed AI-consumable knowledge vaults. ContextNest does not replace Retrieval-Augmented Generation (RAG); it supplies the governance layer beneath retrieval, determining which artifacts are approved, current, attributable, and integrity-verified before retrieval systems operate over them. The specification combines typed Markdown documents with metadata, deterministic set-algebraic selectors, contextnest:// URI references, SHA-256 hash-chained version histories, graph-level checkpoints, source nodes for live data through the Model Context Protocol (MCP), and audit traces of agent context consumption. These mechanisms let organizations reconstruct which knowledge versions informed an agent output and whether those versions were AI-eligible when consumed. We report first empirical results from two controlled experiments. In a stale-version attack isolating the governance-versus-retrieval failure mode, governed selection strictly Pareto-dominates BM25 sparse retrieval, with higher answer-quality pass rate (97% versus 93-90%) at about one-third the input-token cost. In a retrieval-determinism experiment over a 1,060-document corpus, deterministic selectors and BM25 return stable document sets across repeated identical queries (Jaccard 1.0), while a dense+HNSW baseline is non-deterministic on 80% of queries (mean Jaccard 0.611, worst case 0.210). These results suggest that context governance addresses failure modes retrieval quality alone is not designed to resolve. We release a core engine, CLI, and MCP server under open licenses.
A pipeline promoting an AI system publishes records claiming the thing evaluated is the thing deployed and that the evidence licensed the transition, and measures whether those records can express that claim and whether it holds where declared.
This work introduces logos, a pluggable layer for self-evolution and governance that strengthens existing multiagent frameworks rather than replacing them, and provides a living logic for accountable automation.
Yuma Ichikawa, Yamato Arai, Kosaku Kimura et al.· 0 citations
Deploying autonomous AI agents in high-consequence operational environments requires organizational authorization, yet few frameworks provide end-to-end, testable governance mechanisms suitable for such authorization decisions. This paper introduces LATTICE (Layered Agentic Triad Topology for Intelligent Coordinated Execution), a governance-first architecture that reframes the authorization question from “do we trust this AI?” to “do we trust this architecture?” The latter question is answerable through engineering validation rather than assumptions about model behavior. LATTICE enforces separation of concerns across planning, execution, and governance functions through a 1+3 Grid Cell pattern, so that no single component can both decide actions and judge compliance. The architecture implements policy-as-code enforcement with deterministic verdicts, gated execution paths that, under stated trusted-infrastructure assumptions (A1–A5), prevent unauthorized actions, confidence-based escalation to human operators, and cryptographic audit trails that preserve complete decision provenance. Empirical results characterize the AEGIS reference implementation; architecture-level properties are analytic, under stated assumptions. The governance engine is released as open source and reproduces its core results on commodity hardware: deterministic verdicts with zero deviations across 13 configurations repeated 10,000 times each, and no bypass in a 21-vector adversarial suite (0/21 observed; one-sided 95% upper bound 13.3%). In a pre-specified, planner-invariant safety evaluation (not an autonomy benchmark) across four frontier planner families (GPT-5, Claude Sonnet 4.6, Gemini, Grok-4; 4,000 trajectories), a confidence-threshold baseline's false-allow rate ranged from 0.03 to 0.998 across planners, whereas the AEGIS reference implementation admitted zero unsafe actions (false-allow 0.0, recall 1.0) invariant to the planner, at a conservative operating point that auto-allowed no action; a separate live run additionally governed real operating-system actions with zero unsafe executions. Governance latency is low and host-specific (on an Apple M4 Pro: policy evaluation p50 ≈ 6.2 μs; full gated enforcement p50 ≈ 0.7 ms including audit I/O). LATTICE provides a pathway for responsible deployment of autonomous AI in defense, critical infrastructure, and regulated industries where authorization requires verifiable governance rather than trust in AI behavior.
Elias Calboreanu· Frontiers in Artificial Inte...· 1 citation
MAP-Graph is introduced, a provenance-aware memory layer that represents agents, sources, memories, claims, and actions in a typed execution graph and supports provenance as an operational control signal, rather than only post-hoc audit metadata, within the evaluated setting.
Yiqi Wang, Zihao Yan, Jiaqi Zhang et al.· 4 citations
Agentic workflows are commonly evaluated by whether they reach the correct outcome. That is insufficient in institutional settings, where a correct action may rely on the wrong authority, an unsupported completion claim, or work made stale by a later change. We define governed execution as work whose decisions, completion, and response to change are supported by inspectable provenance. We present Matrix, a deterministic causal-state layer that records authority and fact dependencies, verifies completion evidence, and selectively invalidates affected work. Across controlled comparisons, governed and direct workflows often reached the same outcomes, but only the governed path consistently preserved governing evidence, refused unsupported closure, and limited recovery to dependent tasks. A role-separated transfer challenge then failed: a deterministically enforced completeness contract severely over-blocked synthetic packets produced outside its authoring context. These results do not establish Matrix as a general accuracy enhancer; they support its primary role as an institutional integrity layer for making agentic work auditable and independently verifiable.
As autonomous agents rapidly evolve, their ability to reliably manipulate ubiquitous digital documents has become critical for enabling general-purpose AI assistants and automating complex workspace workflows. In this paper, we introduce DocOps, a deterministically verifiable evaluation framework underpinned by a hierarchical taxonomy that deconstructs document operations inspired by real-world practices into atomic dimensions and escalating workflow complexities. Based on DocOps, we systematically evaluate representative closed- and open-source models across various agentic harnesses, revealing that even the most advanced frontier configurations still exhibit profound limitations when handling highly coupled, long-range tasks. Furthermore, a fine-grained analysis of existing agents'manipulation behaviors uncovers 3 key failure modes: long-term state tracking collapse, shallow semantic verification, and destructive editing of structural metadata. Ultimately, our work exposes the capability boundaries of agents in maintaining global document consistency, shedding light on the future design of robust, non-destructive agents for complex digital ecosystems.
Jiazhen Jiang, Boxi Cao, Lingyong Yan et al.· 1 citation
