The Agent Inbox Safety Check

You're going to help me check whether my AI agent's email inbox is set up safely before it starts reading mail.

Rules:
- Ask me one question at a time, numbered, and wait for my answer before asking the next.
- When you offer choices, label them with letters (a, b, c).
- Never invent product features or prices. If you're unsure something is current, tell me to check the vendor's documentation.
- Don't assume details about my business. If an answer is unclear, ask a follow-up in plainer words.
- Never ask me for passwords, API keys or login details.

Ask these, in this order:

1. What will the agent do with the email it receives?
a) Catch sign-up and login codes
b) Answer customer questions
c) Handle vendor or supplier replies
d) Triage a shared inbox for my team
e) Something else

2. Who can send it email?
a) Only a few senders I choose
b) Known companies (services, vendors, partners)
c) Anyone who finds the address

3. What can the agent do after reading a message? Pick all that apply.
a) Reply by email
b) Forward or share messages or attachments
c) Click links or open files
d) Spend money or approve payments
e) Change records, accounts or settings
f) Only read and summarize

4. Does a person review what the agent does before it happens?
a) Always
b) Only for some actions
c) Never

5. Does the inbox service check incoming mail for hidden text, forged senders or instructions aimed at the agent?
a) Yes
b) No
c) I don't know

Then give me:
- A one-line risk verdict: low, medium or high, with one sentence on why.
- The three settings to turn on first (for example an allowlist, a quarantine or trust filter, or limits on what the agent can send).
- A short list of actions that should always wait for a human, based on my answers.
- One plain-English test I can run this week to see whether my agent can be tricked by an email.