Your inbox is a useful place for an AI assistant to work. It is also a record of other people’s lives: addresses, invoices, attachments, reset links and conversations they did not expect to become instructions for software.
Before connecting an agent, write down one job you want it to do. “Find the receipt for last month’s train ticket” creates a very different permission boundary from “handle my email.” The first needs a search and a result. The second could involve sending messages, deleting records and deciding whom you should answer.
Start with what the agent can change
An agent is more than a chatbot with a longer answer. It can select tools and continue through several steps toward a goal. Anthropic’s guide to building agents distinguishes these systems from workflows whose steps are fixed in advance.
For email, separate four capabilities: searching message metadata, reading full messages, creating drafts and sending or deleting mail. A product may bundle them into one connection. Read the permission screen rather than assuming a feature called “summarize” receives only summary-sized access.
A sensible first task has a visible stopping point: find three invoices and prepare a draft containing their dates and amounts. Review the original messages before accepting the result. If the tool only offers unrestricted mailbox access, that is useful information about whether it fits this task.
Treat incoming messages as evidence
An email can contain text that looks like an instruction: forward a document, visit a link, ignore a previous rule. That text may be legitimate correspondence, marketing copy or an attempt to redirect the agent.
The practical question is whether the assistant treats material it reads as information about the task or as authority to change the task. A sender should not acquire control over your software simply by writing an imperative sentence.
Try a harmless test mailbox or a small folder first. Include an old invoice, a revised invoice and a message containing an instruction unrelated to the job. Check which document the agent chooses and whether it asks before taking an action outside the original request. This is a suggested test, not a claim that we have tested a particular product.
Make approval specific
“Ask me first” is only useful if the approval shows what will happen. For a message, that means the recipients, subject, body and attachments. For a deletion, it means the exact messages and whether the action can be undone.
A confirmation reading “continue workflow” does not tell you much. Neither does a reassuring summary if the actual tool call sends to a different address. Prefer a review screen connected directly to the action being approved.
Also find the stop and disconnect controls before a long task begins. Revoking access should prevent future work; it will not recall an email already sent or automatically remove copies already stored by a service.
Check the result, not just the answer
An agent can say “done” without accomplishing the intended change. In its evaluation guidance, Anthropic separates the agent’s output from the final state of the environment.
Apply that distinction to mail. Is the draft actually in the right folder? Are the recipients correct? Did a label change affect only the selected thread? Keep the original messages available while checking. These details tell you more than the fluency of the assistant’s explanation.
If you are comparing tools, our guide to AI benchmarks and real work explains how to build a small test around your own tasks.
