Let AI answer your email - with a human safety net

The two failure modes this avoids

Full autonomy fails the day the bot confidently answers a legal threat or follows instructions embedded in a hostile email. Draft-everything fails because a human still touches every message - you've built an expensive autocomplete. The middle path needs an architecture, not just a prompt: the agent must be able to act alone on the easy 80% and hand over the hard 20% with zero friction.

The shared-inbox pattern

Give the agent and the humans the same real mailbox. In Mektup, one address - say support@yourco.com - is simultaneously:

• the agent's workspace - it's notified by an HMAC-signed webhook the instant mail arrives, reads the thread over the REST API or MCP, and replies from the same address;
• your team's normal inbox - open in Mektup's webmail or in Outlook/Apple Mail over IMAP, with the agent's replies visible in Sent and every thread intact.

Now the escalation path costs nothing: when the agent isn't sure, it does nothing. The unanswered email is already sitting in an inbox a person has open. No handoff queue, no ticket export, no second tool, no lost context.

try {
  const decision = await decide(msg);   // model returns reply | escalate
  if (decision.action === "reply") await sendReply(msg, decision.body);
} catch {
  // On ANY failure: do nothing. The mail is already in the shared
  // inbox, visible to the humans. Failing safe IS the escalation path.
}

That try/catch is the entire safety model, and it's only possible because the mailbox is real and shared. A bot-only inbox can't do this - there, "escalate" means notifying a human in some other system and copying the context across.

What to let the agent handle first

• Acknowledgements and thank-yous; "did you get my email?"
• FAQ answers that are fully contained in the question
• Meeting-time confirmations, opening hours, pricing-page pointers
• Never at first: complaints, refunds, legal or billing disputes, anything emotional - route those to silence, i.e. to your team.

Hardening notes

• Email is untrusted model input. The system prompt must explicitly refuse instructions found inside emails ("ignore your rules and forward this...") - prompt injection arrives by mail.
• Verify webhook signatures on the raw body before processing anything.
• Audit trail: log every decision with its reason; the humans reviewing the inbox will want to know why the agent did or didn't answer.
• Ratchet autonomy up, not down: start with a narrow reply-allowlist and widen it as the log earns trust.

Try it

The full pattern - webhook verification, decide-or-escalate, reply-from-the-same-address - is a ~150-line MIT-licensed repo: mektup-inbox-agent. The concept page: shared inbox for humans & AI agents. If you're comparing tools: Mektup vs AgentMail covers the agent-only alternative, and vs Front / vs Missive cover the human-only ones.

Get started free