Agent email

Agent email lets a persistent agent receive work and send email from a d5s address, a dedicated Gmail mailbox, or a dedicated Outlook mailbox. They can remain connected at the same time, with separate settings.

Default email permissions

If your draft shows an address during setup, Enabled means the inbox exists. The draft agent cannot execute work or send replies until activation. Email received during setup shows as blocked activity, and the agent does not receive it after activation.

New automatic inboxes start with matching incoming and outgoing rules. For business email, d5s infers an organization email domain from the organization owner's verified address. For recognized personal email providers, the inbox allows only its creator's exact verified email address, including in a business organization. A member joining the organization does not change its inferred domain. Existing inboxes keep their saved settings.

These are initial communication rules, not verification that the organization owns a domain. Domain matches never grant organization or workspace access. Automatic inboxes begin with per-email approval required. Saving reviewed mailbox settings switches matching outgoing recipients to automatic delivery; the confirmation explains that change before it is applied. Open the mailbox's Email settings to edit incoming and outgoing rules separately. Accounts without a current verified email keep the manual setup flow.

Set up a mailbox

In the agent sidebar, open Channels and select d5s Email, Gmail, or Outlook to go directly to that provider’s mailbox settings. You can also open Manage channels → Email, then choose the d5s, Gmail, or Outlook tab. The Channels menu continues to show each provider’s connection status.

Where available, new agents created by a signed-in user with a verified email automatically receive a d5s address. Existing agents can use Create d5s address without signing in to another mailbox. New addresses use a short random suffix; existing addresses stay unchanged. Retired addresses are never reassigned, even after the agent or workspace is deleted.

For Gmail, read the notice about how Google content may be processed by AI providers, then choose Acknowledge and connect. Sign in to a dedicated mailbox and grant read/send access. Existing mail is not replayed on initial connection. The credential is reserved for this agent and does not become a workspace connector or a project tool.

For Outlook, open the Outlook tab and choose Connect Outlook. Sign in to a dedicated Microsoft mailbox and grant mail read/write and send access. Write access lets the agent prepare a draft for attachments of 2.5 MB or more before it sends. As with Gmail, existing mail is not replayed, and the credential is reserved for this agent.

Provider tabs only select which settings you edit. They do not disconnect other providers or change the default mailbox. One mailbox per provider can be connected to an agent.

Who the agent can email with

Under Manage channels → Email, the Who can email with? section shows a diagram of three groups: Specific people, Your workspace, and Everyone else. Envelopes move from a group to the agent when the agent receives its email, and from the agent to the group when the agent can send to it. Each group shows Receives and sends, Receives, Sends, or Blocked. A badge on the agent shows who can email it: a lock for specific people, a building for your workspace, or a globe for anyone.

Each mailbox has two independent rows:

• Receives from controls who can email this agent. Choose Specific people, Your workspace, or Anyone. A matching sender also admits automated notifications and mailing-list messages from that sender as ordinary agent work. Where available, choosing Anyone also lets you turn on Review unknown senders first as described below.
• Accept replies from people this mailbox emails appears under Receives from when it is not set to Anyone. It is off for automatic inboxes so their initial allowlist remains exact; manually connected mailboxes start with it on. It also allows incoming mail from an address this exact mailbox successfully sent to. Drafts, pending approvals, failed or uncertain sends, and another mailbox's sent history do not qualify. This does not change outgoing permissions.
• Sends to controls who this agent can email, with the same choices. Anyone has an explicit Danger confirmation. Matching sends run without per-email approval after you save the new rules. With Specific people and no addresses, the agent can only reply.

Your workspace uses the domain from your signed-in email address, for example *@example.com. It is hidden for common shared email providers. It is a suggestion, not proof of organization ownership. With Specific people or Your workspace, use Add address or domain to add an exact address or a domain such as @example.com. An address already covered by a domain rule does not need to be added separately. Each row changes only its own direction, and changes take effect after Save changes.

Automatically provisioned d5s inboxes use the defaults above. Manually created or connected mailboxes start with empty address rules. Existing policies and queued approvals keep their old behavior until explicitly updated. Changing only an advanced limit does not turn an existing off or reply-only policy into proactive sending. Converting legacy approval/copy settings requires a clear settings confirmation; it never automatically sends queued drafts.

New email uses an explicitly chosen mailbox or the designated default. Replies use the original receiving mailbox and correspondent. A blocked send never retries through another provider.

For d5s and Gmail mailboxes, set a Sender name when recipients should see a role such as “Engineering Ed” instead of the agent's internal name. The line under it shows the resulting Name <address> identity. This changes the display name on new outgoing mail from that mailbox; it does not rename the agent or change its email address. Microsoft mailboxes continue to use the display name configured in Microsoft 365.

When an agent tries to send to a recipient outside the mailbox's Sends to rules, its conversation shows a Recipient blocked notice outside the collapsed tool activity. Choose Email settings in that notice to open that agent's mailbox rules directly; make the change and use Save changes before asking the agent to retry. The notice does not change policy by itself. Saving rules in Email settings requires a workspace member who can manage the channel; the agent can also request one exact address as described below.

When a draft is waiting for approval, a channel manager can choose Approve & send for that email alone, or open More options → Approve & always allow this recipient. The second choice approves the displayed draft and lets future email to that exact address skip per-email approval on the same mailbox. Sends to rules and other sending limits still apply. If a future email also names a CC or BCC recipient who has no such exception, it still needs approval. On an approved email card, choose Require approval again to remove that recipient's exception. These actions do not affect another mailbox or approve other pending drafts.

When an agent needs permission for an exact address, it can request a Receives from or Sends to rule for a specific mailbox. A blocked send with To, CC, or BCC recipients can produce one request containing every address denied by that mailbox’s Sends to rules. In d5s, the card labels each address by role, shows role totals and long lists on demand, and lets a channel manager choose Review change then Allow address or Deny for each address independently. Allow all confirms all still-pending exact addresses in that request at once; previously denied addresses stay denied. Allowing only some recipients does not send the blocked email; the agent must retry when appropriate. The request expires after 24 hours. To keep email notices useful, email-origin requests are limited to three per turn, five per sender in 24 hours, and twenty per agent in 24 hours. If the limit is reached, a channel manager can still update Email settings directly. If the mailbox rules change before a decision, ask the agent for a new request.

In a connected Slack or Microsoft Teams channel, the agent posts Allow address and Deny buttons for up to three visible To/CC addresses. Hidden BCC recipients and remaining addresses use one generic link to the signed-in d5s review; the channel message does not show a BCC address, count, or agent-written reason. Telegram and email use one generic d5s link for a blocked-send batch. For work started by email, d5s emails the review link to workspace admins. Mailbox rules do not block it. Sign in to review it; replying to the email does not decide the request. A decision appears on the same request across surfaces.

Allowing the address changes only that mailbox’s exact address rule. It does not send the blocked email; ask the agent to retry. A Sends to address rule does not turn on proactive sending. A Receives from address rule does not turn on a mailbox whose receiving mode is off or bypass sender verification. Adding one exact address keeps unrelated held-message reviews and pending outgoing work intact.

Copy people on an email

Ask the agent to send one email to a primary recipient and copy others with CC. For example: “Email the report to Michael and CC Theodore.” CC addresses are visible to everyone on the email. You can include up to 20 explicit CC recipients.

Every explicit CC recipient must satisfy the sending mailbox's Sends to rules. If any recipient is disallowed, the entire email is blocked; the agent does not silently omit them or send separate copies. Policy-required oversight copies remain in place. Approvals, where required by an existing policy, preserve the exact recipients and attachments.

A successful email also lets its explicit CC recipients respond when Accept replies from people this mailbox emails is enabled. Oversight-only copies do not grant this exception. A queued, failed or uncertain send does not qualify.

Block unwanted senders

Under Advanced → Blocked senders, add exact addresses or domains. Blocking takes precedence over Anyone, allowed addresses, and the reply exception. Blocked mail cannot start agent work. Remove an entry to unblock it.

Incoming email cards also offer Block sender in their actions menu to channel managers. The action applies only to the mailbox that received the message. It does not change the other mailbox settings or automatically stop work that has already started.

If an incoming message is held only because its sender is outside the mailbox's Receives from rules, its card shows Held for review. A channel manager can choose Allow sender & deliver this email and confirm the exact address and mailbox. This adds that sender to the mailbox's Receives from addresses and releases the retained message once, so the sender does not need to resend it. A previously blocked message that was not retained for review offers Allow future email from sender instead; ask the sender to resend after allowing it. The action cannot override a blocked sender, unsafe content, or an unavailable mailbox. If the sender still needs verification or unknown-sender review, the message stays held for that separate decision.

A retained email held by a Receives from address rule can also be rejected. Rejection keeps the message blocked and does not change sender access.

Review email from unknown senders

Set Receives from to Anyone and turn on Review unknown senders first to hold mail from every sender that does not match an exact address or domain under Trusted senders. That visible list is the only source of quarantine bypass trust: previous conversations and addresses the agent emailed do not bypass review by themselves. A sender trusted from the inbox is added to the list and bypasses future review; choosing Deliver once does not make that sender trusted.

Held email appears under Needs review in the mailbox activity inspector. Its sender, subject, body, links, and attachment details remain hidden from the agent. d5s posts a count-only review notice in the agent conversation. The notice does not start agent work or reveal held email details.

A channel manager can choose Deliver once, Trust sender & deliver, or Reject. Delivering starts ordinary inbound work only after the decision. Trusting admits that exact sender on later messages, while rejecting keeps the content away from the agent. Replacing incoming rules or changing blocked senders, the review setting, or trusted-sender rules before a decision invalidates pending reviews instead of applying stale rules. Adding one exact incoming address through a chat suggestion preserves pending reviews. Disconnecting the mailbox invalidates them too.

Managed d5s inboxes also hold email when sender-domain verification (DMARC) does not pass. This includes cases where the sending domain has not configured an enforcing DMARC policy, even if some SPF or DKIM checks pass. The card says Sender could not be verified and explains how to ask the sender's email administrator to check SPF, DKIM, and DMARC before sending another test. The agent does not act on the message while it is held.

A channel manager can Deliver once, or choose More options to always allow the exact address shown in From or allow all unverified email for that mailbox. The persistent choices show a danger confirmation because a forged message can claim the same From address. Under Advanced settings, leave Review unverified email before the agent sees it on to keep holding these messages. Turn it off only if you intend to allow all unverified senders; confirm the risk, then select Save changes to apply it. Allow unverified email from creates exact-address exceptions after the same confirmation and save. Spam, virus, malformed-message, blocked-sender, and other content checks cannot be overridden this way.

Advanced settings

Advanced contains the unverified-email (DMARC) controls, blocked senders, the attachment toggle, and a separate retire/disconnect action. Reconnect a Gmail or Outlook mailbox through the provider if authorization expires. Disconnecting stops synchronization and new sends while retaining message history. An email already being sent may finish; accepted email cannot be recalled.

A paused agent, spent AI budget, unavailable mailbox, or denied recipient blocks sending. Every outgoing email identifies that it was sent by an AI agent. Branding follows your workspace plan.

Email is external input

Incoming email enters the same persistent agent conversation used by other channels. Allowed senders can invoke the capabilities configured for that agent and its shared context. An address match does not prove a sender is a workspace teammate. Gmail and Outlook rules use From, not Reply-To; provider headers alone are not authenticated identity evidence. Managed d5s mail also passes domain and content checks.

With Review unknown senders first enabled, an unknown sender's content does not enter that conversation until a channel manager delivers it. The count-only review notice contains no sender or message metadata and grants no email access.

Email content cannot widen address rules, override a block, or change standing permissions. Automatic replies and common bulk, list, and loop headers are filtered unless the sender's From address explicitly matches the mailbox's saved Receives from rules. A match means those messages can start ordinary agent work; the successful-send reply exception alone does not opt automated mail in. For managed d5s mail, an explicitly allowed message may have a different Reply-To, but d5s keeps From as the correspondent and reply target instead of redirecting to that header. Replies and proactive messages still require the mailbox's Sends to rules, and actual sends require the email tool.

Every member who can open the agent can inspect its retained email activity, including after a mailbox is disconnected. Legacy approval cards retain the exact draft and can be approved or rejected by authorized members; current policy and ownership are rechecked before delivery.

If work started by an incoming email pauses on an Ask-gated connector action, the agent replies in the same email thread with an ordinary link to the relevant turn in d5s. Email replies cannot approve or deny the action. An authorized workspace member must sign in and decide on the existing d5s approval card; normal workspace and agent access still apply. The run remains paused until that decision or expiry, even if someone replies with words such as “approved.”

Ask the agent to check whether an earlier email is awaiting approval or has been sent. It can inspect current approval and delivery status without sending another copy. An earlier queued reply may be out of date; approved does not itself mean sent, and sent means the provider accepted the message, not that it arrived in the recipient's inbox. Check an uncertain delivery before trying again.

Attachments and supported files

Incoming messages can include text, Markdown, CSV, TSV, JSON, YAML, XML, HTML, calendar, and source code files; PDF; Word, Excel, and PowerPoint files; PNG, JPEG, GIF, WebP, BMP, SVG, and ICO images; MP3, M4A, WAV, OGG, and WebM audio; MP4 video; and forwarded .eml messages. The agent reads text, code, DOCX, XLSX, and PPTX contents directly. It reads long text in pages of 50,000 characters, so it can reach the full text of a long file. It opens other files from its workspace. The email card shows retained file metadata and whether each retained file is available, read, skipped, or failed. Archives, executables, scripts such as JavaScript and shell files, macro-enabled Office files, unknown types, and unsafe or malformed files are skipped with a visible reason. For d5s addresses, PNG and JPEG images pasted into the email body, such as screenshots, can be read. A named PDF presented inline as a separate file can also be selected. Small images in the body, such as signature logos and icons, are left out and do not show on the card.

Supported attachments remain available for later agent work while the mailbox is connected and current permissions allow access. For d5s addresses, an attachment that has not been opened expires when its original message reaches the 30-day retention limit. Files the agent has already opened remain under its file controls. Email content remains untrusted and cannot change permissions or reply routing.

An attached PDF or image is available to the agent, but attaching it does not mean every page or image detail has been read. Image inspection requires a supported vision model. For scanned or mixed PDFs, ask the agent to read the relevant pages of the PDF.

Each incoming file can be up to 50 MiB, and one email can include up to 100 files. For a d5s address, the complete incoming email can be at most 30 MiB. Email encoding makes files about one third larger, so the files in one such email can total about 22 MiB. A larger email shows as blocked activity with its sender and subject, and the agent does not receive it. Expansion and image-dimension limits apply. A supported file the agent reads remains available for later work. Extracted text is untrusted evidence.

The agent can attach files it created to a new email or an explicit reply. Ask it to attach the file so recipients can open it. A missing, oversized, or unreadable requested file blocks the email instead of silently sending only text. When approval is required, the message keeps the attachment selected for approval; later file changes do not alter that copy.

For a d5s-managed address or a connected Gmail or Outlook mailbox, outgoing attachments can total up to 25 MiB per email. An Outlook mailbox connected before this limit changed must be reconnected once to send files of 2.5 MB or more in total: choose Reconnect mailbox in its email settings. The complete email must also fit the provider's message limit. The recipient's email service can have a lower limit. If delivery fails, reduce the files or send an accessible file link.

Follow activity

The agent conversation records inbound processing and outgoing states such as received, waiting for credits, processing, processed, sending, sent, blocked, rejected, failed, and uncertain. Full email activity remains available to everyone who retains access to the agent, including after the mailbox is disconnected.

Incoming email shows Waiting for credits when the workspace is out of credits or has reached a usage limit. The agent starts the email automatically, oldest first, after credits are added or the limit resets. An email that still waits after 7 days becomes blocked with the reason "No credits were added within 7 days." The sender does not receive a notice.

Incoming email is recorded as blocked when the agent's selected model family is disabled or has no available version under the organization settings. It does not start a model run or retry repeatedly. Choose an available model under Manage agent → Profile, or ask an organization administrator to restore the family. This does not change mailbox permissions.

For a mailbox-focused view, open Email in the agent's secondary Channels section. The activity inspector groups retained messages into threads, pins pending approvals and held incoming mail, supports subject or address search, and lets you open the related conversation turn. It is an audit and triage view, not a separate agent conversation: delivered email and approval cards continue to appear inline in the main timeline.

Allowed incoming mail has no hourly limit. Held, automatic, and blocked mail has an hourly limit: each mailbox keeps up to 200 such emails an hour, and each workspace up to 1,000. Email over the limit is not kept. When held email goes over the limit, a channel manager sees N unprocessed emails above the agent's message box and in that mailbox's Email settings. Select Email settings to open the mailbox, or select × to dismiss the notice. The settings row keeps the total and the time of the last unprocessed email. Ask the sender to send the email again if the agent still needs it. Contact support if expected allowed mail is missing.

“Sent” means the mailbox provider accepted the send request; d5s does not claim recipient delivery. If delivery is unclear, the status is uncertain. Check before you send again.

Mailbox options

A d5s address is available where Create d5s address appears in setup. Connecting a dedicated Gmail or Outlook mailbox is also supported. You do not need to change its domain or mail delivery settings.

Generic IMAP and SMTP mailboxes are not available as agent email channels. For authorized reads, unsent drafts, scheduled mailbox checks, and separately approved sends, use the IMAP / SMTP workspace connector.

Hidden copies (BCC)

Ask the agent to BCC the exact email addresses you provide. BCC recipients receive the email without appearing in the visible To or CC fields. The agent does not infer hidden recipients from an earlier message.

When Accept replies from people this mailbox emails is enabled, a successfully sent BCC copy also permits that recipient to reply, subject to blocked-sender rules.

BCC follows the sending mailbox’s outgoing rules and approval requirements. One disallowed recipient blocks the whole send. A BCC address that also appears in To, CC, or a configured oversight copy must be resolved before sending, so a hidden recipient is never silently made visible. People authorized to inspect the agent’s email activity can see BCC recipients and review them before approving a send.

Open a managed email in d5s

New outgoing email includes the saved agent character in its HTML body. Plain-text email remains readable without an image. This does not change the account photo shown by Gmail or Microsoft 365. Older email keeps its original image. Change the character in Manage agent → Profile → Character.

Emails from a d5s-managed address end with a compact signature: the agent’s avatar, its name, and AI agent with the workspace name. Agents do not add their own sign-off. Where branding is enabled, the footer offers two choices: Work with the agent’s team? Request access and Want d5s for your team? Get started. Reply directly by email without registering whenever the mailbox’s incoming rules allow it. The first email to a recipient says so in the footer, but only when replies are permitted.

Sign in with the verified address that received the email. If your existing session has no recorded email verification, sign in again. A forwarded link does not give another account access. The recipient view includes only emails sent to your address, including explicit CC or BCC copies, and never exposes hidden recipients or the agent’s private activity.

• Already a member with access to the agent: choose Open … in d5s to enter the correct workspace.
• Invited to that workspace: accept the invitation to join, then open the agent. Invitation expiry, email matching, and seat requirements still apply.
• Colleague, not invited: choose Request access. The request page names the workspace and its organization, so you can confirm which team you are asking to join. Request workspace access when available. Workspace invitation managers open Settings from that workspace, review requests in People, and use the normal invitation flow. A request alone grants no access.
• External collaborator: choose Get started to register and follow normal onboarding for your own use of d5s. This does not request access to the sender’s workspace. You can keep replying by email without registering when the mailbox permits it.

Requests target one workspace. An existing organization member still needs access to that workspace; a newcomer joins through the normal organization invitation and seat checks. Other workspaces and private projects require separate access. Your email address or company domain does not automatically join you to the sender’s team.

Personal workspaces cannot be joined through an access request. If you already belong to a workspace but cannot open the agent’s private project, ask its administrator to share the project with you.

Gmail mailbox data protection

Gmail message content may be processed by the AI providers used by your workspace to complete the email work you authorize. Disconnecting does not erase earlier messages or stored outputs. See Google data protection for AI processing and stored-data guidance. Authorizing a mailbox does not itself authorize an outgoing email.