Security AI context management fails when the model controls retrieval

At a glance

What this is: Cotool argues that context management for security AI agents is harder than for document Q&A because anomaly detection depends on preserving surrounding log evidence, not just the latest relevant snippet.

Why it matters: That matters for IAM and security teams because agentic workflows that query SIEMs, inspect logs, and chain tools can fail if context is pruned too aggressively or measured too slowly.

By the numbers:

• Using OpenAI's Tiktoken, encoding a 673K-token conversation takes about 368ms on an M4 MacBook Pro.
• On production GCP Cloud Run instances, encoding 678K tokens took 3.3 seconds.
• 110% overestimation for token estimation accuracy., ation for token estimation accuracy.

👉 Read Cotool's analysis of context management for security AI agents

Context

Security AI agents that query SIEMs and logs do not behave like ordinary retrieval systems. They operate in verbose, anomaly-driven environments where the useful signal may be buried in surrounding context, so aggressive pruning can remove the very evidence an investigation depends on.

That creates a governance problem for agentic workflows as much as a technical one. When the LLM controls what to retrieve and when to stop, teams need context management that is fast enough for interactive use, precise enough to avoid premature truncation, and resilient enough to preserve auditability across tool calls and model providers.

Key questions

Q: How should security teams use AI in SIEM without losing identity context?

A: Security teams should use AI to accelerate correlation, summarisation, and triage, but only after identity telemetry is fully part of the detection pipeline. IdP decisions, token activity, service principals, and MFA events need to be first-class signals. Otherwise AI will optimise around incomplete evidence and produce confident but weak decisions.

Q: Why do AI agents struggle with security investigations more than document Q&A?

A: Security investigations depend on surrounding events, timestamps, and repeated patterns, so the meaningful signal is often distributed across a long transcript. Document Q&A can succeed with isolated passages, but investigation workflows need continuity across tool calls, which makes aggressive chunking and generic retrieval unreliable.

Q: What breaks when sliding-window context management is used for agentic security workflows?

A: Sliding windows can remove messages that still anchor reasoning, tool-call sequencing, or provider-specific message requirements. That can cause API errors, broken investigation state, or silent loss of evidence needed to interpret an alert correctly. The failure is not just truncation, but broken conversational structure.

Q: What should teams do when token limits are reached during an active investigation?

A: They should prune in phases, starting with the oldest and largest tool-result content while preserving the newest user and assistant turns. If the workflow uses multiple providers, the pruning policy must respect each provider’s message structure so the investigation can continue without corrupting state.

Technical breakdown

Why security logs break ordinary RAG and chunking

Security logs are structured, high-volume, and only meaningful when compared across surrounding events. In a document Q&A flow, the model can usually answer from a retrieved passage, but in an investigation the anomaly may appear in a single line of a much larger trace, a repeated command pattern, or a time-based sequence across multiple tools. Chunking and semantic search can hide the signal because they optimise for topical similarity, not investigative continuity.

Practical implication: preserve adjacent events and time order for SIEM-driven agents instead of relying on standalone chunk retrieval.

Provider-aware token estimation is a control problem, not a utility function

Token estimation needs to overestimate slightly so the agent never overruns context, but not so much that it triggers unnecessary pruning. Cotool’s write-up shows why simple heuristics fail when different providers use different tokenisers and message formats. A useful estimator must therefore be provider-aware, additive across message types, and calibrated against real observed counts rather than generic character-length shortcuts.

Practical implication: validate token estimates against real provider counts and tune them per model family rather than centralising on one approximation.

Why tool-result pruning preserves more investigative value than sliding windows

Sliding windows remove older messages outright, which can break reasoning chains and tool-call pairings in provider-specific APIs. A pruning approach that keeps message order but truncates oversized tool outputs retains structure while shedding the least valuable content first. That matters because security investigations often need the conversation skeleton intact even when the raw payload must be shortened to stay within limits.

Practical implication: prune content in phases, keeping message structure intact before removing entire turns.

NHI Mgmt Group analysis

Context management is becoming a governance layer for security agents. Once an LLM is allowed to decide what to retrieve, the control plane is no longer just model selection or prompt design. It becomes a question of whether the agent can preserve enough evidence to support reliable investigation, auditability, and human review. For IAM and security operations teams, that means context loss is not a cosmetic defect but a control failure.

Security investigations expose a named failure mode we can call context-evidence loss. The problem is not simply that the window fills up. It is that the pruning decision can remove the temporal and structural relationships needed to interpret a suspicious event correctly. This is why RAG-style assumptions work poorly when the signal is embedded in line-level telemetry rather than topical prose. Teams should treat evidence retention as part of the operating model.

Provider-specific message handling is now part of the reliability boundary. Anthropic reasoning blocks and AI SDK tool-call pairing show that multi-model agent systems cannot assume a single uniform context model. Any agent harness that crosses providers must account for message structure, not just token volume, or it will create hidden failure paths. Practitioners should design for cross-provider compliance as an architectural requirement, not an implementation detail.

Interpretability matters because opaque estimators become their own risk surface. Cotool’s decision to use a labeled dataset, real token counts, and test-driven optimisation is the right pattern for this class of control. It keeps the estimator explainable and measurable, which is essential when an investigation workflow is being trusted to decide what stays in memory. The practical takeaway is to prefer simple, testable control logic over black-box optimisation when context correctness matters.

Agentic security tooling needs a memory strategy, not just a search strategy. The article shows that the field is moving beyond retrieval into managed conversational memory with pruning, ordering, and provider-aware accounting. That intersects directly with NHI and agent governance because the agent’s operating state is part of the security boundary. Teams that ignore memory management will eventually discover that their agents are accurate only until the context window becomes the incident.

What this signals

Security teams should expect context governance to become part of the agent security stack, not a separate engineering concern. As agentic workflows expand, the control question shifts from whether the model can retrieve data to whether it can preserve the right evidence long enough to support triage, audit, and human override.

Context-evidence loss: when pruning or truncation removes the sequencing and adjacency needed to interpret a security event, the agent may still be syntactically correct but operationally wrong. That is a governance issue for SOC automation and for any NHI-style workflow where the agent’s memory state affects trust.

The wider signal for practitioners is that provider-aware memory management will become a design requirement for multi-model environments. Teams aligning to the NIST AI Risk Management Framework and the OWASP Top 10 for Agentic Applications 2026 should treat context retention, tool sequencing, and estimate accuracy as measurable controls.

For practitioners

• Measure token usage per provider and message class Track token counts separately for user prompts, assistant text, reasoning blocks, and tool results so estimator drift is visible before investigations fail. Use real API counts as the calibration baseline, not character heuristics.
• Preserve investigation structure before pruning content Keep message ordering, tool-call pairing, and the latest assistant turn intact, then prune oldest and largest tool outputs first. This reduces the chance of breaking audit trails or losing the timeline needed for root-cause analysis.
• Test context controls against long, noisy SIEM transcripts Use replayable investigations with verbose logs, repeated tool calls, and mixed provider responses to confirm the agent still returns correct results under pressure. Include failure cases where the window nearly fills and where pruning must happen mid-flow.
• Define a hard error budget for context overestimation Set an acceptable overestimation ceiling and reject estimators that exceed it too often, because excessive padding can trigger unnecessary pruning and reduce investigative fidelity. Cotool’s 110% threshold is a useful example of measurable control design.

Key takeaways

• Security investigation agents fail differently from document Q&A systems because they need surrounding telemetry, not just retrieved text.
• Provider-aware token estimation and structure-preserving pruning are the controls that keep long-running agentic investigations usable.
• As AI agents take on more security workflows, context management becomes a governance requirement for auditability, reliability, and incident response.

Key terms

• Context Window: The context window is the text a model receives at one time, including prompts, retrieved documents, and conversation history. Security teams care about it because it becomes the practical boundary between trusted instructions and untrusted content, especially when the application assembles that text automatically.
• Context rot: Context rot is the loss of investigative focus that happens when an incident agent or analyst is forced to reason across too many logs, traces, and dependencies at once. The result is overconfidence in the wrong clue, which makes approval boundaries and evidence scoping more important than raw model size.
• Tool Call Pairing: The rule that an assistant tool request and the corresponding tool result must remain structurally matched in the conversation history. Some agent frameworks and providers enforce this strictly, which means context pruning must preserve the relationship or the workflow can fail.
• Extended Thinking: A model mode that preserves reasoning structure separately from normal assistant text. When present, it adds another layer of state that agent harnesses must handle carefully because removing or mutating messages can break provider expectations or invalidate the conversation.

What's in the full article

Cotool's full post covers the operational detail this post intentionally leaves for the source:

• Benchmark results comparing token estimation methods across OpenAI, Anthropic, and Google providers.
• The exact weighted-estimation approach used to keep accuracy within the 110% overestimation threshold.
• Phase-by-phase pruning rules for tool results, assistant turns, and user messages in long investigations.
• Implementation lessons from extended-thinking requirements and AI SDK tool-call pairing constraints.

👉 Cotool's full post covers the token estimator design, pruning sequence, and provider-specific constraints.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It is designed for practitioners who need to connect identity controls to real operational risk across modern security programmes.