Enforcing data minimization on CrewAI task context in sequential and hierarchical processes

How context propagates between agents

In a sequential process, tasks run in order and upstream task outputs flow to downstream tasks. If an early task produces a free-text summary that contains identifiers, every task that consumes that output receives those identifiers, whether or not its agent needs them. The exposure grows with each hop because the output is typically placed directly into the next prompt.

In a hierarchical process, a manager agent delegates work and aggregates results. The manager therefore accumulates context from every worker, and it decides what each worker receives. Exposure concentrates at the manager, and delegation instructions can carry more data than a worker's task requires.

The security concern is broader than any one pattern. NIST's draft work on adversarial machine learning identifies agent-visible information, such as user inputs, intermediate results and credentials, as a target for exfiltration. It also notes that compromise can persist beyond a single interaction when an agent keeps long-term memory, and can spread to other agents through inter-agent communication. For minimization, the practical question is what each agent can see at each step.

Where excess data enters agent context

Excess data tends to enter at five points. The table shows how each behaves across the two process types.

• Upstream task output: Sequential: flows to downstream tasks in full unless scoped. Hierarchical: returns to the manager for aggregation and may be forwarded to other workers.
• Delegation message: Sequential: not applicable, because order is fixed. Hierarchical: the manager composes what each worker receives and can over-share.
• Tool input: Both: arguments composed by the agent can include fields the tool does not need.
• Tool output: Both: returned records enter the next prompt, including fields no task asked for.
• Memory: Both: stored content can persist across interactions and be recalled into prompts for unrelated tasks.

Design-time controls and their limits

Start by narrowing what flows. Scope task context explicitly so each downstream task receives only the upstream outputs it depends on, rather than everything produced so far. Define structured outputs so a task returns only the fields later tasks need, using tokens, identifiers or aggregated values where raw values are not required. NIST AI RMF 1.0 recognizes de-identification and aggregation as data-minimizing methods, and it also notes that privacy-enhancing techniques can reduce accuracy under conditions such as data sparsity, so test task quality after each change.

In hierarchical processes, set delegation boundaries. Limit which workers the manager can delegate to, and give each worker only the tools its role needs. NIST's agent identity design tenets describe delegation and attenuation: narrow what a delegated agent can access instead of trusting the reasoning engine to limit itself. Wrap tools so they accept only required parameters and return only required fields. Enable memory only where a task needs it, and keep sensitive fields out of what is stored.

These controls have a shared limit. They define what the application intends to pass, but they do not inspect the content of the prompt or tool call that is actually assembled. A free-text field in a schema can still carry an identifier, and a prompt instruction telling an agent to ignore sensitive data is a convention, not an enforced property.

Where design-time ends and runtime begins

Design-time controls end where content is assembled. Context scoping and schemas decide what should be available. Runtime enforcement decides what actually crosses into a prompt or a tool call, and it records the decision. The two are layers, not alternatives. NIST's planned AI overlays for SP 800-53 likewise assume foundational controls such as access control and configuration management are already in place.

Expect tradeoffs. Redaction and de-identification can lower task accuracy, and a block can stop a task that depended on the removed data. Run representative tasks through each policy, record the effect, and adjust the schema or policy where quality drops. Several of the NIST publications referenced here are drafts, so confirm their current status as of November 2026.

Trussed produces audit-ready evidence from enforcement, mapped to HIPAA, NAIC, NYDFS, EU AI Act and NIST, which gives a regulated enterprise a per-interaction record of what was allowed, redacted or blocked. A sound first step is to inventory what each agent sees at each step, scope context for the highest-risk task, and place enforcement on that task's model and tool calls.