Compaction is the process of reducing long conversation history into a shorter representation the model can still use. Good compaction preserves task intent, open decisions, and operational constraints, while poor compaction can erase the details needed for safe or correct action.
Expanded Definition
In agentic AI and LLM operations, compaction is a memory-management step that compresses prior dialogue or task context into a smaller form the model can still act on. It is not simple truncation. Proper compaction preserves intent, unresolved decisions, tool outputs, constraints, and any safety boundaries that affect future actions. In practice, the quality of compaction determines whether an agent can continue a workflow without losing the logic that made earlier steps safe or useful.
Definitions vary across vendors and research teams because there is no single standard governing compaction yet. Some implementations summarise the conversation, others extract structured state, and some mix both approaches to keep context windows usable. For security teams, the important distinction is between preserving decision-critical state and merely shortening text. NIST guidance on control discipline and record integrity is useful here, especially when compaction affects auditability or operational traceability, as reflected in NIST SP 800-53 Rev 5 Security and Privacy Controls.
The most common misapplication is treating compaction as generic summarisation, which occurs when teams compress conversation history without retaining tool results, approvals, or constraints that govern the next action.
Examples and Use Cases
Implementing compaction rigorously often introduces a tradeoff between lower token use and the risk of losing context needed for safe execution, requiring organisations to weigh efficiency against fidelity.
- An AI support agent compresses a long incident thread into a state record that keeps the customer impact, escalation status, and already-approved remediation steps.
- A coding agent reduces a multi-turn debugging session into a concise task brief that retains the bug, attempted fixes, repository path, and deployment constraint.
- A procurement assistant compacts prior negotiation history while preserving the authorised budget ceiling and the vendor terms that still need legal review.
- An operations agent working with secrets or credentials keeps the fact that rotation was requested and approved, but excludes the secret material itself from the compacted state.
- A multi-agent workflow uses compaction before handing work to another agent so the downstream agent receives a controlled summary rather than an unbounded chat transcript.
These patterns align with current work on AI risk management and secure system design, including NIST AI Risk Management Framework and the operational control mindset in CISA Zero Trust Maturity Model. They also reflect the broader conversation about memory handling in agentic systems, where compaction must support continuity without over-retaining unnecessary data.
Why It Matters for Security Teams
Compaction becomes a security issue when teams assume shortened context is equivalent to trustworthy context. If the compression step drops an approval, changes a constraint, or removes a caution tied to identity, access, or safety, the agent may continue with authority it no longer deserves. That matters in NHI-heavy environments because agentic systems often act on behalf of people, services, and automation chains that depend on accurate state.
Security teams should treat compaction as part of the control plane, not just a prompt engineering convenience. Strong implementations need retention rules, validation checkpoints, and logging that explain what was preserved and what was discarded. This is especially important when compaction feeds downstream decisions in SOAR, IAM-adjacent workflows, or agent-to-agent handoffs. The governance question is not simply whether the model can still answer, but whether it can still answer safely after context has been reduced, consistent with control expectations in OWASP Top 10 for Large Language Model Applications.
Organisations typically encounter the consequences only after an agent repeats an outdated action, omits a critical constraint, or misuses an approval that was lost during compression, at which point compaction becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | AI RMF addresses governance, risk, and traceability concerns affected by compaction. | |
| NIST CSF 2.0 | GV.RM-01 | Compaction affects risk management and operational assurance in AI-enabled workflows. |
| OWASP Agentic AI Top 10 | Agentic AI guidance covers memory, state, and workflow risks that compaction can weaken. | |
| NIST SP 800-53 Rev 5 | AU-3 | Audit controls matter when compaction changes what is retained for traceability. |
| OWASP Non-Human Identity Top 10 | NHI guidance is relevant when compaction handles service identity context or delegated actions. |
Preserve decision state and validate retained context before any agent continues work.
