Agents for Email and Calendar
Hand off inbox triage, reply drafting, and scheduling to agents while keeping a human in control of anything that gets sent.
Email and calendar are where most knowledge workers lose their mornings. You triage the same kinds of messages, write the same kinds of replies, and play "does Tuesday at 3 work for you?" ping-pong across four time zones. Agents are now good at all of it. They can read a thread and tell you what's being asked, draft a reply in your voice, and find a meeting slot that respects your focus time.
They're also one click away from emailing the wrong person, accepting a meeting you meant to decline, or obeying an instruction hidden in a stranger's message. This lesson takes you past one-off inbox triage to a working system: a standing inbox playbook, an open-loops tracker, reply drafts you can trust, and scheduling help, all with a firm rule that a human presses send.
Decide how much access the agent gets
Before any prompt, decide what the agent can actually touch. Think of it as a ladder. Each rung saves more time and carries more risk.
| Access level | What the agent can do | Risk | Good for |
|---|---|---|---|
| Paste-in | Read only what you paste | Very low | Trying things out, sensitive threads |
| Read-only connection | Search and read your mail and calendar | Low to medium | Triage, summaries, meeting prep |
| Can create drafts and tentative holds | Write drafts into your drafts folder, propose events | Medium | Reply drafting, scheduling proposals |
| Can send, accept, delete | Act as you | High | Almost nobody, almost never |
Many chat assistants (Claude, ChatGPT, Gemini) offer connectors for common email and calendar services: a sign-in that lets the assistant search and read your account. What each connector can do varies, and it changes often. Some can only read; others can create drafts or events. Check the permission screen when you connect, and choose read-only if it's offered and enough for the job.
The recommended stopping point for almost everyone is rung three: the agent reads and drafts, you send. The automating busywork lesson called this "propose, approve, act." For email it has a sharper reason. An inbox agent reads private data, reads content from strangers, and could send messages out. That combination, which the threat model lesson calls the lethal trifecta, is how an agent gets tricked into leaking information. Keeping the send button human breaks the chain.