Limit an agent with controls enforced on the server: narrow permissions, rate limits, and a daily cap. Instructions to the model help, but a model can ignore or misread them, and a confused agent is the case you're protecting against.
What can go wrong
Three failures come up most, and none of them needs a malicious agent. A retry loop sends the same email many times and uses up your monthly quota, so your production email starts failing. An agent guesses addresses, your bounce rate climbs, and your email provider suspends your account, taking your OTPs and receipts with it. Or an agent reads an email containing instructions, and follows them. That last one is called prompt injection, and it's why reading and sending are worth keeping apart.
Controls worth having
- A credential per agent: so you can see what each one did, and remove it without breaking anything else.
- Narrow permissions: an agent that only needs to send shouldn't be able to delete a domain. An agent that summarises your inbox shouldn't be able to send from it.
- Rate limits: a per-minute limit stops a loop quickly.
- A daily cap: this limits the damage from a slower mistake, and should be well below your monthly quota.
- Idempotency keys: a retried send with the same key returns the original result instead of sending again.
- Per-agent bounce monitoring: an account-wide bounce rate can't tell you which agent caused it.
The control that looks safer than it is
Many tools, including ours, ask the agent to show you a preview and confirm before doing something risky. That's useful, because it catches honest mistakes and puts you in the loop. But the model is the one relaying the confirmation, so it isn't a security boundary. Treat it as a seatbelt, and rely on the limits above for the cases where the model gets it wrong.
How MailKaka handles this
Each agent connection has its own permissions, 60 sends a minute, and 500 emails a day, and its emails count towards your plan's quota. Mailbox access is off until a workspace admin turns it on. If one agent passes a 5% bounce rate, the workspace owner gets an email naming it, at half the rate where workspace-level warnings start. You cansee the full list of controlsbefore connecting anything.