What 'Context Governance' Actually Means

We put a paper on arXiv this month, and the reaction I keep getting is a fair one: "governance" is a heavy word, tell me what it actually means. So here is the plain version, without the formalism. If you want the numbers and the proofs, the paper is there.

Start with what retrieval does and does not do. Retrieval finds you a relevant document. It does not tell you whether that document was the approved one, whether it was the current version, whether its contents are intact, or whether you can reconstruct later which version an agent actually read. Relevance without those guarantees is fine for a demo and a real problem in a regulated setting.

Context governance is the layer that answers those questions before retrieval runs. It decides which artifacts are approved, current, attributable, and integrity-verified, and only then lets retrieval work over them. It does not replace RAG. It sits underneath it.

Two results from the paper make the idea concrete.

A relevant but stale document is worse than no document

Picture the common failure: your corpus still contains last year's version of a policy alongside this year's. A relevance-ranked retriever will happily hand the agent the old one, because on the words it looks relevant. The agent then answers from a document that was true eighteen months ago.

Governed selection never puts that artifact in front of the model, because the stale version was not the approved, current one. In the paper's stale-version test, governed selection strictly beat sparse keyword retrieval on both axes at once: a higher answer-quality pass rate (97% against 90 to 93%) at roughly one-third the input-token cost. Cheaper and more correct, because the fix is upstream of the model, not a bigger prompt trying to reason around the bad input.

The same question should return the same context

Ask an agent the same question twice. Does it see the same context both times? With deterministic selectors over a 1,060-document corpus, the answer was yes on every repeat, an identical set each time. A dense-vector retriever returned a different set on 80% of the same queries, with a mean overlap of 0.61 and a worst case of 0.21. Same question, different context, different possible answer.

In a regulated setting, "the retriever might hand back something different this time" is not an acceptable property. You cannot audit a system whose inputs you cannot reproduce.

What it is made of

Concretely, governance here means typed Markdown with metadata, deterministic set-algebraic selectors, contextnest:// addresses, SHA-256 hash-chained version histories, graph-level checkpoints, live sources through the Model Context Protocol, and an audit trace of what an agent actually consumed. The point of all of it is a single property: you can say, and prove, exactly what informed an answer, and get the same result if you ask again.

That is the argument I have made in essays like context engineering as a strategic imperative and from prompts to protocols, now with a formal treatment and two co-authors from Emory and IBM Research stress-testing it. The announcement post has the framing; the paper has the receipts.

The moat in enterprise AI is moving. When every model can retrieve, retrieval stops being the differentiator, and provenance, currency, integrity, and reproducibility become the thing that separates a system you can trust from one you merely hope is right. The engine, CLI, and MCP server are open source. Read it, then try to break it.