Data minimization asks which information a task actually requires and avoids supplying or retaining unrelated detail. In an agent system, that can apply to model context, tool inputs, traces and stored work records. Reducing unnecessary copies can reduce the amount of information exposed if another boundary fails.
The principle does not mean discarding evidence needed for a legitimate task or recovery. Required information still needs appropriate protection and a defined lifecycle. Decisions about purpose, access and retention must be made deliberately rather than assuming that all available data should enter every component.
ELI5
Data minimization means collecting and keeping only the information a service truly needs. Information that is never collected cannot later be leaked, misused, or linked with another record.
For example, a service that only needs to know whether a user meets an age requirement can store the verified result instead of retaining a complete identity document and birth date.
Does data minimization mean keeping no records?
No. It means matching the information collected and retained to a defined need, while protecting required evidence.
Why does it matter for agent traces?
Traces can retain prompts and tool results. Avoiding unnecessary sensitive content reduces what those records might expose.
