Drafting Requirements and Design Documents for Security Training and Phishing Drills: Context and Token

Daily documents for this category include training slides, drill plans, phishing email templates, and drill result reports. Data sources typically

What data for this category looks like

Daily documents for this category include training slides, drill plans, phishing email templates, and drill result reports. Data sources typically include employee contact lists, email gateways, internal training platforms, and drill behavior click statistics. Most updates occur quarterly or annually. Core documents include drill audience tags, email trigger rules, and review statistics fields. Core daily processing steps involve audience filtering, template design, and result review. Data links include personnel information, email sending records, and training completion status.

What constraints these characteristics impose on context and token handling

Documents in this category include unstructured training materials and structured drill reports. Data links to multi-dimensional personnel and behavior tags, which occupy significant context space. Quarterly or annual update cycles mean context does not need frequent refreshing, but a single call must cover full drill cycle data. Audience filtering and template design require precise matching of personnel tags. If context token limits are exceeded, core audience rules and template variables cannot load completely. Additionally, multi-field statistics in review reports require stable token quotas. Insufficient tokens can cause review data truncation, which affects the integrity of audit evidence.

How to set configurations

This configuration is based on FastGPT v4.17.0.

Configuration ItemRecommended RangeRationale
maxContext8000–12000 tokenCovers all core content of plans, slides, and review reports required for a single drill round, and matches the average length of documents for this category
quoteMaxToken1500–2000 tokenMatches the core fragment length of single phishing email templates and drill result reports, avoiding excessive quota usage from redundant data
Single retrieval limitTop 3 entriesCore data for this category is mostly aggregated by drill cycle; a small number of retrievals covers key audience and behavior tags
Context refresh ruleTriggered quarterlyMatches data update frequency to reduce unnecessary token consumption
Context cleanup thresholdAutomatically clear oldest non-core records when context exceeds 10000 tokenPrevents core rule loading failures caused by exceeded token limits

Three common misconfigurations

  • Issue: Configured maximum reference token is 1500 token, but retrieved chunks still exceed this limit. Cause: Did not link knowledge base chunk size to context token quotas. When chunk size is set to 5000 token, a single retrieval result already exceeds the reference limit, leading to higher-than-expected token usage.
  • Issue: Cannot view token usage for a single question-and-answer session. Cause: Did not enable token statistics logging in system settings, or did not configure a log export path.
  • Issue: Context history records cannot be cleared according to rules. Cause: Did not bind trigger conditions to the context cleanup node, or trigger conditions did not match the drill cycle end time node.

How to confirm configurations are correct

  • Navigate to the context and token configuration page in system settings, and verify that the values of maxContext and quoteMaxToken match the document length for the current drill cycle.
  • Send a simulated phishing drill question-and-answer request, and check that the returned content includes complete drill plans and audience tags without truncation.
  • Check the log system to confirm that token usage for each question-and-answer session does not exceed the configured maximum context limit.
  • Trigger a drill cycle end event, and verify that context history records are cleared according to rules.

The values provided are common starting points and should be measured against the reader's own samples.

Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.