Guardrails
Every limit below is enforced by the server that holds your mailbox connection. It applies whatever the assistant is asked to do, and whatever it decides to try. Some of them are capabilities the engine does not have at all; one is a guard it turns on by default and we do not lift. Each entry says which it is.
Per-tool switches, enforced on our server
Every tool has its own on/off switch on your account. A switched-off tool is not offered to the AI at all — it does not appear in the list of tools the client is given.
If a call for a switched-off tool arrives anyway, the server rejects it. The switch is enforced where the mailbox connection lives, not in the prompt, so nothing the assistant is told or persuaded of can turn it back on.
There is no delete tool
No tool in the set deletes mail. This is not a switch that ships in the off position; there is nothing to switch. An agent should file mail, not destroy it.
Trash-like destinations are refused by default
Moving messages between folders is a normal part of triage, so the move tool exists. It refuses trash-like destinations: a mailbox whose special-use is Trash or Junk, or whose name contains trash, junk, spam or deleted. That closes the obvious way to delete mail without a delete tool.
This is a different kind of guarantee from the one above, and the difference is worth being exact about. The missing delete tool is an absence — no setting adds one, because there is no such tool to enable. The trash guard is a setting. It ships on, and an operator running the engine themselves can turn it off. On the hosted service we are the operator, and we do not lift it.
Filter rules move mail through the same path, so a rule cannot route messages somewhere that a direct move would be refused.
Outgoing attachments are reference-only
The AI can never supply file bytes. An outgoing attachment is a reference to a document you authorized, chosen by name from that set; the server reads the file and attaches it.
So the assistant can attach the contract you put there. It cannot fabricate a file and send it, and it cannot reach anything outside that set.
Sending is rate-limited by recipient count
Sends and replies are limited by how many recipients they reach, over a rolling window shared between them. The budget is checked before the message goes out, and the assistant can read what is left of it.
The send log is append-only
Every send is written to a log that is only ever added to. No tool edits or removes an entry, so the record of what went out is the record of what went out.