Context
The selected information available to an agent during a current decision — the objective, the policy, the conversation so far, the business records, the retrieved material and the working notes.
Updated 15 September 2026
In practice
Before drafting a refund response, the system assembles the customer's order, the current refund policy version, the prior conversation and the agent's spending limits.
The distinction
A large context window is temporary capacity, not knowledge. Context determines what the system can consider now; it does not establish that any of it is current, permitted or true.
Seven kinds of information, seven different controls
| Component | What it tells the agent | Primary risk |
|---|---|---|
| Objective | The result and the stopping condition | Ambiguous or conflicting goals |
| Policy and authority | What it may do, spend, disclose or change | Instructions mistaken for permission |
| Current interaction | What has happened in this run | Constraints displaced by noise |
| Business state | The current customer, order or account record | A stale copy treated as the system of record |
| Retrieved knowledge | Relevant policies, research or prior cases | Irrelevant, untrusted or unauthorised records |
| Retained memory | Selected state from earlier sessions | False, sensitive or obsolete memories |
| Working material | Plans, calculations and temporary files | Leakage or uncontrolled retention |
Policy normally outranks a user preference. A current account balance comes from the banking system, not from a memory written last week. Keeping the categories apart is what makes those rules enforceable.
Retrieved content is data, not command
Web pages, emails and documents can contain text that reads like an instruction to a model. When an agent can act, a hostile or accidental instruction inside retrieved content can attempt to redirect the task or invoke a tool.
The operating hierarchy places policy and explicit delegated authority above retrieved content. Untrusted material stays labelled, tool permissions stay narrow, and consequential actions require approval.
Sources & context
Manage tool context
Anthropic · 2026
Documents prompt caching, on-demand tool definitions, programmatic tool calling and context editing as ways to manage context pressure.
Source checked 2026-09-13
Retrieval
OpenAI · 2026
Documents semantic search over vector stores with attribute filtering applied before search, and results carrying the originating file.
Source checked 2026-09-13