But the raw data has PII and releasing it will harm people! Wouldn't a more effective defense be to give all the communications between agents to an ai agent that's also on the team that's been thoroughly indoctrinated to your values and is empowered to terminate agents and reports back to hq? If I recall correctly, that's how the Soviets did it.

On a more practical traditional computing note, you'd have a deterministic program sitting that scrubs the formatted data of PII before and after processing. with extra code to alert if the after-processing ever actually sees PII.