Context Governance, Now With a Paper

For a year I've been writing that the gap in enterprise AI is governance, not retrieval. Saying it in essays is one thing. This week we put it on arXiv.

ContextNest: Verifiable Context Governance for Autonomous AI Agents — written with Benn Konsynski at Emory's Goizueta Business School, and Qaish Kanchwala and Gabe Goodhart at IBM Research — formalizes the idea and, more to the point, tests it.

The core claim: most retrieval pipelines give you relevance without guarantees. They'll surface a relevant document; they won't tell you whether it was the approved, current, integrity-verified version, or let you reconstruct after the fact which version informed an agent's answer. That missing layer is what we call context governance. ContextNest doesn't replace RAG — it sits underneath it, deciding which artifacts are approved, current, attributable, and verified before retrieval runs at all.

Concretely, that's typed Markdown with metadata, deterministic set-algebraic selectors, contextnest:// URIs, SHA-256 hash-chained version histories, graph-level checkpoints, live sources through the Model Context Protocol, and audit traces of what an agent actually consumed.

Two results I care about most:

• Governance beats retrieval on a stale-version attack. When the failure mode is "the corpus still contains an outdated version," governed selection strictly Pareto-dominates BM25 sparse retrieval — a higher answer-quality pass rate (97% vs 90–93%) at roughly one-third the input-token cost. Cheaper and more correct, because it never puts the stale artifact in front of the model in the first place.
• Determinism. Over a 1,060-document corpus, deterministic selectors returned the identical set on every repeat of the same query (Jaccard 1.0). A dense-vector + HNSW baseline was non-deterministic on 80% of queries — same question, different context, mean Jaccard 0.611, worst case 0.210. In a regulated setting, "the retriever might hand back something different this time" is not an acceptable property.

If you've read the strategic imperative piece, or watched me argue that governing the interaction matters more than the agent on top, this is the formal version — with numbers, and with two people I deeply respect from Emory and IBM stress-testing the argument.

The core engine, CLI, and MCP server are open source. Read the paper, then go try to break it.