Keep anything that defines authority or reversibility outside the summarised region. That includes the task statement, the approval record, and the ledger of actions already taken. Those items are governance state, not working memory, and if they are compacted away the agent can no longer reliably tell what it may do next.
What belongs outside the summarised context?
Security teams should treat summarisation as a memory-management problem, not a governance problem to be “compressed away.” Anything that determines what the agent is allowed to do, or what it can safely undo, should stay outside the summarised region so it remains explicit and queryable at the moment of action.
That includes the task statement, the approval record, and the ledger of actions already taken. Those items are part of control state, so collapsing them into prose summary increases the chance that the agent loses the distinction between background context and binding authority.
Practical boundary-setting matters most when the agent is allowed to act across multiple steps. Once authority is summarised instead of retained, the system may still remember what it was trying to do, but not whether it is still permitted to continue, roll back, or wait for review.
Why governance state should not be compacted
Summaries are useful for intent, history, and conversation continuity. They are a poor place to store facts that must remain exact, especially when those facts govern permission, reversibility, or accountability. If the agent has to infer them from a compressed narrative, the control becomes fragile.
This distinction also helps separate working memory from durable state. Working memory can be rewritten to preserve relevance. Governance state should be preserved as structured records, because it needs to survive summarisation, truncation, and handoff without losing the original meaning.
The safest rule is to keep anything that answers “may I act?”, “under what approval?”, or “what has already happened?” outside the summarised region. If those answers are only present in a summary, the system is one summarisation step away from ambiguity.
How to draw the boundary in practice
Use the summary for the agent’s immediate reasoning, and keep authoritative state in separate fields or records that are fetched on demand. That lets the model stay compact while preserving the exact text or machine-readable status needed to govern actions and reversals.
The same design applies to action trails. A summary can say that prior steps exist, but the ledger should remain the source of truth for what was approved, executed, skipped, or reversed. Where actions may need to be unwound, the reversible state should be explicit rather than reconstructed from context.
For teams implementing agent controls, the question is not how much context can be removed, but which facts must never become approximate. The more the system relies on summarised authority, the more it needs independent checks before any new action is taken.
Risk and Threat Considerations
When authority and reversibility are summarised, the main failure is silent control drift: the agent can continue acting after the original approval has expired, been narrowed, or been superseded. That creates exposure even if the model’s reasoning is otherwise correct.
Failure mechanism: The summariser removes or blurs governance facts, so the agent can no longer distinguish current permission from historical intent. That can lead to overreach, duplicate actions, or an inability to determine whether rollback is still required.
Impact: Teams lose reliable control over execution scope, auditability, and exception handling. In the worst case, the agent acts on stale authority or cannot prove which actions were authorised, which raises operational and security risk at the same time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Summarised authority can distort what the agent may do next. |
| Recommendation — Keep current authorization and approval state explicit before any agent action. | ||
| NIST SP 800-53 Rev 5 | AU-10 — Non-repudiation | A durable action ledger preserves who did what and when. |
| AC-6 — Least Privilege | Task scope must remain explicit so the agent does not exceed allowed authority. | |
| Recommendation — Retain tamper-evident action records so authority and reversibility stay auditable. Limit each agent step to the smallest approved scope and recheck before escalation. | ||
Practitioner Guidance
What to verify: Check that approval, task scope, and action history are stored as durable state, not as summary text. If a reviewer cannot reconstruct current authority from the non-summarised record, the control boundary is too weak.
Decision rule: If a fact changes whether the agent may proceed, it stays outside the summarised region. If a fact only helps the agent continue the conversation, it can usually be summarised.
What good looks like: The agent can still reason with a compact summary, but every permission decision is backed by an explicit current record of scope, approvals, and executed actions.
Practitioner takeaway: Preserve the facts that govern action, not just the facts that explain intent. Summaries should reduce token use, not weaken the system’s ability to know what it is allowed to do next.
Related resources from NHI Mgmt Group
- How do security teams decide whether an AI agent should keep access to regulated data?
- How do security teams decide whether to centralise LLM authentication in the gateway or keep it inside each agent?
- How should security teams keep third-party API credentials out of an AI agent's context when the agent reads untrusted content?
- How should security teams prioritise NHI remediation in cloud environments?