# Context engineering: budgets, evidence and agent compaction

> Organise AI-agent context with token budgets, task state, tool outputs, evidence references and compaction. A security example and restart checks.

Published: 2026-11-04  
Canonical: https://rootzero.eu/en/research/context-engineering-budgets-compaction/

Context is the information actually presented to a model for an invocation: instructions, request, useful history, tool results and selected sources. Context engineering organises that material throughout a task. Adding documents alone cannot preserve what should govern the next decision.

[Anthropic’s engineering account](https://www.anthropic.com/research/effective-context-engineering-for-ai-agents) discusses this selection problem. For security agents, we propose starting with verifiable state: authorised scope, observations, hypotheses and remaining actions.

## Make a budget observable

Reserve space for output and new tool results. Advertised context capacity does not tell you how much material is useful for a task. Count input using the applicable tokenizer; words, characters and tokens are different units.

The following allocation is an illustrative design exercise, not a universal threshold:

| Component | Example budget | Purpose |
| --- | --- | --- |
| Instructions and scope | 2,000 tokens | Objective, prohibitions and output contract |
| Task state | 1,500 tokens | Decisions, blockers and next steps |
| Selected evidence | 4,000 tokens | Useful excerpts and references |
| Recent exchanges | 1,500 tokens | Corrections and recent actions |
| Reserve | 3,000 tokens | New results and response |

An experiment should show what gets moved or removed when reserve falls.

## Keep artefacts, observations and conclusions separate

In a fictional API access check, the artefact is an HTTP exchange. The observation is that account B received a document. A cross-customer access-control finding additionally requires the expected owner and intended permissions.

Compacting these into “confirmed vulnerability” loses necessary conditions. A reference to the complete artefact permits resuming work without including every byte in each call.

```json
{
  "objective": "evaluate demonstration tenant isolation",
  "observation": "account B receives document D",
  "status": "unconfirmed",
  "evidence": "artefact:http-17",
  "missing": "expected owner of document D"
}
```

## Compaction must preserve authority boundaries

A summary should not expand permitted assets, convert an unanswered request into approval or turn a hypothesis into a result. We propose retaining scope in protected execution state and referencing its version in summaries.

Instructions found inside a retrieved document remain source data. Repetition inside a summary does not promote them into higher authority.

[Lost in the Middle](https://arxiv.org/abs/2307.03172) reports position-sensitive performance for the models and tasks studied. It motivates position tests rather than a universal context-fill percentage at which every model fails.

## Test resumption after compaction

Construct a history with an early exclusion, a changed date in the middle and conflicting late evidence. After compaction, verify that all three can be recovered with provenance. Include a question requiring retrieval of a complete external artefact.

Keep the summary, lost references and resulting decision. Fewer tokens represent a useful improvement only when required information remains accessible. Redundant text is not reliable memory.

Continue with [durable agent memory](/en/research/ai-agent-memory-lifecycle/) and [multi-agent contracts](/en/research/multi-agent-contracts-orchestration/), collected in the [AI and security series](/en/ai-security-guides/).