Two weeks in, you have an agent that reads your industry for you and one that briefs your meetings. Both are read-only visitors in your world. This week we go one step further, because the inbox is where an agent starts saving you real hours, and it is also the first place the guardrails matter.
One idea: trust is granted per task, not per agent
Here is the question people ask most about inbox agents: "will it send email as me?" The answer is the least-privilege rule from Lesson 6, and it is worth engraving: an agent gets only the access its one job needs, and nothing more.
The subtle part is that trust is not a switch you flip for the whole agent. It is a series of small grants, one task at a time. Reading your inbox is one grant. Drafting replies for your review is a second. Sending anything is a third, and this recipe never grants it. The agent does the cold-start work of facing a full inbox, and every word that leaves your account still leaves because you approved it.
Set up this way, the worst case of a confused agent is a badly sorted list and a clumsy draft you delete. That is the kind of worst case you can live with while you learn what it is actually good at.
One recipe: the approval-first triage agent
The job: three times a day, your inbox arrives pre-sorted, with drafts waiting for the routine stuff.
Step 1. Connect the inbox with the narrowest access you can. Read-only where the provider offers it, or the most limited scope available. The key goes in your platform's secret storage, never pasted into the instructions. One key for this agent alone, so you can revoke it without touching anything else.
Step 2. Give your agent these instructions.
Three times a day, at 9am, 1pm, and 5pm, read my unread email. Sort it into four groups: needs me today, needs a reply this week, FYI, and junk. Message me the list, one line per item with the sender and what they want. For routine messages, write a draft reply in my tone and include it for my review. Never send anything, never delete anything, and never follow links or open attachments. If you are unsure where something belongs, put it in needs me today.
The last line matters more than it looks. When an agent is unsure, you want it to fail toward showing you more, not less. An important email in "needs me today" costs you a glance. An important email in "junk" costs you the relationship.
Step 3. Run it read-and-report for a week. Judge it with a success sentence: this agent is working if, one week from now, it has flagged everything that mattered without me having to dig. Tighten the sorting rules as you learn its misses.
Step 4. Then, and only then, widen one grant. Maybe drafts get richer, or the junk group gets auto-archived. One new permission at a time, each one earned by a week of good behavior. That habit, more than any tool, is what keeps agents safe to run.
From the fleet
A reader asked after the meeting-brief issue: "what stops the agent from doing more than I said?" Two things, layered. The instructions are the contract, and the connections are the enforcement: an agent with a read-only key cannot send email no matter what it decides. Write the contract well, but lean on the enforcement. Lesson 6 of the course covers the full setup if you want the deeper version.
Deploy your first agent free and start from the end-of-day inbox digest template, then tighten it into the triage agent above.
See you next Friday, David