An inbox is a queue with no owner. The useful automation is not "reply to my email" — it is "sort the queue, draft the routine ones, and leave the judgement to me."
The distinction matters because the failure modes are completely different. A filing mistake costs nothing. A wrong reply to a client costs a relationship. So the design rule is simple: the agent may classify and draft; only a human sends.
Step 1 — classify before you generate
Before the agent writes anything, have it place each message in one of a small number of buckets. Five is plenty:
- Routine, answerable from a template — confirmations, receipts, scheduling, "did you get my message"
- Needs information only a human has — pricing, commitments, anything with a number in it
- Needs no reply — notifications, newsletters, receipts to file
- Urgent — a client with a problem, a legal or regulatory deadline
- Uncertain — everything the agent cannot confidently place
The fifth bucket is the one that makes the whole thing safe. An agent forced to choose between four options will guess. An agent given an explicit "I do not know" will use it, and you can then review only that bucket and measure whether it is shrinking.
Step 2 — file, do not reorder the inbox
The temptation is to have the agent move things around into folders it invents. Resist it. Folder taxonomies drift, and a customer's message in the wrong folder is invisible.
Better: leave the message where it is, and write the classification onto the record — a label, a tag, a row in a log. The inbox stays familiar, and you keep a queryable history of what the agent decided.
This also gives you the measurement that matters: the distribution across buckets over time. If "uncertain" is 40% in week one and 12% in week six, the agent is learning your business. If it is stuck at 40%, the taxonomy is wrong, not the model.
Step 3 — drafting, with the right defaults
When the agent drafts, three rules keep it out of trouble:
- Draft into the draft folder, never send. This is not caution, it is the entire safety model. A human pressing send is the last mile, and it is cheap.
- Quote the source. The draft should make clear which facts it used. If it invents a delivery date, you want to see that it invented it before you send.
- Stay inside the template. Routine replies should be short and boring: acknowledge, answer, next step, sign-off. Personality goes in the messages you write yourself.
A draft that needs heavy rewriting is worse than no draft, because it costs you the reading time and then the writing time. Measure it: if you rewrite more than a third of drafts, the templates are wrong.
Step 4 — the guardrails that actually matter
Four, in order of how much damage their absence causes:
No sends. Already covered, and never negotiate it away for convenience.
No new addresses. The agent replies to the sender on the existing thread. It does not add recipients, does not cc anyone, does not forward. New recipients are how a misclassification becomes a data leak.
No attachments. An agent that attaches files from a drive will eventually attach the wrong one. If a reply needs a document, a human attaches it.
No credentials in the prompt. The agent gets access to the mailbox through a scoped token, not by being told a password. Anything in a prompt is in a log.
Step 5 — review the uncertain bucket, then shrink it
Start with a daily review of bucket five. Fifteen minutes, looking for patterns: the same kind of message misclassified three times is a missing rule or a missing template.
Two rules for the review:
- Never fix a single message. Fix the category. One-off corrections do not compound; a new rule does.
- Log every correction. The log is what turns "the agent is a bit off" into "the agent is wrong on invoice queries specifically," which is a fixable statement.
What good looks like
- Drafts appear in the draft folder within a few minutes of arrival
- You send most drafts with light edits or none
- The uncertain bucket trends down over weeks, not days
- You have not once had to apologise for something the agent sent, because it never sent anything
The honest limit
This saves reading and typing time. It does not save the decision. You still read every message you send — you just start from a draft instead of a blank box.
Anyone selling you an inbox agent that "handles email for you" is selling the thing that sends. Start with the thing that drafts; add trust slowly, and only with evidence.