Who decides what content leaves an agent's traces?

Instrumentation does. A span only ever carries what the code emitting it decided to put there, so the moment a prompt, a model’s output, or a tool’s arguments get attached to a span is the moment someone made a call about what’s allowed to leave the process. If that content includes something you don’t want stored downstream, a customer’s email address, an API key sitting in a tool result, it has to be stripped before the span is exported, because once it’s on the wire it’s out of your control. The common pattern is a redaction rule running in the OpenTelemetry Collector’s redaction processor, matching known patterns like emails or secret prefixes and replacing them before the batch leaves your infrastructure, rather than trusting every downstream receiver to redact consistently on its own.