Agent compaction discards process constraints ahead of task descriptions

Long-running agents depend on context reduction to remain within model limits. A summary may retain the code task and current objective while dropping the rule that forbids a particular implementation method. Once the summary becomes the active working memory, later tool calls can lack the original condition that made an action unacceptable.

A study of five context compaction strategies and three models reports disproportionate loss of process restrictions, including around one third of anti-cheating rules missing in first summaries in the authors tested settings. A summary losing a rule is not itself evidence that the agent carried out a prohibited act. The quantitative result depends on the benchmark, exact compactor and subsequent instruction handling, which varied in the paper.

Store hard constraints and authorization policy in an immutable external channel and check them again at tool dispatch; treat generated summaries as task history rather than permission grants. The safety issue is loss of provenance and restriction lifetime, not simply a decline in benchmark task accuracy. Primary evidence.

Additional evidence and trust boundary

Context compaction creates a second source of authority if its prose summary becomes the only surviving copy of constraints. An instruction that says what to build and a rule that says how it may be built must not have the same retention priority. Keep mandatory policies in immutable context or machine-checked effect gates; a successful benchmark artifact does not prove those policies were preserved. Supporting record.