Start with one inbox and one job
A useful first email agent summarizes incoming support requests for your team. It needs to read the support inbox. It does not need to provision other agents, manage workspace keys or send messages.
In Cyberpigeon, an agent is an email identity with an inbox for your software. It is not an AI process running inside Cyberpigeon. Your application or connected AI client decides when the model runs, what context it sees and which actions it may take.
Create a mailbox-scoped key with only the read permission for a summarizer. Keep account keys in your trusted provisioning service: they manage mailboxes and credentials across the workspace. Use a separate key for each integration so you can revoke one connection without replacing every credential. The console guide explains where to create and revoke them.
Treat email as input, including instructions inside it
A message can contain a legitimate support question and a sentence telling the assistant to forward private information elsewhere. A familiar display name, a quoted conversation or a document attachment does not turn those instructions into authorization from the workspace owner.
Keep the task defined by your application separate from the content being read. Tell the agent which fields to extract and where to put the summary. Enforce permission checks in the application rather than asking the model to decide whether it is allowed to use a privileged tool. A prompt alone is not a security boundary.
OWASP describes email and attachments as potential sources of indirect prompt injection and recommends least privilege and human review for sensitive operations. Its prompt injection prevention guidance is useful background. These controls reduce risk; they do not guarantee that a model will ignore every malicious instruction.
Make approval a separate step from sending
Once summaries are useful, let your application store a proposed reply for a person to review. Show the destination address, the complete message and the source conversation. The reviewer should be able to edit or reject it before anything enters the send queue.
Store the approval against the exact response being sent. A later rewrite or a changed recipient needs another review. Put the sending credential in the component that checks that approval, rather than exposing it to a read-only summarizer. This approval flow is something you build in your application; it is not a built-in Cyberpigeon draft approval service.
- Summarize.Agent key: read.
Reads the support inbox and proposes a reply.
- Review.A person, no key.
Checks the recipient and the complete text, then approves or rejects.
- Send.Agent key: read and send.
Sends only the exact reply that was approved.
Cyberpigeon keys can carry read, send or both permissions. The reply endpoint requires both because it reads the original message to derive the recipient and threading headers. Inspect that recipient during review, including an inbound Reply-To address that differs from the sender you expected. A mailbox scope limits which inbox a key accesses; it is not a recipient allowlist.
Use the REST quickstart for a custom workflow or choose an app in the integration directory. Review the access requested by the client and keep its own action approvals enabled.
Decide when the agent is allowed to run
Connecting an AI app to email tools does not by itself create a background worker. Your application can poll events, or you can configure a supported wake-up mechanism. Hosted wake-ups require activation; local listeners need a running process. The email wake-up guide describes the available paths and their requirements.
Start with manual runs while you evaluate summaries and proposed replies. Include test messages that ask for secrets, request a different recipient or claim to override the owner’s instructions. Check the actual tool calls and resulting actions, not just whether the final summary sounds sensible.
Keep a way to stop future work: stop your worker or listener, pause its trigger, or revoke its key. A request already in flight may finish. Record the message, proposed action and approval decision so a person can investigate without reconstructing the whole conversation.
The current beta supports permitted testing, expected transactional messages and support replies. It does not permit cold outreach, sales prospecting, bulk marketing, inbox warmup or spam. Keep the agent’s job within those limits from its first test.
