JIT bind: how an agent hydrates without RAG or long context

Every enterprise action reaches a binding checkpoint: a policy rule, a tool schema, and a record whose value must be current. Broad retrieval and retained interaction history can leave unrelated state eligible at that point. JIT bind resolves the state required by the specific checkpoint and keeps the model context narrowly scoped.

The objects

• Layer 01 index — tenant-scoped pointers: entity handles, policy refs, workflow position. Not documents. Not embeddings of last quarter’s wiki.
• Intent — the job step in flight, parsed by neural inference from messy input (thread, PDF, exception).
• Tool schema — which call is legal at this checkpoint, with which required fields for this tenant.
• Bind target — the single index hit that can fill those fields or authorize that call.
• Slice — the bound payload. Target size is kilobytes (the sample bind is 2.1 KB), not a window.
• Flush — working memory is emptied after the inference or tool call. The next checkpoint starts clean.

The gate

The runtime invokes the binding gate when a task reaches a checkpoint rather than when a session begins. The sequence is: checkpoint identifier → index lookup → scoped payload and size logged → tool call → working-memory release. In the sample trace, CTX-BIND-8841 resolves one vendor discount rule from org.index/vendor/X/clauses/bulk-discount before the ERP action.

The useful measurement is the set of records eligible when the ERP call runs. A scoped bind makes that set inspectable. Session-wide retrieval or retained account history makes provenance and freshness harder to establish because unrelated records remain available to inference.

Why this is function-specific

The bind target is selected by intent, tenant, and tool schema rather than semantic similarity alone. This prevents a finance-close action from resolving an outreach policy or a journal template from the wrong legal entity. Each checkpoint declares the state it may consume, which keeps function-specific tool calls bounded and auditable.

Bind state at the execution checkpoint and keep authoritative state outside the agents’ conversation history.

Bruce applies this protocol to ERP writes and policy checks. A change in the inference model can affect intent parsing, but it does not change how records are resolved, which policies are enforced, or how writes are validated. Those invariants are what allow model substitution without discarding the execution benchmark.