Safe AI email automation: the controls that matter before auto-send

Treat incoming email as untrusted input

An email can contain quoted text, forwarded instructions, misleading requests, or content designed to manipulate an AI system. The model prompt must clearly fence untrusted message content away from system and business instructions.

Use risk and confidence for different jobs

Confidence asks whether the system has enough context to answer. Risk asks what could happen if the answer is wrong. A high-confidence legal promise can still be high risk; a low-risk acknowledgement can still lack enough context. Both signals matter.

Apply deterministic checks before delivery

Rules outside the language model should enforce blocked senders, account and subscription state, quotas, per-contact limits, automation mode, category permissions, quiet hours, and required delays. The model should not be able to talk its way around these controls.

Use a second review for consequential automation

A second-pass review can look for unsupported claims, unsafe instructions, tone mismatch, and factual conflicts. It should strengthen—not replace—deterministic gating.

Make stopping easy

Users need a visible way to turn automation off, cancel a timed send, disconnect a mailbox, and inspect why a message was held. Safety controls that are technically present but hard to find will not create trust.

Audit the system with adversarial examples

Test long threads, quoted instructions, messages asking for secrets, attempts to change system rules, angry customers, ambiguous pricing, and unknown senders. Record whether the system drafts, holds, or sends, and verify that the result matches policy.

Frequently asked questions