Context engineering: budgets, evidence and agent compaction

Context is the information actually presented to a model for an invocation: instructions, request, useful history, tool results and selected sources. Context engineering organises that material throughout a task. Adding documents alone cannot preserve what should govern the next decision.

Anthropic’s engineering account discusses this selection problem. For security agents, we propose starting with verifiable state: authorised scope, observations, hypotheses and remaining actions.

Make a budget observable

Reserve space for output and new tool results. Advertised context capacity does not tell you how much material is useful for a task. Count input using the applicable tokenizer; words, characters and tokens are different units.

The following allocation is an illustrative design exercise, not a universal threshold:

Component	Example budget	Purpose
Instructions and scope	2,000 tokens	Objective, prohibitions and output contract
Task state	1,500 tokens	Decisions, blockers and next steps
Selected evidence	4,000 tokens	Useful excerpts and references
Recent exchanges	1,500 tokens	Corrections and recent actions
Reserve	3,000 tokens	New results and response

An experiment should show what gets moved or removed when reserve falls.

Keep artefacts, observations and conclusions separate

In a fictional API access check, the artefact is an HTTP exchange. The observation is that account B received a document. A cross-customer access-control finding additionally requires the expected owner and intended permissions.

Compacting these into “confirmed vulnerability” loses necessary conditions. A reference to the complete artefact permits resuming work without including every byte in each call.

{
  "objective": "evaluate demonstration tenant isolation",
  "observation": "account B receives document D",
  "status": "unconfirmed",
  "evidence": "artefact:http-17",
  "missing": "expected owner of document D"
}

Compaction must preserve authority boundaries

A summary should not expand permitted assets, convert an unanswered request into approval or turn a hypothesis into a result. We propose retaining scope in protected execution state and referencing its version in summaries.

Instructions found inside a retrieved document remain source data. Repetition inside a summary does not promote them into higher authority.

Lost in the Middle reports position-sensitive performance for the models and tasks studied. It motivates position tests rather than a universal context-fill percentage at which every model fails.

Test resumption after compaction

Construct a history with an early exclusion, a changed date in the middle and conflicting late evidence. After compaction, verify that all three can be recovered with provenance. Include a question requiring retrieval of a complete external artefact.

Keep the summary, lost references and resulting decision. Fewer tokens represent a useful improvement only when required information remains accessible. Redundant text is not reliable memory.

Continue with durable agent memory and multi-agent contracts, collected in the AI and security series.