Coding-agent governance is not one tool category. Instruction files shape behaviour, ADRs preserve reviewed rationale, MCP or CLIs expose context, RAG broadens discovery, and CI policy engines verify objective consequences. The right architecture assigns each layer a clear authority and does not label advisory instructions as enforcement.
Compare by job, not feature count
A repository instruction file may influence an agent before coding but cannot prove that a patch complies. An ADR can explain authority but is useful only if the agent can discover it. A policy engine can block a known structural violation but cannot supply the rationale for every design choice.
- Instruction files: broad, tool-readable operating guidance.
- Decision records: reviewed authority, rationale and lifecycle.
- MCP or local CLI: a common retrieval interface with citations.
- RAG: high-recall discovery across unstructured material.
- CI policy: deterministic checks for objective constraints.
Authority and retrieval are separate
An MCP server is a transport, not automatically a source of truth. A vector database is an index, not automatically authority. Define which repository records humans review and then expose them through interfaces suited to agents and automation.
A defensible stack
Use concise tool-specific instructions to trigger decision discovery. Keep accepted records in Git with explicit lifecycle. Return stable citations through a read-only interface. Add CI checks only where the decision has a consequence that can be evaluated objectively. Retain human review for everything else.
Questions to ask vendors and projects
Ask whether results are reproducible at a pinned commit, whether proposed and superseded records are distinguished, whether writes require explicit human review, and exactly what an enforcement claim covers. These questions reveal the control model more clearly than a long integration list.