Don't hand your AI agent your personal email. Give it a mailbox of its own.

Recurring mistake I keep seeing (and made myself): you build an agent that needs to send/read email, so you paste in your personal email's OAuth token and let it loose. Now a prompt-injected message can make your agent send mail as you, and there's no policy layer between the LLM and your inbox. The cleaner pattern is to give the agent its own managed inbox — a real address, not a borrowed one — plus rules that run before the agent ever reads a message. Full disclosure, I work on the Nylas CLI, so I'm biased. But the "give your agent a human's inbox" anti-pattern predates us and it's the part I'd want people to get right regardless of tool. Here's the approach. One-time setup signs you up, connects an email account, and spins up a free domain for agent accounts: # signup + connect email + free agent-accounts domain nylas init Then provision a dedicated address (no OAuth handshake, no human mailbox) and attach policies: # provision a mailbox the agent owns nylas agent account create [email protected] # add a guardrail that runs before the agent sees mail # e.g. block a sender domain outright nylas agent rule create \ --condition from.domain,is,example.com \ --action block The address can send transactional mail and receive replies, so the agent has a real two-way channel instead of a fire-and-forget SMTP hack. Policies can block / archive / route messages before they hit the model — the part people skip and then get burned by prompt injection. Wire it into an agent through MCP and the model gets email as a tool without you hand-rolling Gmail/Graph API code per provider. How's everyone else scoping inbox access for agents? Separate account + policies, or something else?