AI Governance · Agentic Systems

The Model Is Not the Memory: Why Governable AI Needs a Wiki, Not Just RAG

An AI's explanation of itself is a story written after the fact by the system you're auditing. Cognitive provenance replaces it with a record you can open — the exact pages, claims and edges the agent observed at decision time, version-pinned, resolvable, and gradeable independently of whether the answer happened to be right.

By Scott Farrell · LeverageAI · Second edition, July 2026

I dropped a car in for a heated seat that had stopped heating. The man at the service desk read his screen, and his face did something I've thought about ever since. The booking was for a different repair entirely. He looked at it. He looked at it again. Then he said, half to himself: "I think the AI got that one wrong."

The wrong part had already been ordered. And you could watch him quietly clock out of the problem — because what was he supposed to do? Argue with it? On what basis?

The failure there isn't that the AI was wrong. Wrong answers are visible, arguable and correctable; every system produces them. The failure is that nobody in the building could tell brilliance from hallucination. That is a property of the design, not of the day.

Asking the model why is not governance

The reflex, when an agentic system makes a call you can't account for, is to ask it. And it will answer — fluently, plausibly, reassuringly. It produces a paragraph that sounds exactly like a competent colleague justifying a sensible decision.

That paragraph was generated after the decision, by the same system whose decision you are trying to audit. It is not a record of what happened. It is a performance about what happened.

This is no longer a philosophical objection; it is measured. Anthropic handed reasoning models hints that changed their answers and found the models mentioned the hint only around a quarter of the time; where the models exploited a reward hack, they admitted it in their stated reasoning less than 2% of the time.¹ Independent work on chain-of-thought faithfulness reaches the same shape and names the pathology: verbalised reasoning "can give an incorrect picture of how models arrive at conclusions," with an explicit warning against trusting it in agentic settings — post-hoc rationalisation.² The warning predates the current wave. Cynthia Rudin argued in 2019 that explaining black boxes, rather than building interpretable systems, "is likely to perpetuate bad practices."³

Meanwhile the risk itself has changed shape. As McKinsey put it, organisations "can no longer concern themselves only with AI systems saying the wrong thing; they must also contend with systems doing the wrong thing."⁴ Around 80% of organisations lack a mature governance model for agentic AI — only about 21% have one⁵ — and Gartner forecasts that over 40% of agentic AI projects will be cancelled by the end of 2027, partly for inadequate risk controls.⁶

Governance cannot live inside the model. It has to live in something you can observe from the outside.

Two ways to know, neither of them auditable

An agent has two default sources of knowledge, and neither of them is a knowledge state you can restore.

The first is weights. Compressed, uninspectable, unrewindable. You cannot ask a model which of its priors fired, and you cannot diff last month's beliefs against this month's. You can't look into an LLM's brain and see all the crap it was looking at.

The second is query-time retrieval. Better — you can at least log the query and the chunks that came back — but it fails the governance test in three specific ways.

• No versioned state. The corpus moves, the chunker moves, the embedding model moves, the reranker moves. "Restore the search as it was on 17 June" is not a supported operation. A log of what came back is not a reconstruction of what was there.
• No status. Nearest is not canonical. A second-hand blurb that happens to share the query's vocabulary can outrank the page that actually defines the thing, and the agent has no way to tell — a distance carries no notion of standing.
• Quality hidden in the machinery. When retrieval goes wrong you interrogate chunking, embeddings, the reranker, the metadata filter; you change one, re-index, and re-test everything. The quality lives inside a representation no human can read.

A self-cleaning wiki-graph is a third thing. An ingestion agent compiles closed cases into atomic claims and typed edges; a janitor agent compacts claims into edges over time; retrieval becomes navigation of a prepared map rather than a crawl at query time. I've made that architectural case at length elsewhere and won't re-derive it here. For governance, only one property matters: the artefact is plain markdown under version control. Inspectable by a human, diffable, revertible, portable across model providers, locked inside no vector database. The map behaves like soft weights you can read.

Cognitive provenance

Explainability asks the model to narrate. Cognitive provenance asks the system to produce the knowledge path. One is testimony from the defendant; the other is the evidence room.

With a wiki-graph you can ask a set of questions that have no equivalent against weights: which pages were retrieved; which claims were observed; which edges were traversed; which version of the memory was current; which claims were available but not used; which proposals were rejected; which gates passed or failed; which human or deterministic gate authorised the action.

That fifth one is the sleeper. A knowledge path tells you both what the agent touched and what it ignored — which is the difference between a story and an audit.

The mechanism is unglamorous and that is the point: restore the commit that was live at decision time, plus the DAG version and the agent version, and re-trace. Reconstruct the service AI's world as of 9:17 am on the day the case was booked. We already version code in Git and data and models in tools like DVC precisely so a result can be traced to the exact state that produced it;⁷ this extends the same discipline to the claims an agent reads. Regulation is pushing in the same direction — EU AI Act Article 12 requires high-risk systems to "technically allow for the automatic recording of events (logs) over the lifetime of the system," with high-risk obligations applying from 2 August 2026.⁸ What no regulation tells you is how to get the knowledge dimension, as opposed to the input/output one.

In governed agentic AI, the path through knowledge is part of the decision.

Substantively right, procedurally unsupported

Here is the observation that made me take this seriously, and it's a field note rather than a theory. The more you put into the wiki, the more you notice the model will sometimes bypass it and answer from its own knowledge — and get it right.

Which gives a sharper, governable definition of hallucination:

Two agents, one hard ticket, the same correct recommendation. One read the canonical fault page, followed the occupancy-sensor edge, checked the model-year exception, and arrived. The other read three loosely-related passages, none of them canonical, and guessed — and its guess matched what the model already believed from pre-training. From inputs and outputs alone, they are indistinguishable.

This isn't only our vocabulary. The RAG-attribution literature formally separates correctness from faithfulness: faithfulness "ensures that the model's reliance on cited documents is genuine, reflecting actual reference use rather than superficial alignment with prior beliefs, which we call post-rationalization."⁹

The lucky answer is the dangerous one. Not because it's wrong today — it isn't — but because it will keep passing your tests right up until the day the priors don't hold, and then it will fail silently, on a case you can't predict, with nothing in your test suite watching.

Test the path, not the answer

Naming the failure was the easy half. The instrument is this: grade the journey, not just the destination. Did the agent reach the canonical source, or settle for a nearby mention? Did it follow the edges a competent navigator would follow? Did it fall back to broad search where the graph should have been enough to walk? Did it stop when the map said it had what it needed?

Each of those is a concrete, inspectable fact about a traversal. The final answer is fuzzy and model-dependent — reword the prompt and it shifts. The path is a recorded sequence of pages and edges you can lay out and judge. And once you grade both, four outcomes appear where output-grading could only ever see two.

This is a property of the substrate, not of diligence. Testing a vector store turns into a retrieval science project you debug by poking inputs and squinting at outputs. Wiki testing has a surface a human can simply look at: does the page summary make sense, are the edges useful, is the canonical source present, can the target user discover this page from their question.

RAG quality is hidden in the machinery. Wiki quality is visible on the page.

The artefact: a governance trace

All of this resolves into one thing an auditor can hold. For the heated seat — where the common cause is an upstream occupancy sensor deciding nobody is sitting there, which means the correct repair looks to the customer like the workshop ordering the wrong part:

Case:         Heated driver seat complaint
Vehicle:      Model 3 RWD, 2023
Wiki snapshot: service-wiki@a83f21c
DAG version:   service-triage-dag@2026.06.17
Agent version: triage-agent@1.8.2

Observed pages (claim + exhibit + resolvable pointer):
- [[Heated Seat Failures]]        -> wiki/heated-seat-failures.md@a83f21c#L44
- [[Driver Occupancy Sensor]]     -> wiki/occupancy-sensor.md@a83f21c#L12
- [[Model 3 Seat Module]]         -> wiki/m3-seat-module.md@a83f21c#L61
- [[First Visit Resolution]]      -> wiki/first-visit-resolution.md@a83f21c#L8
- [[Customer Confusion: Non-obvious Repairs]] -> wiki/non-obvious.md@a83f21c#L23

Traversed edges:
- heated-seat-complaint -> possible-upstream-cause -> occupancy-sensor
- occupancy-sensor-fault -> can-disable -> heated-seat-activation
- non-obvious-repair-path -> requires -> customer-facing-explanation
- high-return-visit-risk -> consider -> backup-part-staging

Available, not observed:
- [[Seat Harness Corrosion, Coastal]]  (retrieved, unread)

Known absences:
- no claim covering software revision 2026.14 seat-heater logic

Candidate proposals:
A. Order occupancy sensor only
   FAIL: customer explanation missing; return-visit risk medium
B. Order heated-seat element only
   FAIL: diagnostic evidence weak against remote signal
C. Order occupancy sensor + stage heated-seat element
   PASS: diagnostic evidence adequate; customer-trust risk reduced;
         concierge note generated

Accepted: C
Effect on work: [[First Visit Resolution]] moved the recommendation from A to C
Confession: could not verify current stock latency for the element
Human disposition: accepted by service-lead@site-14 under standing delegation

That is governable. Not because it reveals private chain-of-thought — it doesn't need to. It reveals decision provenance. Tool calls aren't plumbing here; they're evidence of cognition. If the agent used the wiki, the trace proves it. If it skipped the wiki, the trace proves that too.

And the rejected proposals are not clutter; they are the most valuable rows in the artefact. Six months later someone reviews parts spend and asks why the AI is ordering backup components. Without the receipt: AI is over-ordering parts. With it: the cheaper one-part proposals repeatedly failed the customer-trust node, the front-desk explainability node, and the first-visit-resolution node. That is the difference between waste and strategy — and it's how you stop an efficiency review quietly killing the good version of the system.

Four things the first edition of this argument got wrong

I published a version of this case in June 2026. In the year of writing that followed it, four of its claims turned out to be either half-true or actively dangerous. Better to say so than to keep selling them.

1. The rewind is one clock, not the clock

Restoring the commit tells you what the system knew. It does not tell you what bound the organisation. Bitemporal modelling has named these two axes for decades:¹⁰ transaction time (when the system recorded it) and valid time (when the fact was true in the world). A payroll system knows a rate is $100/day from 1 January; payroll runs on 25 February; on 15 March you learn the rate actually changed to $211/day effective 15 February. What was the rate for 25 February? By valid time, $211. By transaction time, $100.¹¹ Both correct, to different questions.

Half of every real audit is the valid-time question. Was this compliant when it was lodged? The current procedure is v21; the lodgement happened under v19. Answering that requires supersedes edges and validity windows — a walk down the succession chain to the version whose window covers the business date, with no restore required. Currency answers "what do we use now?" Applicability answers "what governed the world then?" For a historical question, the current tip is usually the wrong answer.

Which means overwrite is not hygiene. The warehouse instinct — insert a new version with effective dates rather than destroying the old one¹² — is the right one, and it arrives nearly free if the ingest agent records succession as an edge instead of overwriting the page and calling it tidy.

2. Nobody reads every trace

Ten thousand decisions a month, each with a trace. Nobody is reading them. A governance record that is never opened is worse than none, because it manufactures the feeling of control.

The shape that works is the one AI coding arrived at first: heavy thought before implementation, cheap implementation in the middle, heavy verification after. Applied here, the left plate is where senior attention belongs — deciding, before commitment, which pages are required knowledge for a decision class and which edges must be traversed before a non-obvious recommendation is permitted. The middle records completely and reviews nothing. The right plate scales with what you're about to commit: deterministic checks on everything (is the trace pinned, do the pointers resolve, was required-page coverage met); independent lenses on material decisions; full adversarial replay on irreversible ones.

Note the architecture rule that makes this safe, borrowed from code review, where GitHub's own AI reviewer explicitly "does not count as formal approval" and does not block a merge:¹³ the trace reviews the decision; it does not become the decision authority.

3. "Required page not observed = fail" is a trap

The obvious move, once you can detect an unobserved required page, is to make it a hard fail. It reads well and it would be quietly disastrous, for reasons that have nothing to do with technology.

Amber has a cost. It triggers process, attention and often blame. A governance system that can only express concern by changing a status will systematically suppress weak signals — and within two quarters, your required-page list will have been negotiated down to whatever the agent reads anyway.

Run two planes instead. The formal plane keeps its measures, attestations and traffic lights unchanged. Beside it, an exploratory plane reads the traces, compares traversals across teams, and reports findings with evidence and without changing formal status. Which lets an organisation say something it previously couldn't: Formal status: green. Independent findings: three items warranting management consideration.

There's a matching trap on the other side. Three "independent" assurance lines review the AI decision — and all three read the trace the agent produced. That is not three lines of defence; it is one assumption reflected through three mirrors. The fix is not a fourth reviewer reading the same artefact. It's a mechanically different verifier: re-run the decision from stored inputs, race an alternative traversal over the same pinned graph, or check the conclusion against the source system the graph routes to rather than the graph's own claim.

4. Replayable is not authorised

This is the one that matters most. The first edition closed on "the agent is replaceable — that is the governance win." That's right about ownership and over-claimed about safety.

There are two leashes, on opposite sides of the model. The epistemic leash is the wiki: it grounds what the agent believes is true, significant, contested or explicitly unknown. The action leash is authority infrastructure below the model: the model proposes, and an independent execution boundary decides what may actually happen.

Hold only the upper leash and you get an informed-but-unauthorised agent. Hold only the lower and you get a contained-but-ignorant one. Prompts are neither — too small and flat to hold an organisational world, too soft to enforce a boundary.

And there's a specific danger this whole argument creates. A well-conditioned agent is more effective and more dangerous. A rich, traversable organisational memory makes an agent's overreach more convincing — the most dangerous kind, because it sounds like the company. Build only the graph and you have a high-context confused deputy: excellent judgement, no accountable boundary.

Activation improves cognition. It does not mint authority.

The boundary: not every corpus earns a wiki

The sentence this argument is most at risk of being misread as is "replace your RAG with a wiki." Don't. Substrate is a decision, not an allegiance, and the rule runs per corpus: query shape × reuse frequency × loss tolerance.

• Query shape. "Find all the ways people solved X" is recall-shaped and hostile to synthesis — you want the seventeen variants, not one compacted claim.
• Reuse frequency. Compilation is capex, paid once per source. Daily triage repays it thousands of times; an occasional prior-art lookup never does.
• Loss tolerance. High tolerance, compile. Low tolerance, leave it raw.

The upgrade path for a working RAG is stratification, not migration: keep the RAG as the complete raw layer and grow a thin wiki atlas above it, where only recurring themes earn a page and every page routes down into the raw layer rather than replacing it. The page stores the shape of the design space and the query that fetches the specifics — never the compacted answer. The moment an atlas page absorbs the variants instead of pointing at them, you've migrated by accident.

And here's why that boundary is not a retreat from anything in this article. The atlas is exactly the provenance surface everything above requires, at a fraction of the cost. It's traversable and typed, so the path is recordable and gradeable. Each page's query is a resolvable pointer into the raw layer, so exhibits actually open. It's small enough to keep under version control and pin, so both clocks work. And the raw layer stays complete, so an exhibit is the real text rather than a compaction of it.

You don't need to compile the corpus to get cognitive provenance. You need to compile the routes.

What you actually own

Nearly three in four enterprises say losing an AI vendor would disrupt core operations; only 6% say they could stop using it without interruption. Eighty-nine per cent believe they could switch vendors within a month — but of those who actually attempted a migration, only 42% report a smooth transition.¹⁴ The hedge against that is not a procurement clause. It's an architecture: a portable, diffable, model-agnostic markdown graph means you swap the engine and keep the mind.

The model is the engine. The wiki is the memory. The DAG is the law. The receipt is the evidence.

Which reframes what "learning" means for an organisation. Closed-loop AI does not mean the model learns. It means the organisation remembers — and because it remembers externally, it can audit what it remembered.

That asset can rot, and it rots in named ways. The worst is calcified lore: a conditional pattern hardening into an unconditional rule — always replace the occupancy sensor for heated-seat complaints — at which point the graph has become another hidden optimisation nobody can see or challenge, which is precisely the failure it was built to fix. The tell is a claim with no conditions attached that everyone obeys. A governable claim has scope, conditions, evidence, a customer-service implication and an escalation rule.

The failure all of this exists to make harder isn't a wrong answer. Wrong answers are visible, arguable and correctable. It's a right answer nobody can check, acted on by someone who couldn't have checked it, in a system that remembers only the conclusion.

That is the man at the counter, holding a part order he had no way to argue with. Every mechanism here — the pin, the path, the pointer, the confession, the two clocks, the two planes, the two leashes — exists to make that outcome structurally harder. Not impossible. Harder, and visible when it happens.

So the governance question was never "can the AI explain itself?" It is: can the organisation replay the cognitive conditions under which the AI acted — and show what the AI was allowed to do with what it knew?

Ask your vendors both questions. Build the replayable system before the decisions you'll have to defend have already been made.