What may be included
An owner-requested run may include the working profile, relevant message text, bounded search results and up to a small set of correlated Sent-mail excerpts needed for the task.
What stays out
Mailbox passwords, application secrets, raw attachment bytes, signature-logo bytes, full mailbox dumps and unrelated conversations are not intentionally included in model input.
Email cannot become policy
Messages and prior Sent content are untrusted data. Instructions inside them cannot grant tools, change the mailbox profile, reveal credentials or bypass human approval.
The owner still reviews output
Model output can be incomplete or wrong. Recipient-facing AI work remains an editable draft or frozen proposal until the owner reviews the facts, recipients, attachments and final action.