Attention dilution moves agent compliance out of the prompt and into a runtime policy engine

A transformer spreads attention across its entire input, and material sitting in the middle of a long context loses accuracy against material at either end ^[4]. Compliance instructions are static and go in first. Tool outputs, user messages and intermediate reasoning steps arrive later and keep arriving ^[1][3]. On the account cryptobriefing.com gives, a million-token window does not exempt a model from this, and longer windows buy compute cost and brittleness without better compliance ^[7][6].

Compliance rates differ by as much as 46 percentage points across models, and standard benchmarks do not surface the gap ^[5]. Per action, a model complying on 99 of every 100 and one 46 points behind it complying on 53 produce 1 violation per 100 against 47, a factor of 47 ^[18]. cryptobriefing.com does not identify the studies behind the 46-point figure or price either the Microsoft or the Atlassian product ^[19].

The Cloud Security Alliance figure is the survey number in the piece with a named source: 53% of organizations have reported agents exceeding their intended permissions regularly or occasionally ^[9]. The other 47% either had no such instance or saw none ^[16]. Reporting an overrun requires having logged the action. Logging and checking every action before it executes is what the external policy engine does ^[11].

Microsoft's Agent Governance Toolkit intercepts agent actions and validates them against that engine, at what the company describes as sub-millisecond enforcement at runtime ^[10][11]. A session with 500 tool calls therefore pays under half a second ^[17]. Atlassian's Agent Context Controls take a similar approach across enterprise workflows ^[12]. The toolkit launched in April 2026, four months before the EU AI Act's high-risk obligations become enforceable in August 2026 ^[15][13].

I would treat that enforcement layer as a fixed operating cost of running agents in healthcare, finance or law enforcement, and I would expect it to compete for the same budget as model upgrades and extra agent seats. The counter-thesis sits inside the same source. If compliance rates vary by 46 points across models, swapping models is the cheapest single lever a deployer has, and cryptobriefing.com still writes that model selection and benchmark scores are "necessary but nowhere near sufficient" for compliance-sensitive applications ^[5][14].

Two results would break the reading. A measured population showing long-context compliance holding flat in current models would move the problem back to prompt engineering ^[1]. Supervisors accepting start-of-session instructions as evidence of the transparency, human oversight and risk management the Act requires would take the August date out of the procurement case ^[13].