---
title: "Correct Is Not Governed: Provenance Integrity in Agentic Workflows"
authors: ["Jesus Salas"]
year: 2026
venue: "arXiv:cs.AI"
arxiv: "2608.12761"
doi: null
source: "https://arxiv.org/abs/2608.12761"
topics: [provenance-first-agent-memory, agent-failure-localization]
seed_rank: 1018
seed_batch: "frontier-2026-08-14"
reviewed: "2026-08-14"
pool: "agents"
relevance_score: 9
lineage: provenance-first-memory
cites:
  - title: "Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks"
    url: "https://arxiv.org/abs/2005.11401"
    year: 2020
    arxiv: "2005.11401"
    doi: null
  - title: "ToolGate: Contract-Grounded and Verified Tool Execution for LLMs"
    url: "https://aclanthology.org/2026.findings-acl.470/"
    year: 2026
    arxiv: null
    doi: "10.18653/v1/2026.findings-acl.470"
  - title: "Large Language Models Cannot Self-Correct Reasoning Yet"
    url: "https://arxiv.org/abs/2310.01798"
    year: 2024
    arxiv: "2310.01798"
    doi: null
  - title: "From Agent Loops to Deterministic Graphs: Execution Lineage for Reproducible AI-Native Work"
    url: "https://arxiv.org/abs/2605.06365"
    year: 2026
    arxiv: "2605.06365"
    doi: null
see:
  - "008-retrieval-augmented-generation-for-knowledge-intensive-nlp-t"
  - "067-toolgate-token-efficient-pre-call-control-for-tool-augmented"
  - "007-react-synergizing-reasoning-and-acting-in-language-models"
---

# Correct Is Not Governed: Provenance Integrity in Agentic Workflows

## One-sentence takeaway

A correct agent action can still be ungoverned: Matrix records which authority/facts admitted a decision, which receipts closed a task, and which dependents a later change invalidates — and a faithful completeness contract still failed to transfer (specificity 0.00).

## Why it matters here

Provenance-first agent memory is first-class on the radar. GRID COMMAND orders, standing rules, and Broadside seed cards all need “what governed this, what proved done, what went stale.” Matrix is a deterministic causal-state layer *around* the LLM, not another RAG. The negative result is the crème: mechanism fidelity ≠ contract validity — the warning we need before encoding Anoptic production rules as hard gates.

## Key ideas

- Three provenance surfaces: decision (governing vs merely retrieved), execution (receipt vs self-claim), change (dependency-scoped invalidation).
- Same-outcome splits: direct RAG 15/15 expected actions but 6/15 unsupported citations; self-review still self-closes on missing DPA evidence 3/3; authority v2 reissues 3 tasks vs 18 for full rerun.
- Metadata-decidable missing-authority invariant: Phi never self-escalates; Matrix escalates 12/12 incomplete and 0/120 complete authored packets.
- Study 6 transfer: role-separated synthetic packets, sensitivity 1.00, specificity 0.00. The paper treats this as a gate, not a footnote.

## Caveats


## Links

- arXiv: [2608.12761](https://arxiv.org/abs/2608.12761)
- PDF: https://arxiv.org/pdf/2608.12761