Intermediate · Safety

Context Provenance

Visual diagram · (in preparation) · Math · (in preparation) · Worked example · 3 difficulty levels.

TL;DR. Tracking where every piece of content in an AI system's context came from, and how much to trust it based on that origin.

Technical Definition

Tracking where every piece of content in an AI system's context came from, and how much to trust it based on that origin.

How it works

Context provenance applies the data-engineering idea of lineage to what a model sees at inference time. In agentic systems, context is assembled from many places — user messages, retrieved documents, tool outputs, other agents, stored memories — and injection attacks work precisely by smuggling instructions in through channels the operator does not police. Provenance discipline means tagging each context item with its source and trust level, letting the system treat a customer-uploaded file differently from a vendor-signed document, and letting auditors reconstruct why an agent acted as it did. It is the enabling practice behind CxBOM-style inventories and increasingly a requirement in enterprise AI governance reviews.

Related Concepts

• CxBOM (Context-Window Bill of Materials) — A structured inventory of everything packed into an agent's context window — data sources, tools, memories, fetched documents — used to audit and secure what the model can actually see.
• Agent Memory — Information an agent retains beyond the current context window — episodic history, learned facts, preferences, and task state.
• Context Window — The maximum number of tokens a model can process in a single input, determining information capacity.
• Prompt Injection — An attack where untrusted input (a webpage, email, tool output) contains instructions that hijack an LLM's behavior in an agentic context.