Context-perimeter drift describes the shift from protecting fixed technical boundaries to protecting conversational and tool-mediated interactions. It captures the gap that appears when security controls remain endpoint-centric while business logic, data access, and privileged actions move into model-assisted workflows.
Expanded Definition
Context-perimeter drift is the security gap that emerges when trust decisions are still anchored to device, network, or application edges, while actual work happens inside prompts, chat sessions, copilots, and agent-mediated tool calls. The term is most useful in AI security and identity governance because the control point has moved from a fixed perimeter to a changing context: who initiated the interaction, what data the model can see, which tools it can invoke, and whether the request is still aligned with policy.
Unlike classic perimeter security, this concept focuses on the conversation as the unit of risk. A single interaction can expand access, expose secrets, or trigger privileged actions without ever crossing a traditional network boundary. That makes it closely related to identity assurance, authorization scope, and non-human identity governance. For an authoritative baseline on governance-oriented security outcomes, see NIST Cybersecurity Framework 2.0.
Definitions vary across vendors when they describe this as a prompt-security issue, an agentic AI issue, or a zero-trust issue, but the core idea is consistent: the perimeter has become contextual rather than physical. The most common misapplication is treating context-perimeter drift as a pure endpoint problem, which occurs when organisations harden laptops and networks while leaving model access, tool permissions, and session context unconstrained.
Examples and Use Cases
Implementing controls against context-perimeter drift rigorously often introduces workflow friction, requiring organisations to weigh conversational speed against tighter review, logging, and access checks.
- A customer support copilot can retrieve account records based on session context, but the same session later expands into refund approval without a fresh authorization check.
- An internal AI agent can read a ticket summary and then use connected tools to reset credentials, exposing a privileged action path that traditional endpoint controls never see.
- A procurement assistant can access vendor contracts through retrieval-augmented generation, yet policy is not enforced when the model passes excerpts into downstream workflow tools.
- A developer assistant can generate deployment commands from a chat thread, but the approval model assumes the workstation is trusted rather than the action context.
- A non-human identity embedded in an orchestration flow can inherit broader permissions than intended when the conversation state, not the service identity, becomes the real decision signal.
These patterns are increasingly discussed alongside guidance from the OWASP Top 10 for Large Language Model Applications, especially where prompt injection, excessive agency, and tool misuse create an expanding trust boundary. They also map to the control philosophy in the NIST Cybersecurity Framework 2.0, even though the framework does not name this term directly.
Why It Matters for Security Teams
Security teams need to understand context-perimeter drift because it changes where control failures occur. Traditional defenses may still report a healthy perimeter while sensitive actions are being authorized inside AI sessions, agent workflows, and service-to-service chains. That creates blind spots in logging, entitlement review, segregation of duties, and incident response.
The identity connection is especially important. When a model or agent can call tools, retrieve secrets, or act on behalf of a user, the real security question becomes whether the current context is sufficiently bound to identity, purpose, and policy. This is where NHI governance becomes relevant: machine identities, delegated tokens, and ephemeral permissions can all drift out of alignment with the conversational context they were meant to support. For governance and access-control design, the OWASP LLM guidance is useful for identifying where model-driven workflows widen the attack surface.
Organisations typically encounter the consequences only after an agent makes an unauthorized tool call, exposes a secret, or completes a business action that no human explicitly approved, at which point context-perimeter drift becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Addresses access permissions and least privilege when context changes across workflows. |
| NIST AI RMF | Governance and mapping functions help manage AI system risks tied to drifting trust boundaries. | |
| OWASP Agentic AI Top 10 | Covers agentic AI risks where tool use and autonomy outgrow the intended context. | |
| OWASP Non-Human Identity Top 10 | Relevant when machine identities and delegated tokens become the true control perimeter. | |
| NIST SP 800-63 | AAL2 | Identity assurance helps ensure the current user context is strong enough for sensitive actions. |
Revalidate authorization whenever conversational context expands into new data or tool access.
