Privacy controls for persistent, tool-using agent workflows

Engineering teams using coding agents to investigate customer incidents should test durable workflow artifacts as well as model inputs. Custodian Labs places PII handling before the model call, while Sepo writes exchanges into issues, pull requests, comments, and an agent/memory branch. The Qwen pilot also found clearer implementations when privacy requirements distinguished received, stored, logged, and disclosed fields. Together, these sources indicate that a model gateway can protect the call while raw data remains in the repository record or transformed data is later copied into memory.

Add stable synthetic canaries to a test issue, run the answer–implementation–review workflow, and scan the issue thread, progress comments, pull-request diff, logs, model request, and memory branch. The transformation map should remain outside the repository, and the report should identify the first surface on which each canary was masked or replaced. This inexpensive end-to-end check would show whether the control covers the actual workflow rather than only the provider boundary.

Teams automating Gmail, GitHub, or Notion actions need to prevent privacy transformations from changing the intended account, recipient, or record. Custodian Labs can replace PII with synthetic equivalents or typed labels before model use; Tripplet lets an agent read and act through scoped, revocable application connections. A representation that preserves enough meaning for reasoning may still be unsafe as an execution identifier: a synthetic email can select the wrong recipient, while a masked address cannot identify one at all.

Keep planning and execution identities separate. The model should work with stable aliases, while a policy-controlled executor resolves an alias to the real application identifier only after checking the requested action, scope, and any required user confirmation. The alias map should not enter model context or persistent memory. A small evaluation using duplicate names, renamed contacts, revoked access, and synthetic email addresses can compare intended with actual targets while checking that raw PII never appears in the model trace.