Stop an AI agent from sending mail as your employees

An agent with mailbox access can email outsiders, and quietly set forwarding rules that leak every future message. Gate the send and freeze the rules.

For: IT and security teams connecting an agent to Microsoft 365 or Gmail

Give an agent a mailbox and you give it two risks at once. It can send mail to anyone — including outside your organization, in an employee's name — and it can set an inbox rule or forwarding address that silently copies every future message somewhere else. The second is how business-email-compromise persists long after the first mistake.

The controls run at ingress, before the call reaches Microsoft Graph or Gmail. guard-external-send denies or draft-holds any agent send where a recipient is outside your corporate domains, so an agent drafts to outsiders but a human presses go. guard-mailbox-persistence blocks creation of mail rules, filters, and forwarding subscriptions — the standing exfiltration channel. freeze-identity-plane denies changes to groups and directory objects so an agent can't quietly widen its own reach.

Start with external-send held for review and mailbox persistence denied outright. The same two policies exist for Gmail, so a mixed shop governs both suites the same way.