01
Read only
The agent can list inboxes and threads and read message bodies. It has no tool that can produce mail — the send tool is not even listed to it.
Product
Decide what the agent may send
Permission levels, an approval queue bound to the exact draft, recipient rules, and one switch that stops everything.
The interesting failure mode is not an agent that cannot send email. It is an agent that sends the wrong email to the wrong person, confidently, at three in the morning. These are the controls that exist in the application code to make that a decision rather than an accident.
Three levels of access
A grant covers named inboxes, not a workspace. Authority is re-derived on every request and intersected with the authorising human's current permissions, so a grant can only ever shrink.
02
Read and draft
The agent composes, and a person releases. A draft cannot transmit mail; the send scope is stripped from the credential the draft path runs under.
03
Read and send
The agent can transmit — but still through the inbox policy. A send-capable credential does not override a rule that says hold this one.
Approval is bound to the exact draft
Approving is not granting. It authorises one message, with that body, to those recipients.
-
You see what you are approving. Recipients, the full content, the reason the message was held, and the exact draft version.
-
Edits invalidate the approval. The decision is tied to a hash of the payload. If the content changes after you approve, the send fails with a version conflict rather than going out as something you never read.
-
Requests expire. An approval request that nobody answers within 7 days lapses instead of sitting there indefinitely.
-
Rejecting is a first-class outcome. Reject with an optional note; the agent gets an event, not silence.
Why a message gets held
Each inbox has its own Sending controls. When a send is intercepted, the API and the console return the reason code, so an agent can act on it rather than guess.
send_disabled- Outgoing mail is paused for the whole project.
blocked_recipient- The recipient is on the inbox's block list.
recipient_not_allowed- An allow list is set and this recipient is not on it.
always- The inbox holds every outgoing message for review.
new_recipient_domain- First message to this domain from this inbox.
attachments- The message carries one or more attachments.
Owners and administrators can also set a daily cap on live recipients, and pause outgoing email for an entire project in one action. Direct sending stays the default for a send-capable credential until a policy asks for review.
Taking access back
Revocation is a normal operation, not an incident procedure.
Agent grants
Revoke a connection under Connections. Grants also expire on their own after 30 days, so an abandoned integration stops working rather than lingering.
Replaying a refresh token revokes the whole grant, on the assumption it was stolen.
API keys
Revoke a key under Developers. Secrets are digested and shown once, so a leaked key is replaced rather than recovered.
Requests presenting a revoked credential lose access on the next call.
The whole project
Pause outgoing email for the project. Mail keeps arriving and stays readable; nothing leaves.
Every send attempt during a pause comes back as send_disabled.
What these controls are not
These are application permissions, not a guarantee that an agent will make good decisions. Nothing written in an inbound message can widen a grant — scopes are re-derived from the database on every request — but an agent can still be argued into a bad draft, and we make no claim to be prompt-injection proof. Choose the client you authorise and the recipients you allow with that in mind, and keep review switched on where a wrong message is expensive. What the code enforces, in full.
Guides about permissions and approvals
AI Agent Hallucinated an Email Address? Fix the Source
An AI agent's hallucinated email address either bounces or reaches a stranger. Take recipients from records, not model output, and gate the rest.
Restrict Which Domains Your Agent Can Email
Restrict which domains your agent can email with an allowlist it cannot argue with: the policy call, how recipients match, and what a denied send returns.
Monitor Every Email Your Agent Sends
How to monitor what emails my agent sent: four alerts built only from events that actually fire, and why two obvious ones would stay green forever.
How to Revoke an Agent's Email Access Instantly
How to revoke an agent's email access: five kill switches ranked by blast radius, the exact calls, and what happens to mail already queued or held.
Stopping an Infinite Agent Auto-Reply Loop
Four stopping rules that end an agent email loop with an auto responder: a thread reply budget, auto-reply signals, a sender window, and an approval gate.
Export an Agent's Email History, Then Deactivate
Export agent email history as NDJSON, verify the checksums, then deactivate the project, knowing the deletion job erases no stored mail.
MCP Tool Filtering Should Be Required
MCP lets a server hide tools a token cannot use but never requires it. The case for mcp tool filtering by scope as a MUST, and the objections.
The Agent Email Threat Model
Assets, actors, trust boundaries and eight threats for an agent with an email address, with the layer where each control binds and where ours stops short.
Read-Only Email Access for an AI Agent
Read-only email access for an AI agent is five scope strings. The exact list, what the MCP session holds, and three ways the grant quietly leaks.
Agent Email Audit Trail: What to Log
The eight fields an agent email audit trail needs, which ones a second party can corroborate, and the ones this build records but never hands back.
Scoped Credentials for Agent Email: Read, Draft, Send
Give an agent the smallest useful email permission: project and inbox scoping, one-time secrets, draft-only grants, rotation, and revocation you can verify.
Human Approval Before an AI Agent Sends Email
When to require review, why approval binds to one exact draft version, how recipient rules and daily caps work, and what editing a draft does to its approval.
The MCP Tool Surface Is the Permission Boundary
How the MCP tool surface permission boundary is computed per request, what a filtered tools/call returns, and three ways the tool list shrinks under you.
Prompt Injection by Email: What Actually Helps
Any stranger can email your agent. What an email-borne injection looks like, why message text must never grant permission, and the controls that limit damage.