The strong rivalSometimes the whole bounded corpus wins

A long-context-first design can be the simplest sound route. An authorised analyst comparing every clause across a short set of current contracts may need global structure that retrieval fragments. Reading the bounded set in a deliberate order can avoid a ranking miss, preserve cross-document exceptions and reduce application machinery. For a public, low-consequence question, a structured full-corpus read with a lightweight receipt may be entirely proportionate.

Use that route when boundaries are clear, sources and effective versions are already resolved, the requester may receive every item, the corpus fits the empirically tested operating length, position and distraction tests pass, and latency and cost remain acceptable. A provider's nominal limit is only a capacity claim. Test the task with relevant evidence at different positions, plausible distractors, several required facts and the intended output constraint.

Long context does not remove authority, policy, time, trust or provenance. It changes the selection and assembly route. The architecture may decide to include all eligible items, but restricted or superseded material still fails before assembly. Embedded instructions remain typed as untrusted data. Claims still bind to the evidence actually used. State still expires. This permits full-corpus reading without treating the window as an ungoverned database.

Original constructThe nine-stage Context Supply Chain

The Context Supply Chain is this article's synthesis. Each stage receives a manifest, applies gates or transformations and records what it accepted, rejected or changed.

Begin with the decision because relevance is conditional. A request to explain a policy, decide eligibility and execute a refund require different evidence, authority and permissible actions. The affected party and consequence influence how much uncertainty can remain. A system that begins with vector search has already chosen candidates before stating what evidence the decision requires.

The manifest travels through every stage. It contains stable identifiers rather than copied policy prose where possible. A denied item records a non-sensitive reason such as purpose mismatch or expired version, not its protected content. Transformations append lineage. Unresolved contradiction remains visible. The completed receipt proves which path produced the packet and when its terms expire.

Capacity becomes allocationPublish the context budget

A context budget states how the validated operating length is allocated. Reserve space for governing instructions, current operating state, supporting evidence, alternatives and contradictions, tool and action contracts, and the response. The proportions vary by task. They should not disappear inside an unexamined concatenation order.

Governing instructions state role, permitted action and safety constraints. Current state contains effective facts required now, not an entire conversation. Supporting evidence carries the sources needed for claims. Alternatives and contradictions prevent the assembly from presenting one retrieved view as consensus. Tool contracts constrain calls, inputs and outputs. Response reserve prevents evidence from consuming the space required to produce a complete answer.

A larger validated window may allow more primary evidence or wider alternatives. It does not waive entitlement or admit obsolete versions for completeness. A smaller window may require retrieval or compression. It does not justify deleting a qualifying exception. Budget pressure reveals the need to choose, and the manifest records what was discarded and why.

Measure usable length with the actual model, prompt format, task and evidence distribution. Place required facts near the beginning, middle and end. Vary distractor similarity, the number of relevant items, multi-hop dependencies and aggregation. Repeat the test after a model, prompt, tokenizer or assembly change. The operating limit is the length at which the required behaviour remains within the product's evidence envelope, not the largest input the interface accepts.

Budget rule: authority, entitlement, temporal validity and trust classification are gates outside the allocation. No number of spare tokens can purchase permission or make an obsolete fact current.

No universal winnerRoute by task, corpus and evidence risk

Deterministic reconstruction suits known fields and authoritative systems when the decision needs a small current state. Resolve identifiers, effective values and policy through ordinary code or queries, then provide the model only the result and evidence references. Do not ask semantic search to rediscover a fact that has a stable key and defined owner.

Retrieval suits larger corpora and questions whose supporting passages are unknown in advance. Evaluate candidate recall, ranking, permission filtering and abstention with the real corpus. Retrieve eligible candidates after identity and purpose controls. Bind generated claims to the passages actually selected rather than a plausible citation attached afterwards.

Graph or relational traversal suits explicit entities, relationships and multi-hop constraints. It may locate dependencies, authority paths or time-qualified facts more reliably than free-text search. The storage choice does not determine truth. The underlying data-product contracts, identity, time and provenance still govern each relation.

Structured long-context reading suits a bounded, authorised and current set when global comparison matters and tested length permits it. Order documents deliberately, delimit their identities and versions, and preserve contradiction. Test positions and distractors. Do not add RAG merely because it is familiar.

Hybrid assembly combines deterministic state, structured lookup, retrieval and long-context comparison. It is often useful for consequential cases, but complexity must earn its place. Define which component answers which evidence need and what fallback applies when one route fails. A hybrid without a manifest can hide duplicate, conflicting or unauthorised evidence behind orchestration.

The Router chooses among these patterns for one request. The same product may deterministically reconstruct a customer's current entitlement, retrieve policy explanation, traverse product dependencies and read a short contract set in full. Route boundaries should be testable, and each selected item retains its source reason.

Relevance is insufficientAuthority, entitlement and time reject first

Build an authority registry that distinguishes source of record, derived source, advisory source and fallback. Record the owner, collection purpose, known exclusions and evidentiary weight for each fact type. A high-ranking document from a convenient workspace should not displace the effective policy from its authoritative register. When no source of record exists, state the gap rather than filling the packet with weaker proxies.

Resolve identity and delegated authority before querying protected content. The gate evaluates requester, subject, role, purpose, attribute or document scope and destination. A search service may know that a restricted item matches; it should return only a non-sensitive exclusion record to the orchestrator. Post-retrieval filtering has already moved content across a boundary and exposed it to caches, logs or model context.

Temporal resolution chooses the fact that was valid for the decision time and shows authentic conflicts. Event, effective, observation, ingestion and supersession time answer different questions. A current policy may govern action today while a superseded policy explains a historical decision. Do not discard the older version merely because it is old; include or exclude it according to the request's temporal contract.

When two authentic sources conflict, preserve the relationship and seek the declared precedence rule or owner. An unresolved material conflict routes to asking, abstaining or escalation. A summary that silently chooses one version destroys evidence. The context packet may contain both with clear effective intervals, provenance and an explicit unresolved status.

Provenance follows transformations. A retrieved passage, extracted fact, normalised identifier and summary should link to the source version and operation that produced it. A citation identifies a document; it does not prove which passage supported the claim, whether the system retrieved it, or how it was changed. Claim-level binding provides those relationships and permits contradiction.

If source contracts and access rules disagree across systems, a larger window cannot reconcile them. Redesign the source, policy or workflow. The architecture should expose the inconsistency and stop a consequential action rather than distributing incompatible assumptions to the model.

Worked supply chainReconstruct one disputed-service decision

Consider an adviser reviewing whether a disputed service charge may be reversed. The assistant may recommend evidence and draft an explanation, but it may not execute the financial action. The request contract names the adviser, customer, dispute, reversible recommendation, jurisdiction, required billing and policy evidence, and the separate approval needed for execution. This prevents a broad request such as review the customer from becoming authority to inspect or change every account detail.

The authority registry identifies the billing ledger for posted charges, the contract repository for agreed terms, the policy register for current waiver rules and the case system for dispute evidence. A sales note is an advisory source rather than proof of the contract. An email attachment may provide the customer's claim but not the governing policy. Each source enters with its owner, purpose, known delay and evidentiary role, so ranking cannot promote a convenient narrative above a source of record.

The entitlement gate evaluates the adviser's role, delegated business unit, purpose and destination before any query returns content. It allows the customer's relevant account and dispute documents, excludes a restricted investigation maintained by another function, and records only a safe exclusion reason. The assistant never sees the protected text. If the missing item is legally required to decide the charge, the route becomes escalation rather than an attempt to infer its contents.

The temporal resolver reconstructs what was effective when the charge was posted and what governs remedy today. A former waiver policy may explain the original decision while a later correction controls the current response. Both can be authentic. The manifest links their effective intervals and supersession, preventing the newer document from rewriting history and the older one from controlling a present action. If effective dates overlap without a precedence rule, the assistant preserves the conflict and asks the policy owner.

Task-aware selection uses deterministic queries for the charge, account identity and contract version. It retrieves the relevant policy clauses and case evidence, then reads the short eligible set together because their exceptions interact. There is no benefit in placing the whole customer history in context. The route combines exact state with bounded textual evidence and records why every item was selected.

Assembly removes exact duplicate attachments and orders governing instructions, current state, authoritative terms, policy, customer evidence and contradiction. It retains the sentence that excludes charges already under formal appeal. A compressor may shorten repeated procedural language but must preserve that exception, monetary values, effective dates and uncertainty. The budget reserves space for the alternative interpretation and a complete adviser-facing explanation rather than filling the window with marginal correspondence.

Claim-evidence binding links the charge amount to the ledger event, contract applicability to the signed version, waiver eligibility to the effective policy clause and the dispute status to the case record. The customer attachment remains evidence even if it contains imperative wording. Its trust type prevents that wording from changing tool rules. The assistant can quote or summarise the customer's position while tool invocation remains constrained by application policy and the separate approval contract.

The response states which facts are established, which policy interpretation remains contested and which source was excluded without disclosing it. It recommends a route within the permissible action but cannot post the reversal. A context receipt records versions, entitlement, selections, transformations, claims, conflict, tool boundary and expiry. If the policy owner resolves the overlap or the ledger receives a correction, affected receipts can be found and the adviser can reopen the case with current evidence.

After the session, transient correspondence leaves the working window. Any durable memory write is limited to the approved case state, source and retention rule. A superseded recommendation is not carried into the next conversation as fact. The next request reconstructs the current ledger, policy and case status. This discipline may use fewer tokens than a record dump, but its value comes from preserved authority, time, entitlement and repair, not from compactness itself.

The adviser can inspect the receipt without seeing implementation detail that obscures the decision. It shows why the hybrid route was chosen, how the budget protected the exception, which source governed each claim, what remained contested and why execution was withheld. That record supports a focused human judgement. It also gives the engineering team a regression case: move the exception through early, middle and late positions, add plausible contract distractors, revoke one entitlement and supersede the waiver policy. The architecture passes only if the recommendation and evidence route change as the controlled conditions change.

Usable length must be earnedTest position, distraction and aggregation

Position sensitivity means a required fact can receive different use depending on where it appears. Construct tests with identical evidence at early, middle and late positions, while keeping instructions and output constant. Include policy exceptions in the middle because that is where a convenient assembly may bury them. Record both answer quality and whether the response cites or acts on the correct version.

Distraction tests use plausible alternatives rather than random filler. Add documents with similar names, former policies, adjacent customers, related jurisdictions and repeated boilerplate. Increase distractor density until behaviour leaves the accepted envelope. A system that finds one artificial needle in unrelated text may still fail when several authentic candidates compete.

Multi-needle and aggregation tests require several facts, ordering, counts or cross-document relationships. These reflect contract comparison, incident reconstruction and eligibility evidence better than a single lookup. Test abstention when one required fact is absent. The window is usable only if the system recognises incomplete evidence rather than composing a smooth answer from the rest.

Compare routes on the same cases. Retrieval may miss a middle-ranked clause; full-corpus reading may be distracted; a graph may omit a relationship; compression may delete an exception. Hybrid assembly may improve coverage but add propagation errors. Choose the smallest system that meets the decision evidence, latency and cost boundaries, and keep a fallback for the failures observed.

Repeat evaluation after changes to source ordering, chunking, retriever, embedding, model, prompt, tools or budget. A context limit is an empirical product parameter. Marketing capacity and a benchmark from another corpus cannot substitute for local position, distraction, conflict and action tests.

Loss and influenceCompress evidence without promoting instructions

Compression is a transformation with an explicit loss boundary. State whether the method may remove repetition, examples, procedural detail or low-weight sources. Identify material that must survive, including exceptions, thresholds, minority views, uncertainty, dates and contradiction. Compare compressed and original packets on the intended claims and actions. Saving tokens is not a benefit if it removes the condition that changes the decision.

The qualifying-exception case is a useful negative control. A policy summary retains the recommendation but drops the sentence excluding customers under an active dispute. The compressor should fail the declared boundary or carry that exception verbatim with its source. A fluent summary that changes the eligible population is a data defect, not an acceptable approximation.

Deduplication also needs semantics. Two copies may differ by effective date, amendment or jurisdiction. Hash equality can remove true duplicates, while near-duplicate clustering should retain material differences and provenance. Order documents by governing instruction, current state, authority and decision need rather than search score alone. Test whether ordering itself changes the result.

The trust boundary types every contribution. Governing instructions come from the authorised application policy. The user's request is scoped by identity and purpose. Retrieved documents and web pages are evidence, even when their prose uses imperative language. Tool outputs are typed observations. An external document that says to ignore policy cannot become a higher-priority instruction merely because it is relevant.

Typing does not make prompt injection impossible. Combine content separation with least privilege, constrained tools, deterministic policy enforcement, input and output checks, action confirmation appropriate to consequence and adversarial testing. The model should not receive credentials or powers it does not need. A successful answer-quality test does not prove the instruction boundary under attack.

Retained memory enters through the same supply chain. Conversation history can contain stale customer state, withdrawn preferences or earlier tool errors. Reconstruct current state from authoritative sources, mark superseded items and include only what the new request requires. Memory writes need purpose, scope, source, expiry and correction. Do not let convenient history become an unexamined database.

One inference, one manifestThe context receipt

A context receipt records request, actor, purpose and policy version; selected route and budget; sources considered, excluded and retrieved; the entitlement result before retrieval; temporal and supersession decisions; transformations, compression and discarded material; claims supported, contradicted or unverified; trust classifications; model and tool versions; outcome, reviewer and expiry.

For a consequential action, bind each material claim to a source identifier, version, excerpt or structured fact and transformation. Record whether the item supports, contradicts or merely contextualises the claim. A citation list is too weak: it may include a source the system never used or omit the operation that changed it. The receipt must reconstruct the actual evidence path.

Excluded sources require careful handling. Record enough to explain the route without revealing protected titles, attributes or contents. A code such as entitlement-purpose-mismatch can support audit and debugging. The requester may receive a safe explanation and escalation route, while authorised reviewers can inspect the protected policy decision.

Expire the receipt when source versions, policy, identity, delegated authority, model, tool, context assembly or decision changes. A correction should identify affected receipts and downstream actions. The organisation can then replay, remedy or document non-impact. Receipts support accountability only if they connect to operating response rather than accumulating as inaccessible logs.

Interactive instrumentContext Architecture Router

Set the request, corpus, gates, task and loss conditions. The Router returns one of five architectures with required gates, a budget allocation and the evidence gap. It does not produce a relevance or readiness score.

Exactly five outcomesArchitectures the request may use

Reconstruct deterministic state with minimal evidence

Use for known facts in authoritative systems. Resolve identity, entitlement and effective time through code or structured queries, include the smallest current state, bind it to evidence and keep a response reserve.

Use bounded hybrid retrieval with claim-level provenance

Use when unknown passages, several products or multi-hop evidence require search and structured lookup. Apply policy before retrieval, preserve contradictions, retain source reasons and bind each material claim to what the system actually used.

Use a structured long-context read with position tests

Use when an authorised, current corpus is small enough, global comparison matters and the task passes position, distraction and aggregation tests. Delimit documents and versions, keep a lightweight receipt and avoid unnecessary retrieval machinery.

Ask, abstain or escalate for missing, conflicting or unauthorised context

Use when authority is absent, entitlement fails, effective versions conflict materially or required evidence remains unverified. Return a safe explanation and escalation route without exposing protected material or inventing a stronger source.

Redesign the source, policy or workflow before adding context

Use when access and business definitions conflict across systems, retrieved data can become governing instruction, compression cannot preserve decision-critical exceptions, or memory cannot be corrected and revoked. More tokens cannot repair a broken upstream contract.

Router testsPositive, rival, restricted and adversarial cases

Clean lookup: a current customer entitlement has a stable identifier and authoritative effective-dated field. Deterministically reconstruct it and provide only the evidence needed for the answer.

Bounded global comparison: an authorised analyst must compare every clause in a short current contract set. A structured long-context read preserves global relationships after position tests pass.

Retrieval-heavy question: several governed products contain unknown passages and linked exceptions. Use bounded hybrid retrieval with claim-level provenance and explicit fallback.

Missing authority: no source of record exists for a required fact. Ask, abstain or escalate rather than filling the window with weaker proxies.

Entitlement leak: search identifies a restricted document. The pre-retrieval gate excludes it and records a non-sensitive reason; the route asks for authorised evidence or escalation.

Temporal conflict: two authentic policies disagree and validity at the decision time is unresolved. Preserve both versions and stop the material action pending resolution.

Indirect injection: an external file contains instructions to ignore policy. It remains untrusted data inside a bounded hybrid route, while tool privilege and output controls remain external.

Compression loss: a summary removes a qualifying exception that changes eligibility. The transformation fails; redesign the assembly or retain the exception before adding more context.

Stale memory: conversation history contains a corrected customer state. Reconstruct current state from the authority, mark the old item superseded and expire it.

Over-engineering boundary: a low-consequence question uses a small public document set. A structured read and lightweight receipt are sufficient; a complex retrieval platform would not improve the evidence.

Architecture failure: source definitions and access rules conflict. Redesign the source, policy or workflow. A larger context window would only transmit the conflict.

Evidence boundaryEmpirical limits and scoped controls

Lost in the Middle reports position-sensitive performance in long inputs. RULER broadens evaluation beyond a single needle to varied needles, multi-hop tracing and aggregation, while LongBench tests several long-context tasks. These studies support local evaluation of usable context. They do not establish a permanent ranking of current products or one universal operating length.

RAG research describes the combination of generation with retrieved evidence, and comparative work supports task-dependent choices between retrieval and long context. LLMLingua demonstrates prompt compression mechanisms; compression remains a lossy transformation that needs task evidence. MemGPT motivates explicit management across limited context and external state. None of these mechanisms establishes authority, permission or temporal truth.

PROV-O and the W3C Time Ontology support representation of provenance and time. NIST AI RMF sources support contextual governance, provenance, information integrity, privacy, monitoring and accountability. NIST Zero Trust Architecture supports resource-centred, least-privilege access that is continually evaluated. OWASP LLM01:2025 describes direct and indirect prompt injection and recommends segregating external content among broader mitigations. Model-only instructions are not treated as a complete defence.

EU AI Act duties depend on applicable classification, role, provision, jurisdiction and timing. The Context Supply Chain, budget, receipt and Router are this article's synthesis. Keep nominal capacity, empirically usable context, authorised context, selected evidence, citation, provenance and retained memory distinct. The architectural capability is reconstructing the right authorised state, not purchasing the largest empty window.