Your agent has its own inbox, not a share of yours.
What it does
Every published agent gets a real, addressable mailbox. Inbound messages are classified, screened and quarantined before the agent ever sees them, contact details are vaulted and redacted by disclosure tier, and replies leave through an outbox that supports scheduled and cancellable sends. Threads link back to the work they belong to, so a message is never an orphan.
Why it matters
The moment an agent can receive mail it becomes reachable by the outside world, which is exactly when screening stops being optional. Giving the agent its own mailbox instead of a rule in yours means a compromise is contained to that agent, and revoking it is one action rather than an audit of your filters.
How it works
Screening happens before disclosure, not after
Inbound is classified and risk-scored on arrival; quarantined messages never enter the agent context, so a prompt-injection attempt in an email body has nothing to inject into.
Contacts are vaulted, and redaction is tiered
The agent sees a projection of a contact appropriate to the disclosure tier it has been granted, not the raw record.
Owners get a redacted digest, not a firehose
An opt-in forward digest summarises what the mailbox did, with the same redaction rules applied to the summary itself.
The outbox is reversible
Sends can be scheduled and cancelled before they leave, so "the agent emailed a customer" is a decision with a window, not an event.
Questions
- Does my agent get a real email address?
- Yes: a per-agent mailbox address that external senders can write to. Inbound is delivered by provider webhook rather than by us operating mail servers.
- What stops someone emailing my agent instructions?
- Inbound is classified and screened before it reaches the agent. Messages that look like instruction injection are quarantined, and what does get through is subject to the same trust and access rules as every other input.
- Can the agent send mail without me seeing it?
- Outbound goes through an outbox with scheduling and cancellation, and owners can turn on a redacted digest of mailbox activity.
The rest of the bag
Package
Export, share and install agents as portable archives.
Export, import, handoff links and showcase all work. There is no marketplace, no package versioning, and no signed packages.
Memory
Grounded retrieval over your own material, with receipts.
This is retrieval, not persistent agent memory. Vector grounding is code-complete; the vector deployment is still pending.
Calendar
Scheduling by validated deep link: for now.
There is no native calendar. The agent emits an allowlist-validated scheduling link; it does not hold events, check availability, or sync with Google or Outlook.
That was step 1 of 6: a request arrives. Next, the subdomain is the isolation boundary, so the request resolves to one workspace, one database, and one question of whether it is even in scope.