One of the oldest principles in information security is giving a user only the access they need to do their job. This principle maps directly to an agentβs context window. We call this cognitive least privilege: an agent should hold only the information essential to its task, and nothing more.
Why less is better
This restriction yields two structural advantages. First, accuracy: giving an agent irrelevant information creates noise. The model may weigh that irrelevant data in its reasoning, leading to errors or hallucinations. Second, security: the tighter the data in an agentβs context, the smaller the surface area for information to leak or be abused. The logic of security and the logic of accuracy converge.
The boundary between self-knowledge and system-knowledge
A simple distinction helps enforce this: an agent should know about itself, not the system. βSelf-knowledgeβ covers the agentβs identity, its responsibilities, and the rules governing its behaviour. This belongs in the prompt. βSystem-knowledgeβ is awareness of other agents, system topology, and data flow. This should be omitted.
Define the agent by the task it does, not by the position it holds in the system. Remove referential phrases like βupstreamβ and βdownstreamβ from instructions. Ask for output without specifying a destination: instead of βsend the result to such-and-such component,β write βreturn the result.β
In practice
Before adding information to the context, ask: does the agent strictly need this to do its job? If no, remove it. Then ask: could this information leak into user-facing output or reveal internal system details? If yes, remove it. Observing this structural discipline improves accuracy while keeping the attack surface small. A focused agent that has command only of its own task will almost always outperform a know-it-all agent.