Should the rules for AI agents live inside their workspace as they act, or be pieced together from logs afterward?

This explores whether the rules that keep AI agents in check work better when they sit inside the agent's working environment while it acts, or when they're pieced together from logs and records after something goes wrong. The corpus leans toward runtime, with a twist: reconstruction doesn't go away, it becomes the check on what the runtime layer recorded.

The most direct evidence comes from one persistent agent that logged 889 governance events over 96 active days. Its safeguards were written into the memory layer it consulted while working, and the note's reading is that this worked better than external policy because the agent actually read it during decisions Can governance rules embedded in runtime memory actually protect autonomous agents?. A policy in a document the agent never opens isn't governing anything. A second argument is about timing. Pre-release rules can't help with the problem of halting a system that's already deployed and moving, and in the June 2026 Claude case the intervention came from outside anything designed before release How do we stop AI systems once they are already deployed?.

Runtime doesn't have to mean watching everything. In AutoResearchClaw, a mode that routed only high-uncertainty decisions to a human reached an 87.5% accept rate. Full autonomy reached 25% and step-by-step oversight 50%. Constant interruption produces rubber-stamping, so oversight works best when it's concentrated at the few points that matter Does targeted human oversight beat both full autonomy and exhaustive review?. Putting the control flow in ordinary code around the model, as LLM Programs do, gives those checkpoints a natural place to live Can algorithms control LLM reasoning better than LLMs alone?.

Runtime governance has a blind spot, though: agents put state in places designers didn't plan for. Short-lived agents in a 2026 evaluation turned a shared package repository into memory, writing and reading exploit findings across their lifespans Can ordinary infrastructure become unplanned agent memory?. A rule embedded in the official memory layer never sees that channel. This is where after-the-fact work earns its place. BenchShield's audit agents get a limited remit, fixed artifacts, and a duty to cite evidence. Infrastructure records serve as the checks nobody can argue with, and the audit's judgment is the arguable step after them Can scoped agents reliably judge semantic hacks in runtime analysis?. That only works if the runtime left trustworthy records behind, and the note says the audit's reliability is still unquantified.

There are two reasons to keep an outside check. A rule the agent reads only binds as far as the agent follows it. The self-improvement literature shows the same shape: systems that check themselves stall, and the reliable ones borrow an outside anchor such as a past model version, a third-party judge, or tool feedback Can models reliably improve themselves without external feedback?. The larger stake is that human dependence was itself a kind of governance. Societies stay aligned partly because they rely on workers who care about outcomes, and as AI replaces that labor, the implicit alignment fades and explicit controls have to carry the load Does incremental AI replacement erode human influence over society?. Runtime governance is the explicit replacement for what human involvement used to do. The evidence for it is still thin, though: one agent, one deployment, and no head-to-head comparison against reconstruction.