Skip to lesson
中文
The collection/AN OPEN STUDY ROUTE

WEEK 11 / 24 · Build with evidence

Context and boundaries

Context, skills and MCP: connect capabilities and enforce permissions

10 core hours + 2 optionalREAD · BUILD · PRACTISE
Begin the lesson ↓
Context and boundariesTHE PERSONAL FDE FIELD LIBRARY

The question: Do more context and tools improve reliability, or simply enlarge the space for leakage and mistakes?

Before you begin: Run evaluations and explain the difference between the executor and model suggestions.

FIG. 11.1THIS WEEK’S REASONING PATH
  1. 01Project constraints
  2. 02Relevant context
  3. 03Scoped tool call
  4. 04Reject violations
Teaching diagram · Derived from this week’s lab; a suggested process, not observed results.

Concepts and learning objectives

Separate durable project constraints, current task state and untrusted external material. Do not combine them into an ever-growing conversation. A handoff needs the goal, verified outcomes, next step, blockers and necessary file locations, rather than private conversations and full logs.

Skills supply task procedures on demand; MCP connects tools and resources. Neither automatically confers trust. Tool descriptions, repository documents and webpages can contain misleading instructions. Begin with read-only integration, learning identity, parameters, permissions, return values and failure boundaries. If a tool lacks continuation or deletion features, keep a manual process instead of pretending otherwise.

Reading and selected sections

Priority Source and selected sections Budget
Required R43 · Anthropic — Effective context engineering for AI agents — Context selection, compression and retrieval trade-offs; use mechanisms only when needed. 35 min
Required R57 · MCP — Security Best Practices, 2026-07-28 — Versioned guidance on authorisation boundaries, tokens and connector risks. 45 min
Required selections R58 · OWASP — LLM Prompt Injection Prevention Cheat Sheet — Indirect prompt injection, constrained tools and layered protection. 40 min

Studio lab

  1. Reduce project instructions to one page: startup, boundaries, tests and completion. Write a short handoff and load only relevant modules next time.
  2. Capture one recurring low-risk procedure as a skill: triggers, inputs, steps, verification and stop conditions. Do not grant it automatic installation or permission expansion.
  3. Write a read-only tool permission table: resources, methods, argument ranges, returned fields and timeouts. Use mock MCP or a verified public service.
  4. Put a harmless injection into synthetic material, such as a request to ignore the task and emit a marker. Verify that content remains data and the executor blocks unauthorised actions.
  5. Compare a short handoff with full history on the same task. Identify important lost information; keep complexity only if evidence justifies it.

Deliverables and acceptance

Deliverable Evidence of completion
Context and handoff card A fresh session resumes a concrete task without private logs.
Tool permission table Explicit allowed and denied scope with a performed rejection test.
Injection drill Records actual execution, not merely the model's verbal refusal.

Independent exercise: Implement one resource-scope check and test an out-of-scope parameter. Editing the system prompt alone does not count.

Privacy and safety: Avoid token passthrough, shared credentials and unknown MCP services. Read-only data can still be exfiltrated. Restrict unnecessary egress and exclude sensitive tool outputs from traces. Do not disable host permission prompts because a tutorial demonstrates autonomy.

Everyday use: Resume an interrupted learning task from a short handoff. The purpose is easier recovery, not managing an elaborate context-monitoring system.

Pass or revisit: A new session resumes the task, unauthorised requests are actually rejected and external text is treated as untrusted.

A reusable collaboration prompt

Create minimal project constraints, a short handoff and permissions for one read-only tool. Test synthetic prompt injection and out-of-scope arguments at the executor. Do not connect real accounts or add arbitrary file or shell access. Remove unnecessary context first.

Sources and verification scope

Reference IDs and scope follow the supplied manuscript, baseline 2026-09-27. External authenticated labs were not all completed; recheck versions and access before implementation.

  1. R43
    Anthropic — Effective context engineering for AI agents ↗

    Context selection and management; model-specific experience is not permanent law.

  2. R57
    MCP — Security Best Practices, 2026-07-28 ↗

    Pinned for traceability; check newer security changes when implementing.

  3. R58
    OWASP — LLM Prompt Injection Prevention Cheat Sheet ↗

    Layered controls; no single prompt guarantees injection prevention.