Context Assembly: Feeding Agents the Right Evidence

A model does not know your systems; it knows only what you place in front of it for a given step. That placement is not a detail, it is a decision. Choose well and the agent reasons over current, trusted, permission-filtered evidence. Choose carelessly and it reasons over stale facts, untrusted instructions disguised as data, or a wall of irrelevant text that crowds out what mattered. Context assembly is the runtime discipline of deciding what the model sees, and marking where each piece came from.

Context is a decision, not a dump

The naive approach is to pour everything possibly relevant into the prompt and hope the model sorts it out. It cannot, reliably. Every extra passage competes for attention and for the finite space of the context window, the amount of text a model can consider at once. More context is not better context; the right context is.

Treating assembly as a deliberate step changes the question from how much can I fit to what does this step actually need, from which trusted source, filtered to what this agent is allowed to see. That question has a different, safer answer.

Where context comes from

Context arrives from very different places with very different trust. Some is authoritative: your repository facts, configuration, and policies. Some is user-supplied. Some is pulled from the open web or third-party documents. The assembler sits between all of these and the model, selecting what enters and marking each piece with where it came from.

Drawing this as a flow makes the key point visible: untrusted sources may inform the model, but they cross a trust boundary first, arriving as clearly labeled data rather than as instructions the model should obey.

Trusted and untrusted sources both pass through an assembler that labels everything before the model sees it.

Label every source by trust

Not all context deserves equal belief. System instructions and policy are fully trusted. Repository facts are trusted once verified. User input is to be handled with care. Content pulled from the open web or an arbitrary document is untrusted by default, because it may contain instructions written to hijack the agent.

Placing each source on a trust continuum, and carrying that label with the text into the model's view, is what lets later stages reason correctly. A downstream rule like untrusted content may never trigger a consequential action only works if the content was labeled untrusted in the first place.

Every source sits somewhere from fully trusted to untrusted, and carries that label forward.

Fit the budget: relevance over volume

Context has a hard budget: the window is finite, and everything you include pushes something else out. So assembly is also a narrowing. Start from everything available, keep only what is relevant to this step, drop anything the agent is not permitted to see, and trim what remains to fit the budget with room to reason.

The order matters. Filter by permission before you trim by length, so you never spend the budget on material the agent should not have had, and never accidentally keep a sensitive passage just because it was short.

Assembly narrows from everything available to a permitted, relevant set that fits the budget.

Freshness and correctness

Stale context is its own failure mode. An agent handed last month's policy, an outdated schema, or a cached result that no longer holds will reason confidently to a wrong conclusion. Because the model cannot tell old from current, the assembler must: prefer live authoritative sources, stamp cached material with a time, and expire it when the underlying truth can change.

The subtle danger is that stale context looks exactly like fresh context to the model. Only the runtime knows the difference, so only the runtime can protect against it.

⚠️

Stale looks like fresh. A model cannot tell current facts from outdated ones, so the assembler must track freshness and expire cached context.

Permission-filter before the model sees it

The safest place to enforce who-can-see-what is before the model, not after. If a passage the current user is not entitled to never enters the context, no clever prompt can extract it, because it simply is not there. Filtering at assembly time turns access control from a hope into a property of the system.

This is the same least-privilege idea that governs tools, applied to knowledge: give the model exactly the evidence this task and this user warrant, and nothing more.

Resolve the acting user's entitlements and filter context to them first.
Keep the trust label attached to every passage that reaches the model.
Stamp cached material with a time and expire it on change.
Budget the window deliberately; drop the least useful passage, not a random one.

What a practitioner decides

Context assembly is where retrieval, security, and cost meet. The decisions are small but consequential: which sources are authoritative, how trust labels are represented and carried, where permission filtering happens, and how the budget is spent.

Settle these deliberately and the agent thinks with the right evidence. Leave them to chance and you have built a system that will, sooner or later, confidently act on the wrong thing.

Key takeaways

The right context beats more context; the window is a finite budget you must spend deliberately.
Label every source by trust and carry that label with the text into the model's view.
Untrusted sources may inform the model but must cross a boundary as data, not instructions.
Filter context by permission before trimming for length, so sensitive material never enters.
Track freshness and expire cached context, because a model cannot tell stale from current.
Enforce who-can-see-what at assembly time, turning access control into a system property.

Glossary

Context assembly: The runtime step that selects, labels, permission-filters, and budgets the material a model sees for a task.
Context window: The finite amount of text a model can consider at once, shared by everything you include.
Trust label: A marker attached to a piece of context recording how much it can be believed and whether it is trusted or untrusted.
Trust continuum: The range from fully trusted sources like policy to untrusted ones like arbitrary web content.
Permission filtering: Removing context the acting user is not entitled to before it ever reaches the model.
Freshness: How current a piece of context is; stale context can lead a model to a confidently wrong answer.
Retrieval: Fetching relevant passages from a larger corpus to include as context for a specific step.