In-context learning

A model’s ability to adapt its output from examples placed in the prompt without changing its underlying weights. The behaviour is temporary but operationally meaningful, because the session context can steer what the model produces for the duration of inference.

Expanded Definition

In-context learning is the ability of a model to adjust its output using examples, rules, or patterns included in the current prompt, without any weight updates or fine-tuning. In NHI and agentic AI operations, this matters because the model may appear to “learn” a workflow, policy, or credential-handling pattern for the life of a single session, but that adaptation is temporary and bounded by the inference context.

Definitions vary across vendors on whether in-context learning should be treated as a capability, a prompt-engineering technique, or an emergent behaviour. For governance purposes, NHI Management Group treats it as an operational control surface, because prompt content can influence tool use, secret handling, and authorisation boundaries. That makes it relevant to identity-scoped prompts, retrieval augmentation, and agent instructions that reference service accounts, API keys, or task-specific permissions. The practical question is not whether the model has learned permanently, but whether the prompt has changed what the model will do right now.

For a broader identity governance baseline, see Ultimate Guide to NHIs and the NIST Cybersecurity Framework 2.0. The most common misapplication is treating prompt examples as harmless context, which occurs when teams let operational instructions or secrets drift into the session without access scoping.

Examples and Use Cases

Implementing in-context learning rigorously often introduces prompt-design and validation overhead, requiring organisations to weigh faster adaptation against tighter controls on what the model is allowed to infer from the session.

• An AI agent receives a few labeled examples of approved versus rejected ticket responses, then mirrors that decision pattern during the same interaction window.
• A service assistant is shown the structure of a change-approval template and uses it to draft incident-specific requests without any model retraining.
• A retrieval-augmented workflow feeds the model recent policy snippets so it answers according to current NHI handling rules for that session only.
• A security copilot is prompted with examples of valid and invalid API key usage, helping it flag risky patterns in operational text.
• Teams compare this behavior with formal identity controls in the Ultimate Guide to NHIs and use the NIST Cybersecurity Framework 2.0 to keep the broader control environment consistent.

Why It Matters in NHI Security

In-context learning can improve responsiveness, but it also creates a subtle governance risk: the model may comply with whatever the prompt most recently normalised, including unsafe access instructions or secret-handling patterns. That is especially important in NHI environments where prompts may include service account names, scoped credentials, delegation steps, or tool permissions. If a prompt is contaminated, the model can become a short-lived policy engine for the wrong policy. The risk is amplified when teams assume prompt examples are isolated from production behaviour, because an agent may reuse those patterns across multiple tool calls within the same session.

NHIMG research shows that 96% of organisations store secrets outside secrets managers in vulnerable locations, and 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, underscoring how quickly weak handling can become an incident. In practice, in-context learning should be paired with prompt hygiene, session scoping, and explicit boundary checks so examples do not become a covert instruction channel. The Ultimate Guide to NHIs is the right reference point for that governance lens. Organisations typically encounter the security impact only after an agent echoes a sensitive pattern or oversteps its intended tool access, at which point in-context learning becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the Model Context Protocol (MCP) and why does it matter for security?
• What is MCP in the context of AI security?
• When is it appropriate to implement MCP in the context of AI systems?
• Why is organizational context important for AI agents?