AI Context Governance (2026): Context Engineering Controls, Access, Provenance

1. What Is AI Context Governance?

9 entries

Why the information an AI model or agent receives needs ownership, quality, access control and audit. Context is the new attack surface and the new source of truth for agents.

01Anthropic: Effective Context Engineering for AI AgentsWhat belongs in an agent's context, and how to curate it over long tasks. 02LangChain: Context Engineering for AgentsWrite, select, compress and isolate context for agents. 03Manus: Context Engineering for AI AgentsPractical lessons including cache hit rate and file-system context. 04Gartner: Market Overview for AI Context PlatformsGartner reprint on the AI context platform market. 05Enterprise AI Context PlatformsContext and metadata platforms for enterprise agents, on this site. 06Model Context ProtocolOpen standard for supplying tools and context to AI applications. 07NIST AI Risk Management FrameworkGovern, map, measure and manage functions that apply to the data and context models use. 08ISO/IEC 42001: AI Management SystemManagement system standard covering AI data and operations. 09OECD AI PrinciplesPrinciples for trustworthy AI, including transparency and accountability.

2. Context Risks: Injection, Poisoning and Leakage

12 entries

Threats that arrive through retrieved documents, tool output and memory. Treat all retrieved content as untrusted input.

10OWASP Top 10 for LLM ApplicationsMost critical risks, including prompt injection, sensitive information disclosure and vector weaknesses. 11OWASP LLM01: Prompt InjectionHow instructions hidden in context can hijack a model. 12OWASP LLM08: Vector and Embedding WeaknessesRisks in retrieval stores, including access control failures. 13MITRE ATLASAdversary tactics against AI systems, including poisoning and injection. 14Not What You've Signed Up For: Indirect Prompt InjectionPaper showing how retrieved content can attack LLM-integrated applications. 15PoisonedRAGKnowledge corruption attacks on retrieval-augmented generation. 16Simon Willison: The Lethal TrifectaPrivate data, untrusted content and external communication together create leak risk. 17Design Patterns for Securing LLM Agents against Prompt InjectionsPatterns that constrain agents to resist injection. 18CaMeL: Defeating Prompt Injections by DesignSeparates control and data flow to stop injected instructions. 19Anthropic: Mitigating the Risk of Prompt Injections in Browser UseDefences for agents that read web content. 20Microsoft: Prompt ShieldsDetects direct and indirect prompt attacks in context. 21Lakera GuardRuntime protection against prompt injection and data leakage.

3. Access Control and Policy for Context

11 entries

Make sure an agent only retrieves what the user is allowed to see. Enforce permissions at retrieval time, not just at the model.

22Open Policy AgentPolicy engine for authorization decisions as code. 23Cedar Policy LanguageOpen-source policy language for fine-grained authorization. 24OpenFGARelationship-based authorization suited to document-level permissions. 25Permit.ioAuthorization as a service, including for AI access control. 26OsoAuthorization for applications and AI agents. 27CerbosOpen-source policy decision point. 28MCP Authorization SpecificationOAuth-based authorization for MCP servers. 29OAuth 2.0 Token Exchange (RFC 8693)Delegation pattern for agents acting on behalf of users. 30SPIFFEWorkload identity for agents and tools. 31AI Agent Security SolutionsRuntime security for agents, on this site. 32Zero Trust Security SolutionsZero trust architecture and vendors, on this site.

4. Privacy, PII and Data Protection in Context

12 entries

Detect and remove sensitive data before it enters prompts, memory or logs. Redact first, retain least, and keep consent and purpose attached.

33Microsoft PresidioOpen-source PII detection and anonymisation. 34Amazon Bedrock Guardrails: Sensitive Information FiltersDetect and mask PII in prompts and responses. 35Google Cloud Sensitive Data ProtectionDiscover, classify and de-identify sensitive data. 36NVIDIA NeMo GuardrailsProgrammable guardrails for LLM applications. 37Llama GuardMeta's safeguard models and tools for LLM input and output. 38GDPR (EUR-Lex)Official text, including purpose limitation and the right to erasure. 39EU AI Act: Regulatory FrameworkData governance and transparency duties for AI systems. 40India Data Protection Framework (MeitY)India's data protection law and rules. 41NIST Privacy FrameworkFramework for managing privacy risk. 42OneTrustPrivacy and data governance platform. 43BigIDData discovery and classification for AI and privacy. 44DPDP Act ComplianceIndia's Digital Personal Data Protection Act, on this site.

5. Provenance, Lineage and Metadata for Context

14 entries

Know where every piece of context came from and whether it can be trusted. Provenance lets you trace an answer back to its sources.

45C2PA: Content Provenance and AuthenticityOpen standard for attaching verifiable provenance to content. 46W3C PROV-OStandard terms for recording provenance. 47OpenLineageOpen standard for collecting data lineage. 48DataHubOpen-source metadata platform with lineage and AI features. 49OpenMetadataOpen-source metadata, lineage and governance. 50AtlanActive metadata platform positioned for AI context. 51CollibraData governance and catalog platform. 52AlationData catalog and governance. 53Microsoft PurviewData governance and compliance across Microsoft and other sources. 54Databricks Unity CatalogUnified governance for data and AI assets. 55Semantic Layers and Metric StoresGoverned definitions agents can query, on this site. 56Metadata ManagementCatalogs, lineage and standards, on this site. 57Data Lineage ToolsLineage tools compared, on this site. 58Ontology-Driven GraphRAGOntology-governed knowledge graphs for retrieval, on this site.

6. Governing Agent Memory and Retrieval Stores

12 entries

Policies for what agents remember, retrieve, update and forget. Memory needs retention, deletion and review like any other data store.

59LangMemLong-term memory tools for LangGraph agents. 60Mem0Memory layer for AI agents. 61LettaStateful agents with persistent, inspectable memory. 62Zep and GraphitiTemporal knowledge graph memory with provenance of facts. 63MemGPTPaging memory between context and storage. 64Anthropic: Memory ToolFile-based memory the developer controls and can inspect. 65LlamaIndexFramework for retrieval over private data, with access metadata. 66pgvectorVector search inside PostgreSQL, so row-level security can apply. 67Qdrant: MultitenancyIsolate tenants in a vector database. 68Pinecone: NamespacesPartition vector data by namespace. 69Agent MemoryMemory architectures for agents, on this site. 70AI Agent DatabasesDatabases for agent workloads, on this site.

7. Observability, Audit and Evaluation of Context

13 entries

Trace what context an agent used and test that governance works. If you cannot trace the context, you cannot defend the answer.

71OpenTelemetry GenAI Semantic ConventionsStandard attributes for tracing model and agent calls. 72LangSmithTracing and evaluation for LLM applications. 73LangfuseOpen-source tracing and evaluation. 74Arize PhoenixOpen-source tracing and evaluation with retrieval metrics. 75RagasMetrics for retrieval and context quality, such as context precision and recall. 76DeepEvalEvaluation framework including contextual relevancy and faithfulness metrics. 77promptfooTest and red-team prompts and RAG pipelines. 78garakLLM vulnerability scanner. 79AI Agent ObservabilityMetrics, events, logs and traces for agents, on this site. 80Evaluating & Improving Agentic ApplicationsEvaluation frameworks and benchmarks, on this site. 81AI Model GovernanceModel risk, registries, model cards and monitoring, on this site. 82AI Governance FrameworksRegulation, standards, roles and controls, on this site. 83AI Agent GuardrailsFive checkpoints and tools, on this site.

Frequently Asked Questions

What is AI context governance?

AI context governance is the set of policies and controls over the information an AI model or agent receives and remembers: its sources, quality, ownership, permissions, privacy treatment, provenance and retention. It makes sure agents use trusted, authorised context and that each answer can be traced and audited.

How is context governance different from data governance and AI governance?

Data governance manages data assets, and AI governance manages models, risk and use cases. Context governance sits between them and acts at run time: what a specific agent may retrieve for a specific user and task, and what ends up in prompts, tool output and memory.

What risks does ungoverned context create?

Prompt injection through retrieved documents or tool output, poisoned knowledge bases, leakage of private or regulated data, users seeing documents they should not, stale or conflicting facts, and no way to trace an answer back to its sources.

How do you enforce access control on retrieved context?

Carry the user's identity through the agent, filter retrieval by permissions at query time using a policy engine or relationship-based authorisation, partition vector stores by tenant, and use delegated credentials rather than shared service accounts. Do not rely on the model to withhold data it has been given.

How do you defend against prompt injection in context?

Treat retrieved and tool content as untrusted data, separate instructions from data, limit what tools an agent can call after reading untrusted content, require approval for sensitive actions, scan inputs and outputs, and test with red-team tools. Design patterns such as CaMeL and the lethal trifecta guidance help.

What should be governed in agent memory?

Decide what may be stored, for how long, who can read or edit it, how users can view and delete it, and how facts are corrected. Record provenance for each memory and apply the same privacy and retention rules as other personal data.

What is an AI context platform?

An AI context platform assembles trusted business context for agents from metadata, semantic layers, knowledge graphs and policies. Gartner has published a market overview of these platforms, and this site lists vendors on its Enterprise AI Context Platforms page.

How current is this list?

Links were checked in November 2026. A few sites, such as Gartner, ISO, BigID, DataHub and Arize, block automated checks and may need a manual click. This page is a resource list, not legal or security advice, and tool descriptions reflect each project's own positioning.