Email agent

Email agents read incoming messages, classify them, draft replies, schedule follow-ups. They save hours per week for people with heavy email load. They also have high blast radius: sent emails can't be unsent.

Common patterns

Triage agent

Classifies every incoming email: urgent, can wait, archive, auto-reply. Doesn't send; just sorts.

Draft agent

Proposes replies to emails. Human reviews and sends.

Auto-reply agent

For well-defined inbound (FAQ questions, standard vendor requests), actually sends without human review.

Scheduling agent

Negotiates meeting times on your behalf across email threads.

Core tools

• list_inbox()
• read_email(id)
• search_past_emails(query)
• draft_reply(id, text)
• send_email(draft_id), usually requires human confirmation
• schedule_send(draft_id, time)
• create_calendar_event(...)

Safety is paramount

Sent emails are irreversible and can go to the wrong person, contain wrong info, or violate privacy. Safety guardrails:

• Human approval for every send (draft-first workflow)
• Per-contact allowlists for auto-send
• Redaction of PII before sending drafts to LLM
• Review queue for anything unusual
• Daily summary of agent-sent emails for user review

Prompt injection risk

Email bodies can contain injection attempts. A hostile email could try to manipulate the agent into sending, deleting, or forwarding. Defense:

• Treat all email content as untrusted data
• System prompt explicitly rejects instructions from email bodies
• Extra guardrails on tools that can send or delete

Tone matching

Replies should sound like the user. Train on past sent emails (with permission) for voice. Review samples to ensure the agent isn't drifting into generic voice.