An agent assists with employee onboarding. During a session, it learns the employee's name, job title, start date, department, manager name, and salary band. The agent is designed to support this employee in future sessions as well. Applying strict data minimization principles, which data should be retained in long-term memory for future sessions?
Select an answer to reveal the explanation.
Short Explanation
Data minimization means you keep only what you actually need. Job title and department help tailor future onboarding, while name and manager can be pulled from HR on demand, start date is a one-time fact, and salary band stays out of long-term memory.
Full Explanation
Data minimization — a foundational principle in frameworks like GDPR and NIST Privacy Framework — requires retaining only data that is necessary for the stated purpose and no longer than that purpose requires. The correct approach is to retain only job title and department, because those are durable facts the agent needs to customize onboarding content in future sessions, such as routing an engineer to engineering-specific resources versus a sales hire to CRM training. Name can be retrieved from the HR system directory at session start, so it is not a fact the agent uniquely possesses, and retrieving it on demand avoids creating a duplicate personal data store. Manager name falls into the same category. Start date is a one-time onboarding milestone; once onboarding is complete, it has no ongoing utility in the memory store and should not be retained. Salary band is sensitive financial data subject to strict access controls, and storing it in a general-purpose agent memory store violates least-privilege principles and creates unnecessary exposure risk. The approach that retains all information collected during the session is wrong because blanket retention violates data minimization, and maximizing personalization is not a legitimate basis for retaining every piece of employee data collected. The approach that retains everything except the salary band is wrong because it treats salary as the only sensitive field; name, manager, and start date all carry privacy implications and should either be excluded or retrieved on demand rather than persisted. The approach that retains nothing and retrieves all context fresh from HR systems at the start of every future session is wrong because it swings too far in the other direction, increasing latency, API dependency, and system complexity without a proportionate privacy benefit, while retaining non-sensitive utility data like job title and department is entirely appropriate.