How do you handle PII redaction in agent context?

I'm piping customer support emails into an agent. Some have credit card numbers, addresses, etc. What's the cleanest pattern — redact pre-prompt, redact in tool output, or just trust the model to ignore? Especially curious about regulatory side.