For anything an agent can persist, split the proposal path from the commit path and put a real trust boundary between them. If a model can save durable facts, untrusted text from one session could influence later sessions. A practical DIY baseline: Store proposed items as append-only JSONL in Git. Record the source, session ID, and originating commit. Treat agent-authored items as candidates. Promote items into the trusted briefing only through a human-controlled credential or out-of-band approval. Git provides diff, blame, and rollback. Provenance makes the trust decision inspectable. A --by human argument is not an authority check when the agent can invoke the same command. The promotion signal must be inaccessible to the agent, not merely labeled as human. One unresolved issue is expiry: provenance identifies where a rule came from, but not whether it still describes the codebase. What non-forgeable signal do you use before an agent-proposed memory becomes trusted state?