Oct 10, 2025

From Prompt to Protocol II

This is a rewrite of From Prompt To Protocol by ChatGPT:

Maintaining your approachable narrative flow,
Add working pseudocode, context-assembly flow diagrams, and developer-level explanations,
Introduce realistic LLM orchestration code snippets,
Weave in security best practices (context integrity, tool-sandboxing, prompt-injection mitigation).

Large-Language Models (LLMs) are astonishing at generating human-like text—but by default they’re stateless and reactive. You send a prompt, they send a reply. No memory, no goals, no persistence.

To turn that linguistic powerhouse into a goal-driven agent—one that can plan, act, and adapt—you need to go beyond “prompt engineering.” You need context engineering: the deliberate construction of a structured, evolving context that defines how the model perceives, reasons, and interacts with the world.

When context becomes structured, it stops being “just a prompt” and becomes a protocol—a repeatable, stateful interaction pattern between the model and its environment.

1️⃣ Why Prompting Alone Hits a Wall

The traditional flow:

User Prompt → LLM → Response

Even with techniques like few-shot or chain-of-thought, you’re still stuck inside a single inference cycle. The model forgets everything the moment the context window expires. It can’t plan multi-step tasks or learn from outcomes.

In short: prompting gives you intelligence in the moment; it doesn’t give you agency over time.

2️⃣ What “Context Engineering” Really Means

Think of the context as the runtime environment for the LLM—its virtual memory, toolbelt, and mission briefing rolled into one. A well-engineered context typically includes:

Layer	Example	Purpose
Memory	Conversation history, retrieved notes	Maintain continuity
Environment State	Sensor data, API results	Give situational awareness
Goals & Constraints	“Book a flight under $500.”	Provide direction & guardrails
Tool Interfaces	Descriptions of callable functions	Enable action
Execution History	Logs of prior steps	Support reflection & learning

You’re no longer sending text—you’re orchestrating stateful reasoning.

3️⃣ From Prompt → Protocol: Building the Loop

Let’s look at what “protocol” means in engineering terms.

3.1 Define the Agent Contract

Instead of “Answer this question,” define a role and goal context:

{
  "role": "TravelAssistant",
  "goal": "Book a round-trip flight within user budget",
  "constraints": ["must confirm before purchase"],
  "available_tools": [
    {"name": "search_flights", "args": ["origin","destination","date"]},
    {"name": "book_flight", "args": ["flight_id","payment_info"], "requires_confirmation": true}
  ]
}

This JSON becomes part of the system context every time the agent runs.

3.2 Plan → Act → Observe → Reflect

The minimal protocol loop looks like this:

while not goal_reached:
    thought = llm.generate(plan_context)
    action = parse_action(thought)
    result = tools[action.name](**action.args)
    llm.observe(result)

Each iteration updates the context with new observations—forming the heart of the ReAct and Plan-and-Execute architectures.

3.3 Visualizing the Protocol

┌────────────┐
│   Prompt   │
└─────┬──────┘
      │
      ▼
┌────────────┐   calls   ┌────────────┐
│ Reasoning  │──────────▶│  Tool API  │
│  (LLM)     │◀──────────│  Response  │
└─────┬──────┘            └────────────┘
      │
      ▼
┌────────────┐
│  Memory DB │  ←─ stores state/feedback
└────────────┘

That back-and-forth—reason ↔ act ↔ feedback—is the protocol that turns text generation into decision-making.

4️⃣ Implementing Context at Code Level

A minimal Python sketch (LangChain-style):

from my_llm import call_llm
from memory import Memory
from tools import ToolRegistry

memory = Memory()
tools = ToolRegistry()

def agent_loop(user_goal):
    context = memory.compose(user_goal, tools.schema())
    while True:
        reply = call_llm(context)
        action = tools.parse(reply)
        if action:
            result = tools.invoke(action)
            memory.record(action, result)
            context = memory.compose(user_goal, tools.schema(), result)
        if memory.goal_completed(user_goal):
            break

This context composer is the real star: it merges history, goals, and recent results into a serialized prompt every cycle.

5️⃣ Adding Security and Safety Layers

Once an LLM can invoke tools, every context variable becomes a potential attack vector. Basic hygiene includes:

Threat	Mitigation
Prompt Injection (malicious text changes tool behavior)	Strictly delimit user input, validate JSON before merging into context.
Tool Abuse (LLM calls unsafe functions)	Use a permission registry—each tool declares required privilege level.
Context Tampering	Sign or checksum memory entries before re-injection.
Data Leakage	Separate private memory (user data) from public reasoning trace.
Infinite Loops	Impose iteration and token limits per protocol session.

In production, wrap this in a sandbox executor—the agent never calls system-level APIs directly.

6️⃣ Architectural Patterns Enabled by Context Design

ReAct (Reason + Act) – Alternates reasoning and tool calls with context tracking both.
Plan-and-Execute – Separates long-term planning from task execution; plans are stored in memory.
Memory-Augmented Agents – Use vector databases for long-term recall.
Multi-Agent Protocols – Each agent maintains a scoped context and communicates via structured messages.

Each of these patterns is simply a different protocol grammar—a contract for how reasoning, memory, and action interact.

7️⃣ Challenges & Frontiers

Challenge	Engineering Focus
Context Window Limits	Summarize or off-load memory into external stores.
Consistency & Drift	Add rule-based validators to detect contradictions.
Safety Verification	Formally model allowed tool sequences as finite-state machines.
Evaluation	Measure not text quality but task success, latency, safety violations.

Future work is moving toward hierarchical context management and formally verified agent protocols, blending symbolic logic with LLM reasoning.

🧭 Conclusion

Prompting unlocks language understanding; context engineering unlocks agency. By designing structured, stateful protocols—where memory, tools, and feedback are all first-class—you transform an LLM from a passive oracle into an active system participant.

For engineers, the shift is practical: build a context composer, define a safe tool-calling protocol, and wrap it in guardrails. From there, you’re not prompting an AI anymore—you’re collaborating with one.

**From Prompt to Protocol II**