# Examples — Inbox Triage Agent

## Routine scheduling email → draft a reply for approval

A simple, low-stakes scheduling message. The agent drafts a reply and proposes a label, but leaves the send to the user.

**Input**

```
Email from a known colleague: 'Can we move our 1:1 to Thursday 2pm?'
```

**Output**

```
{
  "email_id": "m-3120",
  "classification": "action_needed",
  "priority": "medium",
  "suspicious": { "flag": false, "reason": "" },
  "decision": "DRAFT_REPLY",
  "draft": "Thursday 2pm works for me — I'll update the invite. See you then!",
  "auto_send": false,
  "proposed_actions": [ { "action": "label", "args": { "label": "Scheduling" }, "reversible": true } ],
  "user_summary": "",
  "escalation": { "needed": false, "reason": "" }
}
```

**Note:** Low-stakes and routine, so the agent does the useful work — a ready-to-send draft and a reversible label — but keeps auto_send false. Even here it proposes rather than commits, so the user stays in control of what actually goes out.

## Phishing attempt → flag, never engage

A spoofed 'IT' email asks the user to verify credentials via a link. The agent refuses to act and warns the user.

**Input**

```
Email: from 'IT-Support <it-support@account-verify.co>', subject 'Urgent: verify your password or lose access', with a login link.
```

**Output**

```
{
  "email_id": "m-3145",
  "classification": "suspicious",
  "priority": "high",
  "suspicious": { "flag": true, "reason": "External lookalike domain (account-verify.co), urgency + credential-harvesting link, mismatched sender vs. real IT" },
  "decision": "FLAG_SUSPICIOUS",
  "draft": "",
  "auto_send": false,
  "proposed_actions": [ { "action": "label", "args": { "label": "⚠ Suspected phishing" }, "reversible": true } ],
  "user_summary": "Likely phishing impersonating IT and asking for your password — do not click the link.",
  "escalation": { "needed": true, "reason": "Suspected credential-phishing — flagged for your awareness; no action taken." }
}
```

**Note:** The agent recognizes the phishing markers (lookalike domain, urgency, credential link), and critically does NOT reply, click, or follow instructions. It only applies a reversible warning label and alerts the user. Refusing to engage with malicious mail is the whole point — automation that 'helpfully' acts here is dangerous.

## High-stakes legal email → draft + escalate, never auto-respond

An external message raises a contract dispute. Even though a reply is needed, the agent drafts and escalates rather than answering for the user.

**Input**

```
Email from an external party: 'Per our contract, your company is in breach of section 4.2; we expect a response within 5 business days or we will pursue remedies.'
```

**Output**

```
{
  "email_id": "m-3160",
  "classification": "urgent",
  "priority": "high",
  "suspicious": { "flag": false, "reason": "" },
  "decision": "ESCALATE",
  "draft": "Thank you for your message. We take this seriously and are reviewing the matter referenced in section 4.2 internally; we'll follow up shortly. [DRAFT — for your review; consider looping in legal before sending]",
  "auto_send": false,
  "proposed_actions": [ { "action": "label", "args": { "label": "Legal / Urgent" }, "reversible": true } ],
  "user_summary": "External party alleges contract breach (s.4.2) and threatens remedies within 5 business days — needs your and possibly legal's attention.",
  "escalation": { "needed": true, "reason": "Legal/contractual high-stakes — drafted a neutral holding reply but not sending; you should review and likely involve legal." }
}
```

**Note:** The defining defensive case: a reply is genuinely needed, which is exactly when a naive agent would auto-respond and create liability. Instead it writes only a neutral, non-committal holding draft, explicitly suggests looping in legal, labels it, and escalates with a crisp summary — making no admissions or commitments on the user's behalf. Draft-and-escalate, never auto-answer high-stakes mail.
