Mneme enforces architectural decisions at the earliest reliable workflow boundary. Human-authored decisions are compiled into a structured corpus; typed rules are enforced deterministically — preventing supported mutations before they land, catching what escapes prevention at a post-mutation or session boundary, and verifying the final tree in CI. Retrieval provides guidance. Retrieval is not enforcement.
How it works

Human-readable decisions,
deterministic enforcement.

Mneme lets teams author architectural decisions as ADRs, compiles them into a structured corpus, and applies that corpus deterministically across the agentic workflow — guiding before generation where a harness allows it, preventing supported mutations before they land, catching what escapes prevention, and verifying at the repository boundary in CI.

Engineers working a derivation through on a whiteboard, the reasoning written in marker
A system's decisions, laid out where people can see them. Mneme's job is to keep them true once agents start writing.

The problem with prose decisions

Architecture Decision Records and team conventions live in documents. Engineers write them carefully. But an AI coding agent working three weeks later does not reliably recall that ADR-007 forbids direct BigQuery access from frontend routes, or that the team standardized on Pub/Sub and retired Celery.

Prose is for humans. It communicates intent, rationale, and trade-offs. But prose alone cannot produce a verdict. It cannot be checked at generation time. It cannot tell an agent to stop.

Mneme solves that gap without replacing the prose. ADRs remain the human artifact. Mneme maintains a parallel structured representation that enforcement can reason against.

The enforcement flow

Decisions become enforcement through one pipeline, applied at four workflow boundaries:

  1. 01
    Author decisions in human-readable form. Write ADRs, policy documents, or team conventions as you normally would. Mneme provides a structured schema alongside them — each decision gets an id, a title, constraints, anti-patterns for guidance, and optionally typed rules with exact semantics.
  2. 02
    Compile into a structured corpus. Mneme maintains a parallel structured representation that enforcement can reason against. Typed rules currently have one canonical form — FORBID_LITERAL, an exact, case-sensitive literal — plus optional path applicability (include_paths/exclude_paths) that determines where the rule applies (ADR-020).
  3. 03
    Enforce at the earliest reliable boundary — four of them. (a) Guidance before generation, where a harness exposes context injection. (b) Prevent before supported mutations, where proposed content can be reconstructed deterministically. (c) Catch at a post-mutation or session boundary when prevention isn't technically possible. (d) Verify in CI at the repository boundary. A match produces a structured verdict: PASS, WARN, or FAIL — or an explicit INCOMPLETE when evaluation could not finish.
  4. 04
    Record an auditable trace. Every verdict records which rule matched, which term triggered it, and — for path-scoped rules — the applicability outcome against the real target path. A human can reconstruct any verdict from the artifacts: no hidden scoring, no black box.

Retrieval is not enforcement. Retrieval decides which decisions are injected as guidance and which legacy multi-term heuristics run for the current task. It does not bound typed-rule enforcement: literal rules operate corpus-wide regardless of retrieval score (ADR-017), filtered only by their own path selectors (ADR-020). A decision that was never retrieved can still block.

Claude Code implements the full arc — direct edits prevented pre-mutation, a narrowly reconstructable shell form checked pre-execution, a Stop audit catching the session delta that escaped prevention, then CI as final verification. Other integrations ship subsets of the arc; each integration page states exactly which boundaries it covers and which bypasses remain.

A concrete example

The team has decided: no second LLM provider in v1. Anthropic SDK only.

From decision to verdict
—
The decisionThe team has recorded: "Do not introduce a provider-abstraction layer like litellm. The only LLM provider is Anthropic."
↓
The structured ruleMneme holds the decision as guidance text (constraint, anti-pattern) for retrieval, and — when authored as a typed rule — as a mechanically enforceable rule: an exact, case-sensitive FORBID_LITERAL on litellm, optionally scoped with path selectors.
↓
The proposed changeAn agent proposes: "Add litellm as the provider abstraction layer so we can swap models later."
↓
The verdictFAIL — the typed literal matched at whichever boundary evaluated it. The decision that fired, the term that triggered it, and the applicability outcome are all recorded in the output.
The defining property is mechanism, not timing. Preventing a mutation before it lands is the ideal — and where a harness exposes it, Mneme prevents. Where prevention is not technically possible, Mneme catches the change at the next reliable boundary instead of claiming coverage it does not have. Deterministic detection at an honest boundary beats probabilistic promises at an early one.

Why deterministic enforcement matters

Enforcement that varies between runs is not governance — it is suggestion. Mneme is built around the principle that the same decision, the same task, and the same memory must produce the same verdict, every time, in every environment.

This determinism is what makes governance auditable. When a CI step fails or an agent is blocked, the verdict is reconstructible: the rule that matched is recorded, the term that triggered it is recorded, and the score that surfaced that rule is recorded. There is nothing probabilistic to investigate.

It also makes regressions visible. Any change to the enforcement layer that would alter a verdict is detectable against the frozen benchmark suite — nothing can drift silently.

For deeper detail on the retrieval mechanics, the benchmark methodology, and the Layer 1 charter, see the architecture doc in the source repository.

Where Mneme sits

The architectural intent enforcement layer.

Coding agents generate. Rules files steer. Memory recalls. RAG retrieves. Mneme HQ enforces the architectural decisions that govern implementation.

Where Mneme sits A developer prompts AI coding agents (Claude Code, Cursor, Codex). The Mneme HQ architectural intent enforcement layer for AI coding agents draws on ADRs, standards, architectural constraints and its decision corpus to run a constraint evaluation. An allow verdict yields architecture-aligned code; a block verdict produces guidance that is fed back to the agents to retry. WHERE MNEME SITS ALLOW BLOCK retry with guidance Developer AI coding agents Claude Code · Cursor · Codex Mneme HQ Architectural Intent Enforcement for AI Coding Agents ADRs Standards Architectural constraints Decision corpus Constraint evaluation Guidance Architecture-aligned code
Mneme governs the moment between intent and generated code — one set of rules, applied to every agent, before the change lands.
Rules files document standards.
Mneme enforces them.
Memory tools recall context.
Mneme governs implementation.
RAG retrieves knowledge.
Mneme operationalizes decisions.

The AI-assisted engineering stack

Pre-generation governance
Mneme. Compiles architectural intent into enforceable constraints and applies them at the earliest reliable workflow boundary.
Generation and runtime
Agent frameworks and runtime harnesses. Cursor, Claude Code, agent platforms.
Post-generation observability
Tools like SentRux. Detect violations after the agent has acted.

SentRux tells you when the agent violated architecture. Mneme helps prevent the violation from being proposed in the first place. The two layers are complementary.

What Mneme prevents

Concrete violations, not abstract rules.

Mneme injects your team's architectural decisions into AI-assisted generation. Below is what that catches in practice — the kinds of changes an agent will otherwise ship, because nothing told it not to.

Example scenario

A developer asks Claude Code to add analytics to a checkout route. The agent proposes importing the BigQuery client directly into the frontend service — violating your layered architecture decision that data-platform calls belong in a backend service only.

At a boundary that supports prevention — the Claude Code edit hook, for example — the violating write is blocked before it lands and nothing reaches your PR queue. Where a surface escapes prevention, the session audit or the CI gate catches it instead; the boundary that fired is recorded either way.

Unauthorized framework introduction

Redux pulled into a Zustand-standardized app. Banned ORM imported into a service that already chose another.

Cross-boundary architecture violations

BigQuery client instantiated inside a frontend route. Business logic dropped into a controller. Layering decisions ignored.

ADR supersession conflicts

Celery re-introduced after the team moved to Pub/Sub. Old decisions reappearing because the agent didn't see the new one.

Restricted path modifications

Codegen agent writing to db/prod/migrations/*. Billing agent touching the auth package.

Security policy violations

Raw SQL string concatenation. Mock auth shipped in production paths. Credentials handled outside the approved surface.

Non-approved dependency usage

GPL packages added to a license-restricted repo. Internal-only libraries imported into externally-shipped services.

See all twelve examples across five governance categories →

Not the same category

Not all AI guardrails govern architecture.

"Governance" and "guardrails" describe several different problems. Mneme HQ solves a specific one: keeping AI-generated code aligned with your architecture.

AI governance platforms
Manage model risk, compliance, access, and organizational oversight.
Agent security guardrails
Restrict commands, tools, credentials, networks, and runtime behaviour.
Memory and rules files
Provide agents with instructions and historical context.
Mneme HQ
Enforces ADRs, system boundaries, framework decisions, and engineering standards where agents generate code.
Reference Governance violations → Twelve concrete examples of what enforcement catches, across architecture, security, dependency, and platform categories. Benchmark Benchmark → The v1.1 benchmark suite: layered retrieval and enforcement scoring, structured verification, pre-registered thresholds. Reference CLI reference → Run mneme check in CI or as a pre-commit hook. Exit codes, flags, and GitHub Actions patterns.