# Setup guide — Phishing Triage & Response Agent

## 1. Install and connect mail + sandbox

Install the agent and connect it to your mail platform, sandbox, and threat-intel.

```
pipx install phishing-triage-agent
phishing-triage-agent connect --mail o365 --sandbox cuckoo --intel virustotal
phishing-triage-agent doctor   # verifies sandbox isolation + scoped mail access
```

## 2. Set response authority and caps

Define what may auto-contain. Mass/exec actions stay approval-gated. Enforced outside the model.

```
cp .env.example .env
ANTHROPIC_API_KEY=sk-ant-...
MAX_TOOL_CALLS=8
AUTO_CONTAIN_SCOPE=non_critical_mailboxes
MODE=advise   # advise (recommend) | act (auto within scope)
```

## 3. Mark critical mailboxes & rules

Tell the agent which mailboxes are sensitive so it never auto-purges them, and how to scope campaigns.

```
# .phishing.yml
critical_mailboxes: ["exec/*", "finance/*", "legal/*"]
require_approval: ["org_wide_purge", "critical_mailbox_action"]
always_escalate: ["bec", "wire_request", "credential_harvest_clicked"]
```

## 4. Backtest on past reports

Replay resolved phishing reports to measure verdict accuracy — especially missed true positives.

```
phishing-triage-agent backtest --range 30d --explain
# reports phishing/safe accuracy, FP rate, and missed-true-positive count (target ~0)
```

## 5. Wire to the abuse mailbox

Route user reports to the agent. Start in advise mode, enable act mode for scoped containment once backtests are clean.

```
# 'Report Phishing' button / abuse@ -> POST https://your-host/phishing/report (HMAC)
# promote MODE=act after a clean backtest with zero missed true positives
```
