The state and data associated with a specific agent job, including messages, artefacts, and intermediate outputs. In A2A-style systems, context can become an exposure path if it is shared too broadly, reused across sessions, or allowed to carry sensitive data without strong isolation.
Expanded Definition
Task context is the operational memory attached to a single agent job: the prompts, tool outputs, intermediate artefacts, session metadata, and decisions that shape the next action. In agentic systems, it is not just a convenience layer. It is a trust boundary that can determine what an agent is allowed to see, reuse, or hand off.
Definitions vary across vendors because some platforms treat task context as ephemeral conversation state, while others persist it as workflow history, retrieval input, or shared execution state. NHI Management Group treats the term narrowly: if the data can influence an agent’s authority or exposure surface, it belongs in task context governance. That makes isolation, scoping, retention, and redaction central controls, especially where context may include secrets, credentials, or sensitive prompts. For broader security framing, the NIST Cybersecurity Framework 2.0 remains useful for mapping this state to access, protection, and recovery outcomes.
The most common misapplication is treating task context as harmless application telemetry, which occurs when teams persist it across jobs or allow it to be reused without session-bound access checks.
Examples and Use Cases
Implementing task context rigorously often introduces state-management overhead, requiring organisations to weigh agent continuity against tighter isolation and shorter retention.
- An AI coding agent stores intermediate file diffs and command outputs for a single repository task, but the context is cleared before the next job starts.
- A support agent uses prior ticket notes and tool results to draft a response, while sensitive customer data is masked before being written into context.
- A workflow agent passes context between steps in a multi-agent system, but each step only receives the minimum fields needed to complete its subtask.
- A privileged automation service uses task context to remember deployment parameters, but secrets are fetched at runtime rather than embedded in the session state.
- For governance and lifecycle discipline, NHI teams often pair context handling with the lifecycle controls described in the Ultimate Guide to NHIs, especially where context may persist beyond the original task boundary.
In standards-based implementations, teams often align context handling with session containment and least privilege principles from the NIST Cybersecurity Framework 2.0, even when no single standard explicitly defines task context.
Why It Matters in NHI Security
Task context becomes a security issue when it carries more than operational memory. If an agent can read prior context from another job, inherited data can expose tokens, internal system state, customer records, or privileged instructions. That is particularly dangerous in A2A workflows, where context may be forwarded between agents with different trust levels. NHI Management Group research shows that Ultimate Guide to NHIs reports 79% of organisations have experienced secrets leaks, with 77% of those incidents resulting in tangible damage, which makes context hygiene a practical control issue rather than an abstract design concern.
The governance failure is usually not the agent itself but the surrounding state model: overbroad sharing, inadequate redaction, and retention that outlives the task. In NHI environments, that can turn one successful job into a reusable attack path for the next job. Organisations typically encounter data leakage, privilege confusion, or unexplained agent behaviour only after a sensitive task has been replayed or exposed, at which point task context becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Task context can expose secrets and sensitive state when isolation is weak. |
| OWASP Agentic AI Top 10 | A-04 | Agentic systems must bound memory, state, and tool-visible context to prevent leakage. |
| NIST CSF 2.0 | PR.AC-4 | Context sharing is an access control problem when state crosses trust boundaries. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust requires each context transfer to be treated as a new trust decision. |
| NIST AI RMF | AI risk governance covers data lineage, leakage, and context misuse in model workflows. |
Restrict context contents, prevent cross-job reuse, and redact sensitive material before persistence.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
