A useful assistant starts with the situation.
Identity, screen, live state and permissions change the right answer. Learn how to assemble the smallest useful context before generation.
Short answer
Documentation explains stable rules. A useful answer also depends on who is asking, where they are, which record is active, what the system knows now and what the person may do next. Resolve those facts before generation. Filter restricted knowledge before it reaches the model, retrieve only what is relevant and expose only the tools valid for the current workflow. Context is not a larger prompt. It is a controlled view of the situation.
Key points
- 01
Treat browser state as a hint until the server validates it.
- 02
Separate stable knowledge from live product state.
- 03
Build the smallest useful context instead of sending everything.
01 / SITUATION
The same sentence can require three different answers
“Can I approve this?” is not a documentation question. A customer may only see status. An operator may correct missing information. An administrator may review an approval proposal. The wording is identical, but identity and current state change both the evidence and the next step.
When these distinctions are left to a prompt, the model is being asked to recreate an access-control system from text. That is fragile by design. The host application should establish the boundary first, then give the model a view that already respects it.
02 / MECHANISM
Build context in a fixed order
Ordering matters because later stages should never widen a boundary that an earlier stage closed.
- 01Identify
Resolve the signed-in user, tenant, site and effective role from the host application.
- 02Validate the screen
Check the route, selected record and module on the server. A browser-provided identifier is not authority.
- 03Retrieve knowledge
Search permitted documentation and stable knowledge using filters before ranking and generation.
- 04Observe live state
Use scoped read tools for facts that can change, including status, history and available options.
- 05Select eligible tools
Expose only operations relevant to the module, role and workflow. A denied tool should not enter the candidate set.
- 06Return evidence and limits
Distinguish an empty result, missing evidence, denied access and a tool failure. They demand different next steps.
03 / In real work
A maintenance procedure
The document is stable. Equipment state, site, operator certification and open work order are situational. Both layers are needed.
A finance exception
Policy explains the rule. The current entry, account period, attachments and role explain whether this person can resolve it.
A product support question
The guide explains the feature. Plan, current configuration and screen explain which instructions apply now.
Common failure modes
- Trusting tenant, role or record identifiers sent by the browser.
- Sending the complete knowledge base to the model and calling it context.
- Using stale documents for facts that belong in a live tool.
- Treating no result and no access as the same state.
- Letting semantic routing override a deterministic security decision.
Implementation checklist
- Identity is resolved by the host product.
- Page and record context are server-validated.
- Knowledge filters are applied before generation.
- Live tools use the same tenant and role boundary as the UI.
- Tool eligibility is reduced by workflow or module.
- Evidence includes source type and freshness where useful.
- Empty, denied, partial and failed states are tested separately.
What this approach does not claim
- More context can lower quality when irrelevant details compete with useful evidence.
- Retrieval cannot compensate for missing or contradictory source material.
- Current state may change between answer and action, so writes require a fresh server-side check.
Sources and reference types
- 01Guidelines for Human-AI InteractionAmershi et al., Microsoft Research · 2019Research
- 02Retrieval-Augmented Generation for Knowledge-Intensive NLP TasksLewis et al. · 2020Research
- 03ReAct: Synergizing Reasoning and Acting in Language ModelsYao et al. · 2023Research
- 04AgentDojo: A Dynamic Environment to Evaluate Prompt Injection AttacksDebenedetti et al. · 2025Research
Practical questions
How much context should be sent to the model?
Only what the current question and workflow require. Measure retrieval and answer quality as context changes instead of assuming that more is safer.
Can the model decide which permissions apply?
No. It may explain a policy result, but the host application should calculate and enforce access deterministically.
What if the current screen is not enough?
Use it as one signal. The system can ask a focused clarification or call an approved read tool rather than inventing missing state.