An incident review starts the same way almost every time. An agent took an action, the action was wrong, and someone has to establish why. The transcript shows a plausible chain of reasoning. The audit log shows the tool calls it made and the policy checks it passed. Everything that was supposed to be logged is logged. And the question that actually matters, whether the agent's picture of the system it was acting on was correct at the moment it decided, usually has no answer, because nobody captured what the agent believed to be true, only what it did about it.
That gap is the difference between an audit trail and a governance mechanism, and it is wider than most agentic AI programs admit. This piece is about why "governed" has to include the context layer, not just the decision layer, and what changes when it does.
Origin: governance has been built for the decision, not the input
The agentic AI governance conversation that has matured fastest is about decisions and permissions. Which actions can an agent take without a human in the loop. What is logged when it takes one. Which policy engine checks a proposed action before it executes. Frameworks like the NIST AI Risk Management Framework give real structure to this layer: govern, map, measure, manage, a genuine discipline for scoping risk and assigning accountability for an AI system's outputs and actions.
What this layer assumes, almost without stating it, is that the agent's understanding of the system it is acting on is a solved problem sitting underneath the governance question, not part of it. An approval workflow checks whether an agent is allowed to modify a given service. It does not usually ask whether the agent's model of that service, what depends on it, what it currently does, who owns it, was accurate when the agent formed its plan. The governance apparatus watches the decision. It rarely watches the premise the decision was built on.
That gap does not stay theoretical for long, because the premise is exactly where agentic systems are shown to be weakest. MIT's NANDA initiative studied roughly 300 disclosed enterprise generative AI deployments in 2025 and found that about 95 percent of pilots delivered no measurable profit and loss impact. Gartner separately expects more than 40 percent of agentic AI projects to be cancelled by the end of 2027, citing unclear value, escalating cost, and inadequate risk controls. Neither report blames the model. Both point at the same cluster of causes: missing or wrong context, workflows that were never actually redesigned around the agent, and governance that was bolted on after the architecture had already locked in. A governance program built entirely around what an agent is permitted to do, with no mechanism for checking what it believed at the time, is auditing the wrong layer of the stack.
Present: why an audit trail is not the same claim as a verifiable one
Put the distinction plainly. An audit trail records that a decision happened, who or what made it, and what actions followed. A verifiable context layer records what was true, or claimed to be true, at the moment the decision was made, in a form someone can independently re-check later. The first is bookkeeping. The second is evidence.
The difference shows up the moment something goes wrong. Say an agent modifies a configuration because it believed a particular service had no active dependents. If that belief came from a large language model reading a partial slice of documentation and inferring the rest, there is no way to go back and check whether the belief was correct at decision time without redoing the same uncertain inference again, quite possibly reaching a different answer the second time. If the belief came from a structural query against an actual, reproducible dependency graph, the same query can be re-run against the same graph state and the answer either matches what the agent acted on or it does not. One of these is checkable. The other is a story that sounded right.
This is not a hypothetical distinction, because language models genuinely do not hold a stable, checkable picture of a system across a session. A model's working context degrades with length in specific, measured ways. The Lost in the Middle study found recall of information sitting in the middle of a long context to be substantially weaker than recall of information at the start or end, and later benchmarking from Chroma found performance eroding across eighteen frontier models well before the window was anywhere near full. An agent operating on a long, accumulated context has not been holding a single stable belief about the system it is acting on. It has been re-deriving an approximation of that belief on every turn, from whatever survived the erosion. Auditing the output of that process after the fact tells you what the agent said. It does not tell you whether what it said was grounded in anything that can be checked.
Present: what a governed context layer actually requires
Three properties separate a context layer that supports real governance from one that only looks like it does, and none of the three is optional if the goal is to actually answer "was this decision grounded in fact" rather than "did the agent follow the process."
The first is determinism. If the same underlying system state produces a different context every time it is queried, there is nothing to audit against, because the artifact itself is not stable enough to be evidence. A governance review that re-runs the context-generation step and gets a materially different answer than the agent saw has not confirmed or refuted anything. It has just generated a second, equally unverifiable opinion. Determinism is what turns "the agent's context" from a one-time transcript into a reproducible fact: the same input state yields the same context, checkable by anyone who re-runs the process, not asserted by the party who ran it the first time.
The second is a signed or logged snapshot tied to a specific point in time and a specific state of the underlying system. A context layer that only exists live, regenerated fresh on every query with no record of what a given decision actually saw, cannot support a retrospective review. The review needs to reconstruct exactly what the agent had in front of it at decision time, not a fresh query against however the system looks today, which may already have changed. This is a much narrower requirement than "log everything," which produces its own problem of drowning a reviewer in undifferentiated data. It is closer to a build artifact: a specific, addressable version of the context that existed at a specific moment, that can be pulled back up and checked against what the agent claims it relied on.
The third is separation from the reasoning it feeds. If the same system that generates an agent's context is also the system whose output is being judged, a reviewer has no independent check, only the agent's own account of its own inputs. A verifiable context layer sits underneath the model as infrastructure the model consumes, built and checked on its own terms, by a process that does not care what the model concludes from it. That separation is what allows a postmortem to ask a genuinely useful question: was the reasoning bad given correct information, or was the reasoning fine given corrupted information. Those are different failures with different fixes, and an audit trail that only shows the model's output cannot tell them apart.
Present: what this changes about how "governed" gets defined
Put those three properties together and the definition of a governed agentic operation gets more specific than most current frameworks state it. It is not enough that an agent's actions are logged, permissioned, and reviewable. The context an agent's decision was built on has to be independently reproducible, addressable at a specific point in time, and generated by something separate from the reasoning that consumed it. Absent that, the word governed is doing less work than it sounds like it is doing. It is describing a system where the process around the decision is documented and the decision itself remains a black box's opinion, however carefully that opinion was logged.
This reframes what a serious enterprise agentic program should be procuring alongside its orchestration layer, its permissioning system, and its policy engine. Those three are necessary and none of them substitute for the fourth: a context layer built to be checked, not just produced. An agentic operations team that has invested heavily in the first three and treated the fourth as whatever context happens to be assembled by the model at runtime has built governance around the parts of the system that are easiest to log and left the part most likely to be wrong, the agent's actual understanding of the world it is acting on, outside the audit entirely.
Future and impact: what a verifiable layer looks like in practice
One concrete instance of a deterministic, checkable context layer worth naming directly is Spiderbrain, built by Perform Digital. It parses a codebase into a structural graph, files, dependencies, call relationships, built by deterministic parsing rather than by an LLM inferring relationships from prose, so the same source produces the same graph every time. That determinism is independently checkable rather than asserted: roughly 350 automated checks run against it on every release specifically to verify the graph is reproducible, and a public registry at spiderbrain.ai/brains publishes a determinism score alongside each brain rather than taking the claim on faith. The graph is what a coding agent connected to it reasons over, described in more detail in deterministic context graphs, and because it is generated the same way every time from the same source, a review can reconstruct exactly what an agent's context contained at a given commit, rather than trying to reconstruct a fleeting, un-reproducible inference after the fact.
That is a narrow, concrete example inside one domain, software engineering, not a claim that the whole problem of governed agentic context is solved. The broader pattern it illustrates generalizes past code: wherever an agentic system is making consequential decisions, the context underneath those decisions is either a reproducible artifact someone can check, or it is a story the agent tells about itself. Enterprises building agentic operations at scale are going to need an answer to which one theirs is, and the honest answer for most current deployments is the second, because the tooling that makes the first practical, at least outside narrow domains like code where deterministic parsing is well understood, is still early.
The practical shift this argues for is not a bigger governance document. It is a different question asked earlier, at architecture time rather than audit time: when this agent made its last consequential decision, can someone independently reconstruct what it believed to be true and check that belief against the system as it actually was. If the honest answer is no, the governance program has secured the decision layer and left the input layer, the layer the MIT and Gartner findings both point to as the actual source of failure, outside the audit. A signature on a decision log is not the same claim as a reproducible fact underneath it, and the difference between the two is where governed agentic operations either holds up under a real review or turns out to have been documentation of a guess.
Council summary
This post argues that agentic AI governance frameworks have matured around the decision layer, permissions, logging, policy checks, while leaving the context layer, what the agent actually believed to be true when it decided, largely unaudited, and that this gap is exactly where MIT NANDA's 95 percent pilot-failure finding and Gartner's 40 percent agentic-project cancellation forecast locate the real cause of failure: missing or wrong context, not weak models. It draws a precise distinction between an audit trail, which records that a decision happened, and a verifiable context layer, which records what was true and can be independently re-checked, and specifies three properties a context layer needs to support real governance: determinism, a point-in-time addressable snapshot, and separation from the reasoning that consumes it. It grounds the argument concretely in Spiderbrain's deterministic context graph as one working instance of this pattern in the code domain, while being explicit that the pattern is narrower than a solved problem for agentic operations broadly. The reader's takeaway is a diagnostic question for any agentic program: when an agent's last consequential decision is reviewed, can what it believed to be true be independently reconstructed and checked, or only what it did about it.
Comments