How Does Context Engineering Drive Multi-Agent Reliability?

In June 2025, Shopify CEO Tobi Lütke introduced the term “context engineering” as a more precise alternative to prompt engineering. Lütke’s definition: “the art of providing all the context for the task to be plausibly solvable by the LLM” (Lütke, 2025). Andrej Karpathy echoed it a week later; the term arrived because the problem had outgrown its old name. Prompt engineering implies craft; context engineering implies architecture. For platform teams deploying multi-agent systems, that distinction separates a fragile prototype from a reliable production system. A third discipline, harness engineering (Hashimoto, 2026; Lopopolo, 2026), governs the execution runtime. Harness engineering shapes the system layer; context engineering defines the model’s context window and is the focus here.

Three failure modes account for the majority of production incidents: context accumulation, context starvation, and context leakage. Each has a distinct fingerprint, a detection signal, and a remediation pattern.

Table of contents

What Is Context Engineering and Why Does It Matter Now?

The information a model sees at inference time is a designable artifact, not a fixed input. Anthropic defines it as “the set of strategies for curating and maintaining the optimal set of tokens during LLM inference” (Anthropic, 2025). That definition now has production evidence behind it: Anthropic’s engineering team recently published that they removed over 80% of the Claude Code system prompt with no measurable loss on coding evaluations. Context discipline, not context volume, drives reliability (Shihipar, 2026). That includes the system prompt, retrieved documents, tool outputs, conversation history, structured state, and any other tokens present in the model’s context window when it generates a response.

By contrast, prompt engineering focuses on the wording of a single instruction. The scope difference is more precisely a compilation step. Context engineering transforms raw event streams into an optimized token view through explicit pipeline stages. That is the same operation a compiler performs on source code: processing the input differently, not rewriting it.

As an infrastructure discipline, context engineering shares the same properties as other platform concerns: it must be observable, testable, and subject to capacity constraints. A context window is a finite attention budget. Transformer architecture scales attention quadratically with token count, so every irrelevant token is doubly costly: it consumes capacity and degrades the signal available to the model. Vishnyakova (2026) frames context as the agent’s operating system, proposing five quality criteria: relevance, sufficiency, isolation, economy, and provenance. That framing is useful because it makes the engineering trade-offs explicit.

The business imperative is timing. Vishnyakova cites Deloitte (2026) survey data indicating that approximately three in four enterprises plan agentic AI deployment within two years, alongside KPMG findings showing that early deployment waves have already contracted as organizations confront scaling complexity.

How Does Context Engineering Relate to Harness Engineering?

In February 2026, Mitchell Hashimoto (HashiCorp co-founder) formalized a parallel discipline he called harness engineering, summarized by the formula Agent = Model + Harness (Hashimoto, 2026). Days later, OpenAI engineer Ryan Lopopolo published a field report from shipping a production codebase with zero manually written lines of code, using the same vocabulary (Lopopolo, 2026). The harness is everything that wraps the model except the model itself: tool execution, multi-session state management, error recovery loops, permission enforcement, sandboxing, and session lifecycle. The core principle: whenever an agent makes a mistake, engineer the environment so it cannot make that mistake again.

The relationship between the two disciplines is not a replacement hierarchy. Fowler and Böckeler put it directly: “Context engineering provides us with the means to make guides and sensors available to the agent. Engineering a user harness for a coding agent is a specific form of context engineering” (Fowler / Böckeler, 2026). Context engineering defines what the model sees at each inference step, the window layer; harness engineering controls the runtime that assembles that window and acts on its output, the system layer.

The claim that “context engineering is outdated” conflates chronology with containment: the fact that harness engineering was named in 2026 does not make the 2025 discipline obsolete, for the same reason that distributed systems engineering did not make database schema design obsolete. The 2026 TMLR-track survey “Agent Harness Engineering: A Survey” (Li et al., 2026) confirms this structurally: its seven-layer taxonomy (Execution, Tool, Context, Lifecycle, Observability, Verification, Governance) places context management as an explicit layer inside the harness stack, not a predecessor to it. A harness without that layer still accumulates stale tokens, starves agents of relevant signal, and leaks state across boundaries.

What Are the Three Failure Modes of Context in Multi-Agent Systems?

Each failure mode leaves a distinct observable fingerprint before it causes a task failure.

Why Does Accumulation Turn More Context Into Less Signal?

Chroma Research (2025) tested 18 frontier models, including GPT-4.1, the Claude 4 family, Gemini 2.5, and Qwen3, across context lengths from 1K to 1M tokens. Every model degraded with input length, even on simple tasks, well before advertised window limits were reached. This is context rot: gradual degradation, not a hard cliff. In some conditions, accuracy drops exceeded 30%.

Yi et al. (2026) label this the Fidelity-Reliability Trade-off and show that preserving more context fidelity degrades reliability. Their AdaCoM system trains an external manager via reinforcement learning to compress and prioritize context adaptively, without modifying the underlying agent, making it applicable to closed-source models. The behavioral consequence is specific: a context window flooded with stale tool outputs or deprecated state causes the model to fixate on past patterns instead of the current instruction. Chroma’s data shows that what accumulates matters as much as how much accumulates.

Why Does Starvation Leave the Agent Unable to See What It Needs?

Retrieval succeeds; placement fails. Liu et al. (2024) document a U-shaped degradation pattern: models perform best when relevant information appears at the very beginning or very end of the context, and worst when it is buried in the middle. In long-context multi-agent pipelines, most retrieved content lands in the middle.

The consequence is failures that look like retrieval failures but are positioning failures: the chunk was retrieved, then placed where the model attends least. Fixing recall does not fix the problem; context budget allocation and chunk ordering do.

Why Does Leakage Occur When Context Crosses Agent Boundaries?

Shared memory stores and insufficiently scoped prompts are the most common causes; typed context slots and explicit boundary enforcement at every handoff are the remediation, illustrated below by the Bayer AG PRINCE production case (Thoughtworks / Bayer AG, 2026).

How Does Context Isolation Prevent Failure at Scale?

Named, typed containers defined at design time give each agent role exactly the context subset that its task requires. Isolation controls which context an agent sees; progressive disclosure controls when it loads: skills, verification workflows, and tool definitions pulled on demand instead of kept always-on (Shihipar, 2026).

In a standard three-role pipeline, the planner receives the schema, the user query, and the workflow specification. The researcher receives retrieved document chunks and the research question. The writer receives the citation set, the output constraints, and the structured summary from the researcher. Anthropic describes this pattern as “context window protection”: sub-agents handle specialized tasks without polluting the main agent’s context (Anthropic, 2024). In practice, sub-agent returns are condensed. Effective summaries typically run in the low thousands of tokens, not full transcripts.

from dataclasses import dataclass
from typing import Any, Literal

AgentRole = Literal["planner", "researcher", "writer"]

@dataclass
class ContextSlot:
    role: AgentRole
    schema: str | None = None
    query: str | None = None
    chunks: list[str] | None = None
    citations: list[str] | None = None
    constraints: str | None = None

def route_context(full_state: dict[str, Any], role: AgentRole) -> ContextSlot:
    if role == "planner":
        return ContextSlot(
            role=role,
            schema=full_state["schema"],
            query=full_state["query"],
        )
    if role == "researcher":
        return ContextSlot(
            role=role,
            chunks=full_state["retrieved_chunks"],
            query=full_state["query"],
        )
    return ContextSlot(
        role=role,
        citations=full_state["citations"],
        constraints=full_state["constraints"],
    )context_router.py

A routing function enforces context isolation by dispatching only the relevant subset to each agent slot.

The PRINCE case study illustrates what isolation looks like at production scale. The system’s structured harness enforces context boundaries between pipeline stages; logging is a secondary concern. The 3.1/5.0 live evaluation score (Thoughtworks / Bayer AG, 2026) reflects the difficulty of the preclinical data domain, and underscores that isolation is necessary but not sufficient: it removes a class of failures without replacing measurement.

Anthropic’s guidance reinforces this operationally: developers should literally inspect the agent’s context window at decision time. Agents frequently fail from information asymmetry, not model capability limits (Anthropic, 2024); typed slots are the enforcement mechanism.

How Do You Measure Context Quality in Production?

Four metrics cover the space of context quality concerns in production multi-agent systems. Each maps to one of the three failure modes above.

Which Metrics Should You Instrument First?

Instrument freshness ratio and leakage rate first: both are observable at the infrastructure layer without touching agent code. Retrieval precision and task success delta require sampling and a held-out baseline, so they follow once the pipeline is stable.

The 0.80 freshness threshold derives from the Chroma degradation curve, where accuracy loss accelerates below that ratio.

How Do You Implement a Context Guard?

Accumulation builds gradually; a freshness guard catches it at injection time before the agent ever sees the stale chunk.

from datetime import datetime, timedelta, timezone

# set from observed degradation curve, not advertised window limits
MAX_CONTEXT_AGE_HOURS = 4

def is_context_fresh(
    chunk_timestamp: datetime | None,
    reference_time: datetime | None = None,
) -> bool:
    if chunk_timestamp is None:
        return False
    now = reference_time or datetime.now(timezone.utc)
    if chunk_timestamp.tzinfo is None:
        age = now - chunk_timestamp.replace(tzinfo=timezone.utc)
    else:
        age = now - chunk_timestamp
    return age <= timedelta(hours=MAX_CONTEXT_AGE_HOURS)

def filter_stale_chunks(
    chunks: list[dict],
    reference_time: datetime | None = None,
) -> list[dict]:
    return [c for c in chunks if is_context_fresh(c["timestamp"], reference_time)]context_guard.py

How Do You Detect Context Leakage?

Compare the slot the router was authorized to populate (expected) against what was actually populated at runtime (actual). Any field present in actual but absent from expected crossed an agent boundary it should not have. The leakage_rate float maps directly to the near-zero target in the metrics table: a value above 0.01 in production signals a boundary enforcement gap.

def audit_context_leakage(
    expected: ContextSlot,
    actual: ContextSlot,
) -> dict[str, object]:
    authorized = {k for k, v in vars(expected).items() if v is not None}
    received   = {k for k, v in vars(actual).items()   if v is not None}
    leaked     = received - authorized
    return {
        "leaked_fields": leaked,
        "leakage_rate": len(leaked) / max(len(received), 1),
    }context_guard.py

Freshness ratio and leakage rate are instrumentable at the infrastructure layer without changing agent behavior. Retrieval precision at k requires sampling: logging 5-10% of agent invocations, scoring retrieved chunks against the task query, and computing precision over time. Task success delta requires a baseline on a held-out evaluation set. The PRINCE team’s live evaluation methodology (Thoughtworks / Bayer AG, 2026) demonstrates that structured evaluation is feasible in production drug-development workflows, where the cost of a wrong answer is measurable.

What Does Context-First Design Look Like in Practice?

First, define the budget: the maximum token allocation for each agent role, derived from the model’s effective context window, not its advertised limit. Second, define the slots: named, typed containers specifying which categories of information each role is authorized to receive. Third, wire the routing: implement a router that enforces slot boundaries at every inter-agent handoff. Fourth, instrument the metrics: deploy freshness checks, leakage monitors, and retrieval precision logging before the system handles real traffic.

# Pre-launch checklist: instantiate before any agent ships
context_budget:
  planner: 8000      # tokens, from effective window 
  researcher: 16000
  writer: 6000
context_slots:
  planner: [schema, query]
  researcher: [chunks, query]
  writer: [citations, constraints]
routing:
  enforce_at: "every inter-agent handoff"
metrics:
  - freshness_ratio
  - leakage_rate
  - retrieval_precision_at_k
  - task_success_deltacontext_first_design.yaml

How Do You Triage a Detected Failure?

When an agent pipeline fails, use this decision tree to pinpoint the context breakdown and select the appropriate guardrail.

Takeaways

1. Context engineering is infrastructure. The information environment at inference time is a platform concern, not a wording concern. It subsumes prompt engineering: the instruction you wrote is one layer of many. Treat it with the same discipline as schema design or capacity planning.
2. Three failure modes cover most production incidents. Accumulation degrades accuracy over time; starvation leaves critical information out of the window; leakage crosses agent boundaries. Each has a distinct detection signal and remediation pattern.
3. Isolation is the primary control. Named, typed context slots enforced at every inter-agent handoff address all three failure modes. The Anthropic and PRINCE case studies both converge on structured separation as the enabling architectural pattern. As model capability improves, expressive interface design (typed parameters, enumerated constraints) becomes a more reliable signal than exhaustive hard rules. Reserve explicit guardrails for domains where the cost of a wrong judgment is not recoverable (Shihipar, 2026).
4. Measure before optimizing. Freshness ratio, leakage rate, retrieval precision at k, and task success delta are the four metrics that cover the space. Define a minimum detectable threshold before running at scale: a small pilot that fails to show the expected signal is cheaper to stop than a full-scale run that surfaces the same finding after 10x the cost.
5. Design context budgets from observed degradation curves, not advertised limits. Chroma Research data showing accuracy drops exceeding 30% before window limits are reached means that advertised context window sizes are not safe planning assumptions.
6. Context engineering and harness engineering address different failure modes. Harness engineering (Hashimoto, 2026; Lopopolo, 2026) governs the runtime: tools, sessions, error recovery, permissions. The latter owns the window that runtime assembles. A well-engineered harness that skips context quality discipline will still accumulate, starve, and leak. Neither discipline supersedes the other.

References

• Anthropic, “Context Management: Context Editing and Memory Tool” (2025) — https://www.anthropic.com/news/context-management
• Anthropic, “Building Effective Agents” (2024) — https://www.anthropic.com/research/building-effective-agents
• Chroma Research, “Context Rot: How Increasing Input Tokens Impacts LLM Performance” (2025) — https://www.trychroma.com/research/context-rot
• Fowler, Martin & Böckeler, Birgitta (Thoughtworks), “Harness Engineering for Coding Agent Users” (2026) — https://martinfowler.com/articles/harness-engineering.html
• Hashimoto, Mitchell, “My AI Adoption Journey” (2026) — https://mitchellh.com/writing/my-ai-adoption-journey
• Li et al., “Agent Harness Engineering: A Survey” (2026) — https://openreview.net/forum?id=eONq7FdiHa
• Liu et al., “Lost in the Middle: How Language Models Use Long Contexts” (2024) — https://doi.org/10.48550/arXiv.2307.03172
• Lopopolo, Ryan (OpenAI), “Harness Engineering: Leveraging Codex in an Agent-First World” (2026) — https://openai.com/index/harness-engineering/
• Lütke, Tobi, “X post coining context engineering” (2025) — https://x.com/tobi/status/1935533422589399127
• Shihipar, T. (Anthropic), “The New Rules of Context Engineering for Claude 5 Generation Models” (2026) — https://claude.com/blog/the-new-rules-of-context-engineering-for-claude-5-generation-models
• Thoughtworks / Bayer AG, “Building Reliable Agentic AI Systems” (2026) — https://martinfowler.com/articles/reliable-llm-bayer.html
• Vishnyakova, Vera V., “Context Engineering: From Prompts to Corporate Multi-Agent Architecture” (2026) — https://doi.org/10.48550/arXiv.2603.09619
• Yi et al., “Learning Agent-Compatible Context Management for Long-Horizon Tasks” (2026) — https://doi.org/10.48550/arXiv.2605.30785