Build a Privacy Filter Before Your AI Agent Remembers User Actions

AI agents are increasingly remembering user actions such as clicks, typed text, app switches, browser context, files, tool calls, and workflow history. This memory can enhance an agent's usefulness but also poses privacy risks. To mitigate these risks, it is crucial to implement a privacy filter that processes user activity before it becomes part of an agent's memory.

Recent AI tooling trends indicate that agents are expanding beyond chat boxes to include operating systems, browsers, IDEs, customer support tools, analytics dashboards, and workflow automation platforms. As agents become more useful, they require more context, leading to an engineering challenge: balancing the need for context with privacy considerations.

The primary goal of an AI agent privacy filter is to capture the smallest event stream necessary to help the user while ensuring the protection of sensitive information. This filter should perform five key functions: allowlisting, sensitive data detection, purpose binding, retention control, and retrieval control.

The first step in implementing a privacy filter is to classify the event stream into different categories based on their risk level. For example, navigation events may be low risk and can be stored with redaction, while user typed text is considered high risk and should not be stored without explicit redaction. Once events are classified, the filter should reduce the event data before running any PII detection algorithms.

This reduction process involves removing unnecessary details such as full URLs, DOM text, and sensitive information like card numbers and emails.

After reducing the event data, the privacy filter should detect sensitive information using multiple detectors beyond simple regex patterns. This includes identifying email addresses, phone numbers, access tokens, API keys, session cookies, credit card details, and other potentially sensitive data. By detecting and redacting sensitive information early in the process, the filter minimizes the amount of personal data stored in an agent's memory.

Finally, the privacy filter should enforce retention and retrieval controls. Retention policies determine how long raw or redacted events can be stored, while retrieval controls restrict who can access the stored data. For instance, raw traces may have a short retention period of 48 hours, while redacted task summaries could be retained for up to 30 days. Retrieval controls ensure that only authorized users, tenants, roles, and task types can access the memory, thereby preventing unauthorized access to private data.