Agent Context Isolation

Agent context isolation

In a multi-agent system, sharing everything with everyone is the default that quietly kills quality: agents drown in irrelevant context, one agent's confusion spreads to all, and a prompt injection anywhere reaches everything. Isolation is the fix: each agent gets a clean, scoped context and a narrow interface to the rest.

Method

1. Scope each agent's context to its job. A worker agent gets the task, the inputs, and the tools that task needs, not the whole system's history and every other agent's chatter. Focused context produces focused work (see context-engineering's select-for-relevance rule); a shared ever-growing transcript degrades every agent reading it.
2. Pass structured handoffs, not raw transcripts. When one agent feeds another, hand over a clean, defined result (the answer, the artifact, the decision) rather than dumping your entire reasoning trace into their context (see agent-handoff-protocol). The next agent needs your output, not your scratch work.
3. Isolate failure and confusion. With scoped contexts, one agent going off the rails or hitting a bad input does not corrupt the others; the orchestrator can retry or replace it (see orchestrator-prompt, agent-orchestration-antipatterns). Shared mutable context turns one agent's error into a system-wide one.
4. Contain the injection blast radius. Untrusted content (retrieved docs, tool results, user input) reaching one agent should not carry instructions into every other agent's context; isolation limits what a successful prompt injection can touch (see llm-guardrails). The agent with web access should not share a context with the agent holding credentials.
5. Give each agent least-privilege tools. Beyond context, scope capability: an agent gets only the tools and permissions its role requires (see agent-role-definition, iam-design's least-privilege applied to agents). A researcher agent reads; it does not deploy.
6. Define the shared surface explicitly. Decide deliberately what IS shared (the goal, a shared artifact store, a results channel) and keep it small and structured. Everything shared is coupling and a failure path; make the shared surface a choice, not an accident.

Boundaries

• Isolation trades some coordination ease for containment and clarity; agents that genuinely need to collaborate closely need a shared channel, but make it the exception you design, not the default.
• Too much isolation can starve an agent of context it needs to do the job well; scope to the task's real needs, not to an arbitrary minimum (see context-engineering).
• This governs what agents see and can do; it does not replace verifying their output (see agent-qa-gate, agent-eval-design).