Most governance conversations around AI agents start at execution. What may the system touch? What may it do? What approval does it need? What record should it leave behind?
Those questions matter. But there is a smaller, stranger problem nearby that I keep seeing in systems that carry work across time.
A present step can be readable and still come from a history that should not govern.
That is the seam I wanted to name here. A system can look locally legible while the path that produced its governing state is globally suspect.
Sometimes the defect is in the lineage, not the snapshot.
Replay contamination, reset residue, stale derived state, and mixed execution history can all create the same practical failure shape. The present action still matches its declared dependencies. The ledger still looks coherent. The current step is not opaque. But something earlier re-entered, lingered, or got mixed in a way the local check does not catch cleanly.
In that situation, the system may be exact about the wrong thing. The current surface is neat. The underlying history is not.
"Is this what was approved?" is not always enough.
Binding answers an important question: is this the action and dependency set that was approved? That matters a lot. But in some settings it does not answer the next question: did the history that produced the governing state remain fit to do so?
Those are not the same check. A grant can still be live. A dependency set can still match. A record can still be internally consistent. And the path leading into execution can still be unfit to govern.
Trajectory integrity is a separate governance question.
The phrase I am using for that question is trajectory integrity: whether the causal history that produced the governing state remains admissible enough to support execution.
The strongest version of the claim is simple: governing state should come from a coherent, admissible lineage, not merely from a set of artifacts that still look valid at the present step.
This does not require one grand implementation doctrine. It only suggests that some systems need an explicit way to ask whether the current state is not just matching, but well-derived.
Delegated systems make this seam easier to hit.
This question gets sharper when authority stretches across time, when action happens after approval rather than during it, when runtimes resume after interruption, or when multiple sources contribute to what becomes the governing state.
In those environments, it becomes tempting to treat legibility as though it were enough. But a clean record of what was approved is not yet proof that the path leading to execution remained sound.
A trajectory can be locally legible and still globally suspect. If that defect class is real, then serious governance systems likely need an explicit way to reason about trajectory integrity instead of assuming ordinary binding has already done enough.