Context assembly converts ranked chunks into bounded evidence for a model. It must preserve source identity, remove duplicates, include enough neighboring context, fit the model and product token budget, and treat every retrieved byte as untrusted data. Retrieved instructions never gain authority to change system policy, reveal secrets, or invoke tools.
Start from the model context limit, then reserve space for system/developer instructions, the user request, required conversation state, output, and safety margin. Evidence receives the remainder. Count with the relevant tokenizer where available; character estimates are fallbacks.
Select evidence by value per token rather than rank alone. A concise authoritative chunk may be more useful than a long near-duplicate.
Documents, web pages, emails, tickets, and memory can contain hostile instructions. Delimit them and tell the model they are evidence, not policy. More importantly, enforce privileges in code:
Prompt wording alone is not a security boundary.
Collapse identical checksums, cap chunks per document, fetch parent context selectively, and preserve citation coordinates. If compression or summarization is used, retain links to originals and evaluate whether important qualifiers disappear. Never summarize unauthorized content into an authorized cache.
Create fixtures containing “ignore previous instructions,” fake system messages, exfiltration requests, malicious tool arguments, encoded instructions, and a valid-looking citation to an unauthorized source. Assert that policy and tools remain unchanged, secrets are absent, and the system answers only from eligible evidence or abstains.
Review this context builder and tool boundary [paste]. Produce a token budget, deduplication policy, citation map, injection threat model, typed tool gates, approval points, cache-key requirements, and adversarial tests. Treat all retrieved content as hostile data.
Verification contract: Run attacks through documents, conversation history, memory, and tool outputs; success means code-enforced policy remains invariant.