Behavioral Version Control: Governing Agent Self-Modification of Procedural Memory as Unreviewed Code Change

Deployed LLM agents update their own procedural memory, the stored knowledge of how to act: instruction files, skill libraries, and learned playbooks. Each update is an unreviewed, self-authored change to production behavior. Software engineering governs code changes with version control and review; MLOps governs model weights with registries and staged promotion. No comparable discipline covers the behavioral state agents accumulate at runtime, and a growing record of memory-poisoning incidents and benign-drift findings shows what that gap costs. We propose Behavioral Version Control (BVC), a framework that treats agent self-modification as a change-management problem. BVC requires four things of a memory substrate: self-modifications rendered as reviewable diffs, an append-only changelog binding each change to its provenance and rationale, risk-tiered approval gates enforced outside the agent’s write authority, and rollback with commit-level granularity and explicit limits on external side effects. We give a reference architecture, a worked example, evaluation criteria, and a positioning analysis showing which components exist today and which remain unoccupied.