How to let an AI agent send emails from a shared mailbox

Grant sending by message type, not by mailbox. An agent can send templated replies on existing threads to the original sender at depth 3, once certified. New threads, forwards, attachments outside the approved set and any new recipient are drafted for a person. Changing mailbox rules is refused, and every message sent carries the template, the sources and the verdict.

What makes a shared mailbox different?

A shared mailbox speaks for a team, not a person. Customers and suppliers write to "payments@" or "operations@" and expect a consistent answer whoever replies. That consistency is what makes it a good place for an agent, and also what makes mistakes expensive: a wrong reply comes from the firm, under the team's name, and the recipient has no reason to doubt it.

The team lead owns the mailbox and its standards. IT owns its configuration: who may send as the mailbox, its forwarding rules, its retention. Compliance often owns the rules for what may be said in writing to customers. Before an agent sends anything, someone should have decided what it is replying to, which is the work in triaging a shared operations mailbox.

Which permissions should the agent get, and at what depth?

1. Agent, depth 1: reads the mailbox and the systems it needs to answer, such as the payments or case system.
2. Agent, depth 2: drafts replies to any message within its job, for a person to review and send.
3. Agent, depth 3: sends templated replies on existing threads to the person who wrote, where the reply type is certified: a status update drawn from the case system, an acknowledgement, a request for a missing document listed in the template.
4. Agent, depth 2: starts new threads. Outbound messages to someone who has not written in, even a known contact, are drafted.
5. Agent, depth 2: adds recipients. Anyone not already on the thread, including a colleague, is a person's decision.
6. Agent, depth 3: attaches files from approved sources only, such as a statement generated by the system of record. Other attachments are drafted.
7. Agent, depth 2: forwards messages outside the team. Forwarding sends someone else's words, often with personal data, to a new audience.
8. Refused for the agent: creating or changing mailbox rules, auto-forwarding, changing the mailbox's permissions, and deleting messages.

Why does "existing thread, original sender" matter so much?

It is the simplest check that the agent is answering someone who asked. A reply to the sender of the message cannot leak information to a stranger, as long as the sender is who the case system says they are. Every widening breaks that guarantee. Reply-all can reach people copied by mistake. A new recipient can be a typo. A forward sends the thread to a new audience.

Check the sender too. If the case system records a customer's email and the message came from a different address, even a similar-looking one, the agent treats it as unverified and drafts rather than sends. Lookalike domains are a common route for payment fraud through shared mailboxes.

Should the agent send without anyone reviewing?

Only for reply types that have been certified at depth 3, and only after a period of drafting where reviewers rarely change the text. The argument for and against is set out in whether an AI agent should be allowed to send emails without review. The short version: a reply type earns depth 3 by evidence, and loses it the day a run fails.

What is recorded?

Every message sent, as sent: recipients, subject, body, attachments, the template used and the thread it replied to. The mailbox's own sent folder can be edited or purged; the agent's record cannot.

The sources behind each statement. "Your payment was released on Tuesday" should trace to the payment record. If it traced to an inbound email, it would be external and should never have been stated as fact.

Drafts and their reviewers, including what the reviewer changed.

Refused and held actions, with the bound that decided. An attempt to add a recipient shows as held for a person.

What should you measure?

• Reviewer edits to drafts, by reply type, before and after any widening.
• Customer follow-ups saying the reply was wrong or did not answer.
• Unverified senders detected, and how many were attempted fraud.
• Time to first reply on the threads the agent handles.

Where does it usually go wrong?

Auto-replies talk to auto-replies. The agent answers an out-of-office, which replies again. Detect automated messages and do not reply to them.

The template grows prose. Teams add "kind regards" variants, apologies and explanations until the template is a free-text reply. Keep the variable fields few and defined.

Attachments come from the wrong place. The agent attaches the file a person saved to a drive rather than one generated by the system of record. Keep its write and read rules consistent with how it saves files to shared drives.

Send-as is granted broadly. "Send as" lets the agent send anything as the team. That is a mailbox-level grant; the agent's own bounds must do the narrowing, and should be tested in shadow first, as train, shadow, certify, widen describes.