Context Windows, Summarization, and Prompt Injection
Context engineering decides what information reaches the model, in what order, and with what trust level. Include relevant, current, permission-filtered data; exclude unrelated history and secrets. For long sessions, summarize decisions, constraints, and unresolved tasks rather than blindly truncating the first messages. Keep source identifiers so summaries can be checked against evidence.
Prompt injection occurs when untrusted content attempts to change model behavior, reveal data, or invoke tools. RAG documents can contain malicious instructions. Defenses include data/instruction separation, least-privilege tools, document filtering, source provenance, explicit confirmation for sensitive actions, and adversarial tests.
{
"userGoal": "Prepare a release checklist",
"confirmedConstraints": ["Use PostgreSQL", "No production writes"],
"decisions": ["Run a read-only audit first"],
"openQuestions": ["Which environment is in scope?"],
"sourceRefs": ["conversation:turn-18"]
}- Context selection is part of system design.
- Summaries should preserve decisions, constraints, and source references.
- Prompt injection defenses require architectural controls and testing.
Which defense is most important against prompt injection that tries to trigger a privileged action?