Advanced · Safety

Context as a Security Boundary

Visual diagram · (in preparation) · Math · (in preparation) · Worked example · 3 difficulty levels.

TL;DR. The design principle that an agent's context window is a trust boundary: what enters it defines what the agent can be persuaded to do.

Technical Definition

The design principle that an agent's context window is a trust boundary: what enters it defines what the agent can be persuaded to do.

How it works

Treating context as a security boundary means recognising that a language model cannot reliably distinguish instruction from data once both are inside the same window. Security must therefore be enforced at the boundary — before injection and after generation — rather than by asking the model to behave. In practice this means segmenting the window by trust level (system, user, tool output, third-party content), never granting untrusted segments authority, gating side effects behind capability checks outside the model, and treating any model output derived from untrusted context as untrusted itself. This principle is the foundation for capability-based agent authorization.

Related Concepts

• Context Poisoning — An attack or accident in which false or hostile content enters an agent's context and corrupts its subsequent reasoning and actions.
• Agent Authorization — Deciding and enforcing what an authenticated agent is allowed to do, at what scale, and under which conditions.
• Context Security — Protecting the integrity and confidentiality of what enters and leaves an agent's context window.
• Capability-Based Agent Authorization — Authorizing agents by handing them unforgeable, narrowly scoped capability tokens rather than checking roles at call time.