Context Compaction

What Context Compaction Does

Context compaction is a control-plane operation for long-running AI sessions. It reduces older dialogue into a shorter working memory so the session can stay within a fixed token window, preserve continuity, and keep important task state available. In practice, it trades completeness for survivability, which is why it needs governance in agentic workflows.

Why Context Compaction Matters in Long-Running Sessions

The main value of compaction is that it lets an agent continue after the raw conversation would otherwise exceed the model’s context limit. That is useful for assistants that maintain plans, tool state, or multi-step workflows over time. The downside is that anything not carried forward, especially policies, constraints, or prior decisions, may vanish from the active prompt even though the user still expects it to apply.

Because the summary becomes the new operating memory, the compaction step is not neutral. It can change what the model “remembers” to be true, which means the quality of the summary directly affects task safety, instruction fidelity, and the integrity of follow-on actions.

How Compaction Can Change Security Behaviour

Compaction can silently remove standing instructions that were meant to constrain the session, such as approval rules, refusal boundaries, tool-use limits, or escalation requirements. If those constraints are not preserved, the agent may continue with an incomplete policy picture and behave as though the missing instructions never existed.

In agentic systems, that is especially sensitive because compaction may sit between the user, the model, and downstream tools. A summariser that drops a restriction can unintentionally widen the agent’s effective authority, particularly when the session depends on prior context to remember what it is and is not allowed to do.

What Good Compaction Preserves

Useful compaction preserves the facts that change future decisions: task objective, unresolved questions, explicit constraints, tool state, safety boundaries, and any commitments the session still needs to honour. It should reduce repetition without erasing meaning, and it should distinguish between background detail and active instructions.

Lossy compression becomes risky when the summary retains only the narrative flow but not the governing rules. A compacted history that is concise but semantically incomplete can create a false sense of continuity, because the session appears coherent while the policy state has been degraded.

Compaction, Memory, and Trust Boundaries

Context compaction is not the same as durable memory. It is a temporary representation of what the session needs right now, not a reliable archive of everything that was said. That distinction matters when systems use compaction as input to planning, delegation, or tool execution, because the compacted text becomes a trust boundary between prior conversation and current action.

In secure designs, the compaction step should be treated like any other transformation that can alter control state. If the summary is generated by the model itself, or by a separate service, the organisation needs to understand what can be lost, who can influence the summarisation, and how omitted instructions are recovered.

Risk and Threat Considerations

Context compaction can create security exposure when it drops constraints, approvals, or safety instructions from the active session. In agentic systems, that can lead to policy drift, unauthorised tool use, or continued execution under a truncated instruction set that no longer reflects the original intent.

Failure mechanism: The session summary becomes the only memory the model reliably uses, but the summariser omits a standing restriction, so later turns operate without the missing control state.

Impact: The agent may take actions outside its intended bounds, follow stale assumptions, or continue a workflow without the guardrails that were supposed to remain in force.

Practitioner Guidance

Why practitioners should care: Compaction is a governance point, not just a performance trick. If your workflow relies on persistent instructions, ownership, or approval state, you need a deliberate rule for what must survive every summarisation pass.

What to watch for: Treat any summary that removes constraints, names, approvals, or tool permissions as suspect. The safest compaction output is one that makes the active obligations explicit, rather than assuming the model will reconstruct them from prior turns.

Practitioner takeaway: Design compaction so that it preserves security-relevant state first and compresses everything else second.

Related resources from NHI Mgmt Group

• What breaks when AI agent sessions lack context compaction and tool-result controls?
• When does context compaction become a governance failure?
• What is the difference between context compaction and durable execution?
• What breaks when agentic AI compaction turns attacker text into trusted context?