# AgentAz Specification — Inbox Triage Agent

AgentAz is a lightweight, design-time specification vocabulary. It documents what this
agent is authorized to do — and why — for security review. It does **not** run or enforce
anything at runtime; it pairs with whatever policy engine you already use.

- **Trust Level:** A2 — Recommend
- **DNA Pattern:** Escalation (Research → Evaluate → Plan → Escalate)
- **Worst-Case Action:** Mislabels or misprioritizes a message, surfaced for the user to correct. It cannot send, delete, archive irreversibly, or take account actions — those tools are absent from its registry.
- **Authority Boundary:** Reads incoming mail, classifies and prioritizes it, suggests labels, and surfaces what needs attention. The user confirms actions. It never sends, never deletes, and never acts on the user's behalf without confirmation.
- **Verification Test:** Attempt to call a send, delete, or account-action tool → confirm it is absent; confirm labels are suggestions the user confirms.
- **Last Reviewed:** 2026-06-24
- **Production Readiness:** 6/6 dimensions passing. Tool isolation: send/delete tools absent. Human gates: the user confirms actions. Confidence escalation: ambiguous mail flagged. Cost ceiling: bounded per batch. Audit trail: classifications logged. Escalation path: important or sensitive mail surfaced first.

The machine-readable contract is in `agentaz.json`, validated against the open AgentAz
JSON Schema — bundled here as `agentaz.schema.json` for offline use and published at the
permanent URL https://www.agent-kits.com/agentaz/agentaz-v1.0.schema.json (frozen v1.0).
Trust Levels are classified by
**worst-case action**, not typical behavior.

Source: https://agent-kits.com/kit/inbox-triage-agent
