# Inbox Triage Agent

> An inbox-triage agent that classifies and prioritizes email, drafts routine replies, flags phishing, and escalates high-stakes messages. Never auto-sends sensitive mail.

- **Category:** Email & Inbox
- **Difficulty:** Intermediate
- **Setup time:** 40 min
- **Stacks:** Claude, LangGraph, OpenAI
- **Version:** 2.0.0 (updated 2026-06-21)
- **Source:** https://agent-kits.com/kit/inbox-triage-agent

## Overview

Classifies and prioritizes every message — urgent, action-needed, FYI, or suspicious — so the important mail surfaces first.

Drafts replies for routine messages and proposes actions, leaving the send decision to you.

Flags phishing and suspicious mail without clicking links or replying, and labels safely.

Defensive: it drafts but never auto-sends sensitive or high-stakes email, never deletes, and never commits on your behalf.

## When to use it

- Your inbox volume buries the messages that actually need attention.
- You want routine replies pre-drafted for your approval and a clean priority order.
- You want suspicious/phishing mail caught and flagged rather than acted on.
- You want high-stakes messages escalated with a summary instead of auto-answered.

## When not to use it

- You want it to fully autonomously send email on your behalf — sensitive sends are draft-only by design.
- You can't grant scoped, privacy-respecting inbox access.
- You expect it to make commitments or decisions for you in replies.
- You need it to delete or irreversibly act on mail (it won't).

## Architecture

- **Inbox intake** — Reads new messages under scoped, privacy-respecting access, with sender, subject, body, and metadata for triage.
- **Classification & priority** — Classifies each message by type and scores priority so urgent and action-needed mail surfaces above FYI and newsletters.
- **Phishing & suspicion check** — Screens for spoofing, suspicious links, and social-engineering patterns, marking risky mail before any action is considered.
- **Draft & propose** — Drafts replies for routine messages and proposes safe, reversible labels/archives — without sending sensitive mail or committing to anything.
- **Safety gate** — A deterministic gate forces draft-only for sensitive/high-stakes classes, blocks any action on suspicious mail, and prevents deletion or irreversible actions.
- **Escalation & summary** — Surfaces urgent, sensitive, or ambiguous messages to the user with a one-line summary and a ready draft, leaving the send decision to them.
- **Audit & scope** — Keeps inbox content in scope, logs actions taken (labels) for review, and never forwards or exfiltrates externally.

## Files in this bundle

- `system-prompt.md` — the agent's system prompt
- `tools.json` — tool/function definitions the agent expects
- `workflow.md` — step-by-step run loop
- `.env.example` — environment variables to fill in
- `kit.json` — full structured metadata
- `starters/` — minimal starter snippets
- `LICENSE` — Apache-2.0 (code, configuration, and schema)
- `LICENSE-CONTENT` — CC BY 4.0 (specification text and documentation)
- `NOTICE` — attribution and trademark notice
- `run.py` — **runnable demo**: real agent loop with mock tools (`pip install anthropic`, set `ANTHROPIC_API_KEY`, `python run.py`)
- `agentaz.json` / `agentaz.schema.json` — AgentAz™ governance spec + schema

## Implementation notes

- Default auto_send to false globally and make sensitive/high-stakes classes draft-only in a deterministic gate — never rely on the model to 'remember' not to send.
- On any suspicious/phishing signal, hard-block replying, clicking, authenticating, or following instructions; the only allowed action is a reversible warning label plus a user alert.
- Forbid deletion and irreversible actions entirely; labeling and archiving must be reversible.
- Never let the agent commit, agree, promise, or decide as the user — high-stakes messages are draft-and-escalate, with non-committal holding language.
- Keep inbox access scoped and private; never forward or exfiltrate content externally, and log actions taken for review.
- Tune phishing sensitivity to favor flagging; a false 'suspicious' label is cheap, while acting on a real phish is costly.
- Spend the strong model on drafts, phishing judgment, and escalation framing — a cheaper model can classify and prioritize bulk mail.

## Variations

- **Basic — Triage & prioritize:** Classifies and prioritizes the inbox and flags suspicious mail, producing a clean read order. No drafting or actions.
- **Advanced — Draft & escalate:** Adds routine-reply drafting, safe reversible labeling, phishing flagging, and high-stakes escalation — with sensitive mail kept draft-only.
- **Enterprise — Governed inbox assistant:** Adds team-wide deployment, policy-based send controls, DLP/PII guardrails, audit logging, and shared-mailbox routing — sensitive sends always human-confirmed.

## FAQ

**Will it send emails on my behalf?**

It always drafts, but sending is gated. Sensitive, legal, financial, HR, contractual, and external high-stakes replies are draft-only for you to review and send. Auto-send is off by default and only ever applies to clearly routine classes if you explicitly enable it.

**What does it do with phishing or suspicious mail?**

It flags it and stops there — it won't reply, click links, authenticate, pay, or follow the message's instructions. It applies a reversible warning label and alerts you, because acting on malicious mail is exactly what you don't want automated.

**Can it delete email?**

No. It never deletes or takes irreversible actions. Labeling and archiving are reversible, and anything consequential is proposed for your confirmation.

**Will it commit to things for me?**

No. For anything high-stakes it drafts neutral, non-committal language and escalates to you; it won't agree to meetings, terms, payments, or promises on your behalf.

**How does it handle urgent messages?**

It classifies and prioritizes so urgent and action-needed mail surfaces first, and escalates genuinely high-stakes items with a one-line summary and a ready draft for you to act on quickly.

**Is my inbox kept private?**

Yes. Access is scoped, content stays in scope and isn't forwarded or exfiltrated externally, and actions taken are logged for your review.


---

© 2026 AgentKits · www.agent-kits.com

**Open source.** Code, configuration, and the AgentAz™ schema are licensed under
**Apache-2.0**; specification text and documentation under **CC BY 4.0** (with
attribution to AgentKits, link to https://www.agent-kits.com). See LICENSE, LICENSE-CONTENT,
and NOTICE in this bundle. "AgentAz" and "AgentKits" are trademarks of AgentKits.

**Flagship reference blueprint.** View the source, AgentAz™ spec, and frozen v1.0 schema
in the public registry: https://github.com/agent-kits/agentaz
Original: https://agent-kits.com/kit/inbox-triage-agent
