Context engineering for long-horizon agents needs failure-specific controls

At a glance

What this is: This is an analysis of context engineering for long-horizon AI agents, with a central finding that compaction solves distraction but can worsen poisoning if applied blindly.

Why it matters: It matters because IAM and security teams designing AI agent workflows need to separate stable governance records from disposable context, or they will lose auditability, decision integrity, and safe delegation.

Context

Context engineering is the discipline of deciding what an AI agent keeps in its working window, what it retrieves, and what it compresses. The governance problem is that long-horizon agents do not just forget, they can also preserve the wrong fact, the wrong tool result, or the wrong action history if the window is treated like a passive buffer rather than a managed control surface.

This article argues that a single summarisation strategy is not enough because context degradation has multiple modes. For autonomous systems, the key question is not how much context fits, but which information must remain exact, which can be summarised, and which should be excluded from any agent authorisation guide style workflow altogether.

The practical implication for identity programmes is that agent memory, tool history, task state, and authorisation state need different handling rules. A long-running agent that can act, re-plan, and re-enter earlier decisions needs controls that distinguish durable governance evidence from disposable operational noise.

Key questions

Q: What should teams do when a long-running AI agent keeps repeating old actions?

A: Treat that as context distraction, not a general failure of the model. Reduce the amount of retained history, remove redundant tool output, and isolate exploratory work so the lead agent is not forced to reason over every prior step. The goal is to preserve current task signal while keeping the action history available elsewhere for audit and recovery.

Q: Why can summarisation make an AI agent less reliable?

A: Because summarisation can strip away provenance and preserve a wrong fact in cleaner form. If the original context contained an error, compaction can turn a visible mistake into an authoritative-looking summary that survives later turns. That is why summarisation should only touch disposable detail, not decisions, approvals, or any irreversible action record.

Q: How should security teams decide what to keep outside an agent’s summarised context?

A: Keep anything that defines authority or reversibility outside the summarised region. That includes the task statement, the approval record, and the ledger of actions already taken. Those items are governance state, not working memory, and if they are compacted away the agent can no longer reliably tell what it may do next.

Q: What is the difference between context poisoning and context clash?

A: Context poisoning is when a wrong fact enters the window and gets reused as if it were true. Context clash is when two incompatible facts remain in the window at the same time. The first problem is about false authority, while the second is about unresolved contradiction, and they need different handling.

Technical breakdown

Why long context degrades before it fills up

A large context window is not a guarantee of stable reasoning. Transformers must weigh relationships across many tokens, and as the sequence grows, attention gets diluted across more pairwise relationships. That creates a performance gradient rather than a hard cliff, so the model can still fit the text while becoming less reliable at using it. The article’s key point is that this is not just a token-capacity problem. Position effects, context rot, and multi-turn drift all show that where information sits and how it is presented changes the outcome. For practitioners, the architecture question is not only retention, but salience management across turns.

Practical implication: Design agent workflows to minimise irrelevant carryover, not just to increase the maximum window size.

What context poisoning, distraction, confusion, and clash mean

The article’s four-way taxonomy is operationally useful because each failure mode needs a different treatment. Context poisoning happens when a wrong claim enters the window and then gets repeated as if true. Context distraction is when the window gets so large that old history overwhelms current task signals. Context confusion is too much irrelevant material, such as excessive tool definitions, and context clash is when mutually inconsistent facts coexist. These are not synonyms. They describe different failure mechanisms, which means the same mitigation can help one and harm another. Compaction is useful for distraction, but dangerous for poisoning because it can launder a bad fact into a clean summary.

Practical implication: Classify the failure mode first, then choose whether to summarise, isolate, reconcile, or discard context.

Why compaction is a control, not a cure

Compaction reduces window pressure by summarising older context and starting a fresh window, but it only works safely when the input is already trustworthy. If the model compacts a poisoned instruction or a wrong tool output, the summary can preserve the error while deleting the evidence needed to challenge it. That is why the article treats compaction as a targeted control for distraction, not a universal fix. The more reliable pattern is to remove unnecessary tool output, externalise durable state, and keep irreversible decisions outside the summarised region. In identity terms, compaction should never be allowed to rewrite the authorisation record or the action ledger.

Practical implication: Keep irreversible state and governance records outside any summariser, and only compact disposable operational detail.

NHI Mgmt Group analysis

Context governance is now a control problem, not a prompt-writing problem. Long-horizon agents fail because the window contains competing claims, stale history, and degraded salience, not because the model simply needs more tokens. That means programme owners need to treat context state as governed evidence, not disposable chat history. The practitioner implication is clear: separate authoritative task state from transient working context.

Compaction creates an identity-risk boundary that teams must manage explicitly. A summariser can preserve the wrong instruction with clean formatting and no provenance, which turns an operational error into a durable one. That is a governance failure, not just a model limitation. The implication is that any workflow using agent summaries must preserve the original action ledger and authorization record outside the compactable region.

What must survive context collapse is more important than what can be compressed. The article’s strongest insight is that some artefacts, such as the task statement, approval state, and irreversible actions, should never be passed through a summariser at all. Those items define what the agent is allowed to do next. The practitioner implication is to design a protected state layer that summarisation cannot rewrite.

Long-horizon autonomy exposes a provenance gap in current agent design. The window can still hold enough information to look complete while losing the traceability needed to explain why the next action is authorised. That makes auditability a runtime requirement, not an after-the-fact log review problem. The implication is that autonomous agents need a durable record of decisions, not just a larger memory footprint.

Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Context governance will become a first-class identity control for autonomous systems. As agents take on longer tasks, teams will need explicit rules for what can be compacted, what must be preserved, and what must never be rewritten. The practical shift is toward runtime state management rather than prompt-only tuning, because governance fails when authority and history are left inside the same mutable window.

Persistent action records will matter more than larger context windows. The article points toward a future where reliability depends on externalised ledgers, not on fitting more tokens into the model. That changes how practitioners should think about audit, rollback, and delegated authority, because the most important evidence is the record of what the agent was allowed to do and what it already did.

For practitioners

• Separate durable state from disposable context Keep the task statement, approval state, and action ledger outside any summarisation path so the agent cannot rewrite them during compaction.
• Classify the failure mode before applying compaction Decide whether the problem is poisoning, distraction, confusion, or clash, then apply the matching control instead of summarising by default.
• Clear tool outputs as soon as they are harvested Replace large raw tool dumps with the extracted answer and a pointer to the source so the window keeps signal without preserving unnecessary bulk.
• Isolate exploratory work into subagents Use separate working windows for broad investigation, then return only distilled conclusions to the lead agent to reduce distraction and history overload.
• Persist investigation notes outside the window Store hypotheses, evidence, and open questions in an external file that survives compaction and can be reviewed by a human operator.

Key takeaways

• Long-horizon agents fail in multiple distinct ways, so a single summarisation strategy cannot be the default response.
• Compaction is useful for some context problems, but it can also preserve a bad fact while deleting the evidence needed to challenge it.
• The safest operating model keeps authority state, task state, and completed actions outside anything a summariser can alter.

Related NHI Mgmt Group resources: AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Guide · AI Agent Authorisation Guide · AI Agent Memory Security Guide

Key terms

• Context Poisoning: Context poisoning is the manipulation of information that an AI agent reads before acting. The malicious content does not need to be code. If it changes the agent’s instructions, tool choices, or assumptions, it can alter behaviour and expand the impact of a compromised delivery path.
• Context Compaction: Context compaction is the process of summarising or pruning conversation history so a long-running AI session can continue inside a fixed token window. It is useful for continuity, but it can also remove standing instructions, making it a security-sensitive operation in agentic systems.
• Action ledger: A durable record of what an agent has already done, approved, or changed during a task. Unlike ordinary conversation history, it should survive summarisation and be treated as governance evidence, because losing it can cause repeated actions or incorrect reversals.
• Context distraction: A degradation mode in which a long context window contains so much prior material that the model over-weights history and under-weights the current task. The result is not simple forgetting, but decision drift, where the agent keeps reusing old steps instead of producing the next best action.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.