An AI agent won't follow rules stored somewhere it never reads — so where exactly do safety constraints need to live?

This explores what governance actually has to look like when it's baked into the memory layer an agent reads from, rather than bolted on as an outside rulebook. The sharpest finding in the corpus is that governance only works when the agent actually consults it — and the place it reliably consults is its own runtime memory. One persistent agent logged 889 governance events across 96 active days precisely because the safeguards were encoded into the memory it read during decisions, not left in an after-the-fact policy appendix the agent never opens Can governance rules embedded in runtime memory actually protect autonomous agents?. So the first governance semantic is location: rules have to be resident where the agent looks.

The second is write control. A lot of agent failure in long tasks turns out not to be missing knowledge but weak memory control — transcripts and retrieval that let errors and drifting constraints accumulate because nothing gates what gets committed. The fix is a bounded, schema-governed committed state that explicitly separates temporary artifact recall from a permanent memory write, so the agent can't quietly corrupt its own long-term store Can agents fail from weak memory control rather than missing knowledge?. Governance here means a gate on the write path and a schema that constrains what a valid memory even is.

That points to a third semantic: memory has to be decomposable so you can govern each stage. Treating memory as one black box scored by task success hides where it broke; splitting it into storage, extraction, retrieval, and maintenance exposes which module actually failed and where a control belongs How should we actually evaluate agent memory systems?. You can't govern what you can't locate, and the same decomposition that makes memory evaluable makes it governable.

Maintenance is its own governance problem. When agents compress their own history, they can silently lose the detail that mattered — so consolidation needs structure, not just squeezing. Autonomous memory folding works because it consolidates into typed schemas (episodic, working, tool) rather than lossy summarization Can agents compress their own memory without losing critical details?, and context-as-playbook approaches deliberately use incremental generate–reflect–curate updates instead of full rewrites to prevent brevity bias and context collapse Can context playbooks prevent knowledge loss during iteration?. The governance semantic is provenance and controlled update: memory should evolve by additive, auditable edits, not destructive overwrites.

What you didn't know you wanted to know: some of these systems move governance out of storage entirely and into retrieval. Instead of trusting a static stored record, the agent reconstructs what it needs by traversing a memory graph and pruning paths against accumulated evidence Can agents reconstruct memory on demand instead of retrieving it?. That reframes governance from 'what did we store' to 'what will we let the agent reassemble, and on what evidence' — the check happens at read time, every time, which is arguably the only place a rule can't be skipped.