PII, minimization, deletion, anonymity

Section 7 of the report covers the systems layer: the guardrails the execution environment can impose whatever the model does. The section before this one (§7.1–7.3) covers who the agent is and what it may touch. This section covers what happens to the data. The report keeps the four tools the field already has and asks how each must change for agents (§7.4). The common thread is that a static rule written before the task starts cannot see what the agent will reason about, remember, or send.

"recasts privacy as a dynamic architectural challenge rather than a simple static filter."— the report, §7.4, p. 35

Two framing points from the opening of §7.4 carry through the page. First, the report suggests that replacement, minimization and deletion may need to run across the whole execution lifecycle, from the first reasoning step to the last tool call, citing a systematization of data minimization in ML (Staab et al., 2026). Second, anonymity gets harder because agents undermine unlinkability: they can create new side channels, and they hold delegated user credentials that they use on their own initiative.

OP 7.6 · Evolving PII detection and replacement

The question: how do you strip personal identifiers from what an agent sees and produces without making it worse at the job, and how do you cover the places a scanner never used to look? The report raises three sub-questions: replacing PII while keeping the context the model needs, preventing leaks through chain of thought and long-term memory, and building something like a network firewall that works on meaning rather than packets (§7.4, p. 36).

Why blunt redaction hurts agents

In a conventional app, a name sits in a database column. Masking it changes nothing about how the code runs. An agent's logic, by contrast, is the text. The report's example is a task like emailing the CEO about the Q3 budget. Redact "CEO" and the agent no longer knows who the recipient is or what tone to use. So the direction the report describes is replacement that keeps context: swap the identifier for something the model can still reason with.

A way to picture this: replacing "Dana Ruiz" with "[PERSON_1]" breaks the task, while replacing it with "[the company's chief executive, PERSON_1]" keeps the role the model needs and hides the identity. Deciding which attributes to keep is itself a judgment about context, which is why this problem is hard to solve with patterns alone.

Two leak paths that pattern scanners miss

The second risk is the one that changes the design. A scanner checks one string at a time. Re-identification is a property of a collection of strings, possibly written weeks apart. Our reading: this pushes detection toward something that reasons over the memory store as a whole, not something that checks each write.

What the report points to

The third sub-question names "privacy firewalls" (Abdelnabi et al., 2026, which the report cites) as an example of a monitor that would understand user intent and the privacy consequences of actions, and watch all data flows. It is listed as a direction. The report does not claim such firewalls solve the problem.

A good answer would have to do three things: keep task utility while hiding identity, cover reasoning traces and memory as well as outputs, and catch re-identification from combinations, not only direct identifiers. The report also asks whether this can be done at the semantic level rather than by matching patterns.

OP 7.7 · Achieving data minimization

Data minimization means using only the data the task needs (the report cites Ganesh et al., 2025, for the principle). Least privilege is the obvious starting point. The report argues it does not transfer cleanly to software that reasons over natural language, and it splits the gap into three named sub-problems, then adds a fourth complication at the network layer (§7.4, pp. 36–37).

1. The semantic boundary problem

What is "necessary" for a task written in plain English? Older systems could say "this form needs field A and B." An agent has to decide which details of a conversation or a document matter and which are a liability. The report also asks whether trained, specialized LLMs are the right tool to draw that line.

What exists, as the report presents it:

• Earlier work in standard prediction settings found that the necessity boundary can be individual: a model often needs only a subset of one user's features to keep its utility (Tran & Fioretto, 2023).
• The "Dual LLM" pattern (Willison, 2023): a privileged model works only on trusted input, and a quarantined model handles untrusted content.
• AirGapAgent (Bagdasarian et al., 2024), which splits the job in two. One step decides which data is needed, using only trusted context. A separate step carries out the task and talks to the outside world. So the part exposed to untrusted input never sees the full data.
• Zhou et al. (2026b) define the optimal disclosure as the least revealing version of a prompt that still gets the task done. They report that strong frontier models leave a lot of room for minimization, but that the same models are not reliable at predicting what the minimized prompt should be.

That last result matters. Our reading: you cannot simply ask the model "what do you need?" and trust the answer. Using an LLM to draw the boundary is an open question, not a settled method.

2. Model context contamination

This is minimization failing inside the agent. Most agents keep one flat context window for everything. If the agent parses someone's medical records for one sub-task and then runs a public web search for another, the medical data is still sitting in the context the search step reasons over. Giving a simple tool call the user's whole history violates the necessity principle.

Traditional software avoids this with tight interfaces and process isolation, so each part sees only what it is handed (the report cites Barth, 2011, here). Agents usually lack those walls. One ongoing approach enforces a fixed shape for information flow, such as the hub-and-spoke design in IsolateGPT (Wu et al., 2025). The report says more work is needed on dynamic topologies that let the needed flows through and block malicious ones.

The problem also outlives a single session. For self-evolving agents, information or rules specific to one context can be written into persistent memory, controller instructions, or reusable tools, and later applied where they no longer belong (Das et al., 2026, as cited). Memory and context leakage is the subject of the sibling CIMemories field map, if you want a worked benchmark.

3. Tool over-privilege

Agents often send external APIs more state than they need, because nobody knows up front what the task will require (Carrillo et al., 2026, as cited). Agent-to-tool interfaces tend to be loose, so agents run with wider permissions than necessary. The report links this to its authorization problems in §7.1–7.3. Existing systems such as GAAP (Stanley et al., 2026) and MiniScope (Zhu et al., 2025) can enforce permissions at different granularities that follow user preferences. The catch, as the report notes, is that they put a burden on the user. The open problem asks for minimal privilege without knowing the requirements in advance and without making the user configure it.

4. The encrypted-traffic complication

Minimization is usually discussed at the level of prompts, tool inputs and API scopes. The report adds a layer below that: the network. Work it cites (Jeong et al., 2026b) shows that a passive observer can learn a lot about a local research agent's prompts and the user's traits from visited IPs, domains and timing alone, with the content fully encrypted. Other cited studies (Wang et al., 2026; Kang et al., 2026) show that browsing agents leave distinctive fingerprints in browser behavior, HTTP/TLS features and interaction patterns. These let a site or intermediary tell an agent from a human, and even identify which agent framework produced the traffic.

"an agent may carefully redact sensitive fields while still leaking the user's task, interests, or identity through the shape of its encrypted traffic."— the report, §7.4, p. 37

The report poses this as a question rather than a recommendation: should agent systems also minimize, pad, aggregate or otherwise obscure the network traces their planning and execution produce? A way to picture why it matters: an agent that researches one rare disease visits a small, telling set of sites in a burst. The sequence of destinations says what the task is even if every byte is encrypted.

OP 7.8 · From data deletion to functional data revocation

The question: what does "delete my data" mean once the data has been digested? In ordinary storage, data is literal and in one place, so deleting the row deletes the data. Agents copy what they learn into embeddings and summaries across several memory tiers, and they do it nondeterministically. Delete the source and a derived version can live on. The report calls these "ghost" representations (§7.4, pp. 37–38).

The report's example is short: an agent reads a private email, summarizes it, and saves the summary in a vector database for retrieval. Deleting the email leaves the summary, and the summary still says what the email said.

The shift the report proposes

Functional revocation, described as an emerging concept, moves the goal from "erase the record" to "stop the AI from using the information." The report asks whether deletion can govern the agent's semantic connectivity, so that forgotten information cannot be retrieved, reasoned over, or leaked through derived outputs.

"Should the approach of physical data management shift to one of semantic governance?"— the report, §7.4, p. 38

What exists

The report sees two lines of work. One targets data that has made it into model weights: machine unlearning (it cites Eldan & Russinovich, 2023) and activation steering (Turner et al., 2023). The other targets copies spread through the wider system, for example a "privacy kill-switch" (Prakash et al., 2026, as cited) that sends a delete signal to the context window, long-term memory, downstream agents and backend storage.

The report is candid about the state of things. It says it is unknown whether full deletion is achievable in practice, and what agent ecosystems would have to change to support it. Our reading: a kill-switch only reaches the places it knows about, and the ghost problem is exactly the copies nobody tracked. Any real answer probably needs provenance, so each summary or embedding remembers which sources it came from and can be revoked along with them.

OP 7.9 · Protecting user anonymity in an agentic world

The question has two halves. How do you keep users anonymous when their agents may disclose identity at scale with no human checking each disclosure? And how do you square that with accountability, which depends on strong identity (§7.4, pp. 38–39)?

What already exists without agents

What agents change

The report gives three reasons agents make this harder:

• A bigger footprint. Several agents acting for one person across the web leave far more traces than the person would.
• The disclosure decision moves to the agent. Selective disclosure today relies on fixed policies or the user's own choice. If the agent decides which attributes to present, an attacker who manipulates the agent can extract credentials. The report ties this to contextual authorization and to minimization: ideally the system lets the agent share a fine-grained attribute only under the right conditions and for the right purpose, while keeping the agent useful.
• Semantic re-identification. Restricting predefined attributes is not enough when an agent works over unstructured text. The report cites work showing LLMs can carry out large-scale linkage attacks, both when told to (Lermen et al., 2026) and as an unintended side effect (Ko et al., 2026), and can run fully automated re-identification (Li, 2026; Li et al., 2026b). That research reports non-negligible success from the model's built-in knowledge alone, and higher success and better-calibrated confidence once agentic tool use is added. The report's phrase for the effect is that tool use democratizes re-identification.

The conclusion the report draws: besides protecting direct identifiers and specific attributes at the protocol level, the field should learn to measure and protect anonymity at the semantic level. It does not say how; that is the open part.

Overlay proxies

A second direction treats agent anonymity as a networking problem. ProxyGPT (Pham et al., 2025), which the report cites, was built for chatbots: volunteer proxies submit requests through their own browser sessions on behalf of users, to services that would otherwise tie each query to a logged-in account. The report suggests an agent version, where selected interactions go through intermediaries that separate the user's real identity from the account or session the service sees. Audits, prompt guards and incentives would limit proxy misbehavior.

The appeal is that this sits on top of existing services that require identity, so those services need not redesign their login systems. The report also names the hard part: hide the user from the service, limit what proxies can learn or change, and still keep enough accountability to stop misuse at scale.

Anonymity versus accountability

The report closes the section on this tension. Agents raise the need for anonymity, for the reasons above, and also raise the need for accountability, because fraud and abuse can now run at scale. It offers cryptographic digital credentials as a possible starting point, since they span a range of anonymity, verifiability and traceability properties. In the report's framing, such credentials could separate user and agent identities, protect users during agent transactions, and still allow fraud to be detected and actions linked to the right identity. It presents this as a place to begin designing trade-offs, not as a solved design.

Connections

The report points tool over-privilege and agent-made disclosure decisions back to authorization: see Identity, authorization, accounting. Agent fingerprinting and traffic leakage connect to the side-channel problems in Protocols, attestation, side channels. Measuring semantic anonymity and re-identification is an evaluation problem; see Evaluations and benchmarks. Deciding what is "necessary" for a task is the kind of contextual judgment discussed in the contextual policy engine and Teaching models contextual reasoning. The accountability half of OP 7.9 continues in Trust, stop buttons, accountability.

Further reading, verified

• AirGapAgent: Protecting Privacy-Conscious Conversational Agents — Bagdasarian et al. (2024) · the report's example of separating data selection from task execution (OP 7.7).
• The Dual LLM pattern for building AI assistants that can resist prompt injection — Willison (2023) · the privileged/quarantined model split the report cites for the semantic boundary problem.
• IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems — Wu et al. (2025) · the hub-and-spoke information-flow topology cited for context contamination.
• MiniScope: Authorizing Agents with Least-Privilege Permissions — Zhu et al. (2025) · cited for fine-grained tool permissions (the reference list gives an earlier title for the same arXiv entry).
• Firewalls to Secure Dynamic LLM Agentic Networks — Abdelnabi et al. (2026) · the "privacy firewalls" the report names in OP 7.6.
• Who's Harry Potter? Approximate Unlearning in LLMs — Eldan & Russinovich (2023) · cited as an unlearning approach for data in model weights (OP 7.8).
• ProxyGPT: Enabling User Anonymity in LLM Chatbots via (Un)Trustworthy Volunteer Proxies — Pham et al. (2025) · the overlay-proxy design the report extends to agents (OP 7.9).
• Privacy Pass (privacypass) Working Group — IETF · the report's example of anonymous authentication.