Context-centric governance is the practice of managing AI risk by controlling the surrounding instructions, retrieved data, and runtime context, not just the model itself. It recognises that behaviour is shaped by the full execution environment, including files that define access and action.
Expanded Definition
Context-centric governance is an AI security control approach that treats the prompt, retrieval layer, tool permissions, session state, and policy files as part of the security boundary. For NHI Management Group, the important distinction is that this term does not focus only on the model, because model behaviour is often shaped by whatever the agent can read, retrieve, and execute at runtime. That makes it especially relevant to agentic AI, retrieval-augmented generation, and systems that can act on behalf of users or services.
Definitions vary across vendors, but the common thread is governance of the surrounding context rather than the weights of the model itself. The term overlaps with NIST Cybersecurity Framework 2.0 thinking because it emphasises risk management across assets, access, and operational dependencies. In practice, context is not just conversation history; it includes retrieved documents, system instructions, memory stores, connectors, and action policies that can expand or constrain what an AI system does.
The most common misapplication is treating prompt filtering as sufficient, which occurs when organisations ignore the retrieval sources, tool scopes, and mutable runtime files that actually govern model behaviour.
Examples and Use Cases
Implementing context-centric governance rigorously often introduces operational friction, requiring organisations to balance tighter control over AI behaviour against faster iteration for teams building AI-enabled workflows.
- Restricting which knowledge base collections a customer support agent can retrieve from, so the model does not answer from stale or unapproved documents.
- Separating system instructions from user prompts and maintaining version control on policy files that define what the agent may access or execute.
- Applying allowlisted tool scopes to an AI assistant so it can draft an email but cannot send it without human approval, a pattern closely aligned with guidance in OWASP Top 10 for Large Language Model Applications.
- Monitoring retrieved content for poisoning, prompt injection, or privilege escalation cues before it is passed into the model.
- Limiting memory retention for agent sessions when the retained context could carry sensitive data into later actions or users.
These use cases show that governance decisions are often made outside the model itself, in the surrounding orchestration layer where instructions, secrets, and data meet.
Why It Matters for Security Teams
Security teams need this concept because AI incidents often begin with trusted context rather than a faulty model. A benign-looking document, connector, or action file can silently alter the agent’s behaviour, enabling data exposure, unsafe automation, or policy bypass. Context-centric governance therefore connects AI safety with classic control disciplines such as access management, change control, and data handling. It also matters for NHI and agentic AI security because many agents operate with non-human credentials, API keys, and delegated privileges that become dangerous when paired with untrusted runtime context.
Controls in the NIST Cybersecurity Framework 2.0 map naturally to this problem, especially where organisations must govern identities, assets, and protective measures across dynamic environments. Context-centric governance helps teams ask not only whether the model is approved, but whether the surrounding execution path is still safe, current, and correctly scoped. Organisaties typically encounter the damage only after an agent has retrieved the wrong source, executed an overbroad tool action, or inherited an unsafe instruction set, at which point context-centric governance becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST AI 600-1 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | AI RMF governs AI risk across the system lifecycle, including surrounding context and dependencies. | |
| NIST AI 600-1 | The GenAI Profile addresses risks from prompts, data inputs, and system context around GenAI. | |
| OWASP Agentic AI Top 10 | OWASP Agentic AI guidance focuses on agent tool access, memory, and context injection risks. | |
| OWASP Non-Human Identity Top 10 | NHI guidance is relevant where agent context includes service identities, secrets, and delegated access. | |
| NIST CSF 2.0 | PR.AC-4 | Access control and least-privilege principles apply to the tools and context an AI system can use. |
Apply AI RMF govern and map functions to manage prompts, retrieval, and runtime context as risk-bearing assets.
