--- title: The Agent Needs Identity. The Model Does Not. | daily.dev description: A case study demonstrates an architecture where a Phoenix LiveView support agent keeps raw customer identity (emails, phone numbers, names) inside the... canonical: https://daily.dev/posts/the-agent-needs-identity-the-model-does-not--5tla5jnnb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Agent Needs Identity. The Model Does Not. | daily.dev og:description: A case study demonstrates an architecture where a Phoenix LiveView support agent keeps raw customer identity (emails, phone numbers, names) inside the... og:url: https://daily.dev/posts/the-agent-needs-identity-the-model-does-not--5tla5jnnb og:image: https://api.daily.dev/og/posts/5tLA5jNNB.png og:image:alt: The Agent Needs Identity. The Model Does Not. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Agent Needs Identity. The Model Does Not. **[ElixirStatus](https://daily.dev/sources/elixirstatus)** · 13 min read · 1 upvotes · 0 comments ## Summary A case study demonstrates an architecture where a Phoenix LiveView support agent keeps raw customer identity (emails, phone numbers, names) inside the application, while the Jido agent framework and OpenAI's model only ever see stable pseudonyms generated by a library called Obscura. The write-up walks through every place personal data could leak in an agent workflow beyond the initial prompt: tool arguments, tool results, streamed responses, credentials, and logs/telemetry. A trusted tool restores a raw email only briefly for a local lookup, then re-protects the result before returning it to the model. Streaming responses stay tokenized until the final answer is restored client-side. OpenAI API keys are stored as opaque references and resolved only at the Finch HTTP layer. The demo includes tests verifying no raw values leak through any of these boundaries, while explicitly noting limits: it doesn't provide authorization, DLP, or regulatory compliance, and can't stop a model from generating new sensitive values outside the vault. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I prevent an LLM agent from receiving raw customer PII when it calls tools that look up customer records? Replace raw identifiers with stable pseudonyms before the prompt reaches the model, then have trusted tools restore the raw value only briefly for the local lookup and re-protect the result before returning it to the agent. This keeps the same token (like an email placeholder) consistent across the prompt, tool arguments, tool results, and model answer, so the model can correlate the customer without ever seeing the real value. _Teams building PII-safe LLM agent pipelines can follow architecture write-ups like this on daily.dev._ ### Why shouldn't I just redact PII completely instead of pseudonymizing it in an LLM agent workflow? Permanent redaction removes the reference a tool needs to perform a lookup, breaking the workflow, while a stable pseudonym preserves the relationship across steps. For example, a token like an email placeholder can appear consistently in the user request, tool argument, tool result, and model answer, letting the model correlate the same customer across multiple steps without ever receiving the actual email address. _Developers weighing redaction versus pseudonymization for agent pipelines can track approaches like this via daily.dev._ ### How do you stop an LLM agent from leaking an API credential like an OpenAI key through agent state or tool calls? Store the real key in a private ETS table on a single process, and pass only an opaque reference plus a placeholder authorization header through the agent and tool layer. A dedicated adapter resolves the real key and swaps in the actual authorization header immediately before the request reaches an approved host and path, and it rejects requests if the reference has expired or the destination isn't approved. _Engineers securing credentials in agent-to-provider request paths can follow patterns like this on daily.dev._ ## Similar posts on daily.dev - [AI Agents Are Not Users: Building an AI Agent Identity Model](https://daily.dev/posts/ai-agents-are-not-users-building-an-ai-agent-identity-model-0gmsbkuop) · Auth0 · 1 upvotes · 0 comments - [Why AI Agents Need Their Own Identity, Not Yours](https://daily.dev/posts/why-ai-agents-need-their-own-identity-not-yours-eoi0qehm1) · The New Stack · 3 upvotes · 0 comments - [AI Agents Authentication: How Autonomous Systems Prove Identity](https://daily.dev/posts/ai-agents-authentication-how-autonomous-systems-prove-identity-ynnf7lwlb) · GitGuardian · 0 upvotes · 0 comments - [Two AI Stories, One Enterprise Trust Question](https://daily.dev/posts/two-ai-stories-one-enterprise-trust-question-wssgsp3pg) · Kilo Blog · 2 upvotes · 0 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents), [#data-privacy](https://daily.dev/tags/data-privacy), [#elixir](https://daily.dev/tags/elixir), [#liveview](https://daily.dev/tags/liveview) [View this post on daily.dev](https://daily.dev/posts/the-agent-needs-identity-the-model-does-not--5tla5jnnb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Agent Needs Identity. The Model Does Not.","url":"https://daily.dev/posts/the-agent-needs-identity-the-model-does-not--5tla5jnnb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-agent-needs-identity-the-model-does-not--5tla5jnnb"},"datePublished":"2026-08-20T21:54:32.238Z","dateModified":"2026-09-13T18:56:34.258Z","description":"A case study demonstrates an architecture where a Phoenix LiveView support agent keeps raw customer identity (emails, phone numbers, names) inside the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ced015358b1abb0e652df7c85106ebcd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ced015358b1abb0e652df7c85106ebcd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ElixirStatus","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ElixirStatus","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/22e4640538124187827caf8cc8e39190","url":"https://daily.dev/sources/elixirstatus"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-agent-needs-identity-the-model-does-not--5tla5jnnb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"llm,ai-agents,data-privacy,elixir,liveview","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ElixirStatus","item":"https://daily.dev/sources/elixirstatus"},{"@type":"ListItem","position":3,"name":"The Agent Needs Identity. The Model Does Not."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-agent-needs-identity-the-model-does-not--5tla5jnnb#faq","mainEntity":[{"@type":"Question","name":"How can I prevent an LLM agent from receiving raw customer PII when it calls tools that look up customer records?","acceptedAnswer":{"@type":"Answer","text":"Replace raw identifiers with stable pseudonyms before the prompt reaches the model, then have trusted tools restore the raw value only briefly for the local lookup and re-protect the result before returning it to the agent. This keeps the same token (like an email placeholder) consistent across the prompt, tool arguments, tool results, and model answer, so the model can correlate the customer without ever seeing the real value. Teams building PII-safe LLM agent pipelines can follow architecture write-ups like this on daily.dev."}},{"@type":"Question","name":"Why shouldn't I just redact PII completely instead of pseudonymizing it in an LLM agent workflow?","acceptedAnswer":{"@type":"Answer","text":"Permanent redaction removes the reference a tool needs to perform a lookup, breaking the workflow, while a stable pseudonym preserves the relationship across steps. For example, a token like an email placeholder can appear consistently in the user request, tool argument, tool result, and model answer, letting the model correlate the same customer across multiple steps without ever receiving the actual email address. Developers weighing redaction versus pseudonymization for agent pipelines can track approaches like this via daily.dev."}},{"@type":"Question","name":"How do you stop an LLM agent from leaking an API credential like an OpenAI key through agent state or tool calls?","acceptedAnswer":{"@type":"Answer","text":"Store the real key in a private ETS table on a single process, and pass only an opaque reference plus a placeholder authorization header through the agent and tool layer. A dedicated adapter resolves the real key and swaps in the actual authorization header immediately before the request reaches an approved host and path, and it rejects requests if the reference has expired or the destination isn't approved. Engineers securing credentials in agent-to-provider request paths can follow patterns like this on daily.dev."}}]} ```