DETERMINISTIC GOVERNANCE AND MEMORY STATE

9. Deterministic Governance: Hooks and the Lifecycle

Everything discussed so far trusts the model to behave within the boundaries it has been given. Hooks are the point at which an enterprise platform stops trusting and starts enforcing: deterministic logic that fires at fixed points in an agent’s lifecycle, independent of how the model reasoned about a given action.

Four lifecycle points cover the governance surface that matters to most enterprise deployments:

• Session start — inject standing context: coding conventions, the active work item, environment configuration. This ensures every session starts from the same institutional baseline rather than depending on what the operator remembered to paste in.
• Pre-tool-use — fires before every tool invocation. This is where audit logging, deterministic denial of dangerous operations (destructive filesystem commands, force-pushes, anything touching a production-labeled resource), and automatic formatting live.
• Permission requests — route approval for sensitive actions to a human, out-of-band, while auto-approving low-risk actions like reads and test execution.
• Stop — the point at which the process decides whether to continue or conclude. A goal condition, described in Section 3, is technically a specific instance of this hook — a prompt-based stop condition evaluated by a separate model. When completion must instead be decided by running something and inspecting a real exit code rather than reading transcript text, a command-based stop hook is the correct tool.

The governance value of the pre-tool-use hook in particular deserves emphasis: a deterministic audit log — every command, timestamped, independent of the model’s own narration of what it did — is precisely the artifact a change-management or AI-risk review process requires. It converts “we trust the agent behaved correctly” into “here is the complete, reviewable record,” which is the difference between an assurance and a control.

Hooks are not without their own failure mode: an overly broad deny-list can block legitimate work and stall a loop indefinitely, and a hook that fails silently can either wedge a session or, worse, silently allow an unsafe action through. Both the allow and deny paths of any governance hook should be tested explicitly before it is relied upon.

10. Memory and State Across Sessions

Because individual agent sessions do not share context by default, any lesson, convention, or piece of accumulated institutional knowledge must be persisted to a file that gets re-read at the start of the next session — it cannot live only in a conversation that will be discarded. This is the mechanism by which loops accumulate genuine institutional memory rather than re-deriving the same context from scratch every run: a standing conventions file read automatically every session, and narrower sidecar state files for loop-specific accumulated knowledge.