Start with the purpose
The system should retrieve the minimum context required for the current task and audience. Purpose limitation is easier to enforce when context is structured and scoped rather than copied into one large shared knowledge base.
Reduce persistence by default
Sensitive working context should not become permanent simply because an agent used it once. Retention periods, redaction and separation between operational evidence and source data should be deliberate architectural choices.
Keep people visible
Individuals need to know when an automated system is acting, what information it can use and how a consequential result can be reviewed. Privacy and human oversight reinforce one another.