The security failure that occurs when legitimate prompts, retrieved content, secrets, and tool permissions are combined into one execution path. The individual components may be acceptable on their own, but together they create a higher-risk action chain that traditional access reviews often miss.
Expanded Definition
Context collision describes a control failure in which separately acceptable inputs or permissions are composed into one execution path that is more dangerous than any element on its own. The problem is not simply that a prompt exists, or that a tool is available, or that a secret is stored somewhere accessible. The failure emerges when those elements are combined without a strong boundary between what the model may read, what it may decide, and what it may execute.
This term is most relevant in agentic AI and NHI-adjacent environments, where an AI agent, retrieval layer, secret store, or workflow connector can all be technically “working” while still creating an unsafe chain of action. The boundary that is often missed is the transition from context assembly to action authorization. A system may appear compliant at the component level yet still allow an over-broad effective privilege. For control mapping, NHI Management Group treats this as a composition problem rather than a simple prompt-safety issue.
In practice, the term is used to describe failures that arise when trust is inferred from proximity inside the same conversation, session, or orchestration path. That is why context collision is more dangerous than a single misconfigured control: the risk is created by the interaction between otherwise reasonable parts.
Examples and Use Cases
Context collision commonly appears in agent workflows where separate inputs are merged before the agent acts. The issue is not always visible in the individual logs because each piece may look benign in isolation.
- An AI assistant retrieves an internal policy document and also receives a user request that appears normal, but the combined context allows it to expose a restricted process detail.
- A workflow agent can read a secret from a vault, then use that secret in a downstream tool call that was not intended for the same trust boundary.
- A support bot receives a legitimate troubleshooting prompt, but retrieved customer records and tool permissions together let it perform an action beyond the original request.
- A multi-step automation chain blends calendar, ticketing, and admin APIs, and the agent is allowed to infer a higher level of authority from the merged context.
The implementation tradeoff is that richer context often improves usefulness, but every added source increases the chance that the system will treat unrelated trust assumptions as one coherent decision space. The more the orchestration layer reuses context across tools, the more important it becomes to distinguish informational access from execution authority.
Security Implications
When context collision is misunderstood, access reviews can certify each input path as acceptable while missing the combined risk of the full chain. That creates a blind spot where secrets, retrieval content, and tool permissions reinforce one another into a higher-impact action than any control was designed to permit.
Common consequences include unintended data disclosure, unauthorized tool invocation, excessive privilege use, and policy bypass through indirect instruction. In agentic systems, the observable symptom is often not a single broken permission but an apparently valid series of steps that produce an unsafe outcome. This is especially hard to detect when the model is allowed to mix user instructions with retrieved material and operational credentials in the same reasoning path.
A practitioner should treat this as a composition hazard: the risk is in the assembled context, not only in the original artifacts. If a control only checks whether a prompt is allowed or whether a secret is present, it may still miss the moment where both together create an unsafe action surface.
Domain and Governance Relevance
Context collision matters most in agentic AI security and in governance of non-human identities that can read, reason, and act across multiple systems. The core question is whether the entity making decisions is also being supplied with the information and authority needed to carry them out. If those layers are not separated, the environment can drift into implicit trust based on context rather than explicit authorization.
For NHI governance, this changes how ownership is assigned. A secret, token, or service credential is not just an access artifact if it can be combined with model context to trigger actions outside its intended scope. That means inventory, routing, and permission boundaries need to be understood together, especially when one agent or workflow can carry context from retrieval into execution.
The broader governance lesson is that approval at the component level is not enough when the risk is created by composition. The system must be evaluated at the path level, not only at the part level.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATLAS address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 — Prompt Injection and Context Integrity | Context collision centers on unsafe merging of prompts, retrieved data, and tool context. |
| Recommendation — Separate instruction, retrieval, and execution paths so mixed context cannot silently raise agent authority. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Secrets become dangerous when combined with agent context and tool permissions. |
| Recommendation — Constrain secret exposure to the minimum needed and bind credential use to explicit approved actions. | ||
| MITRE ATLAS | AML.T0042 — Prompt Injection | Adversarial prompts can exploit context assembly to steer model actions and disclosures. |
| Recommendation — Detect prompt-injection patterns and block untrusted instructions from influencing downstream tool use. | ||
| NIST CSF 2.0 | PR.AC-4 — Access Permissions Management | Context collision often converts separately valid permissions into excessive effective access. |
| Recommendation — Review effective access across chained workflows and remove permissions that become unsafe in combination. | ||
| CIS Controls v8 | 6.3 — Access Granting, Modification, and Removal | Unsafe combined context often persists because access is granted in fragmented pieces. |
| Recommendation — Reconcile tool and data permissions together so no workflow can assemble unintended privileged paths. | ||
