Context Window
A context window is the maximum amount of text, measured in tokens, that a large language model can consider at once. It holds everything the model sees for a single request: the system prompt, the conversation history, any retrieved documents, and the user's current input, plus the response the model generates. Modern models range from a few thousand tokens to over a million. Once content exceeds the window, the model can no longer attend to it. Everything inside the window is treated by the model as input, which is why untrusted text placed there can carry injected instructions.
How the context window is filled
For a single inference call, the application assembles the context window from several sources: a fixed system prompt that sets the model's instructions, the running dialogue, documents pulled in by retrieval, and the user's message. The model processes all of it as one undifferentiated sequence of tokens. It has no built-in way to know that the system prompt is trusted while a retrieved web page is not; both occupy the same window and both influence the output.
Why the window is a security surface
Because the model acts on the whole window, any channel that can insert text into it becomes an injection channel. A poisoned document retrieved into the window, or hostile text pasted into a conversation, can steer the model's behavior. The defensible control point is the request that carries that window to the model. DeepInspect inspects the prompt payload on the HTTP path, applies prompt-level classification and policy before the request reaches the inference endpoint, and records the decision, so sensitive content and disallowed instructions are caught at the boundary rather than after the model has acted.
Related reading
- AI Agent Context Window Poisoning: How a Single Bad Retrieval Steers an Entire Session
An AI agent runs in a context window: the system prompt, the user request, the retrieved documents, the prior tool calls, and the prior model responses. The window is the model''s working memory for the session. Context window poisoning is the attack pattern where attacker-controlled content lands in the window and steers the model''s subsequent decisions. A single bad retrieval can alter the model''s behavior for the rest of the session. This article walks the attack vectors, the detection signals at the gateway, the redaction patterns that prevent the poison from reaching the model, and the audit record that supports investigation.
- RAG Security Architecture: The Four Trust Boundaries in a Retrieval Pipeline
A RAG request crosses four trust boundaries before the answer comes back: what gets indexed, who can retrieve which chunks, what the assembled prompt carries into the model, and what the response returns. This article lays out the reference architecture for each boundary, marks which two are data-plane controls and which two sit on the HTTP path to the model, and shows where identity-bound policy and a per-decision audit record belong.