AI Email Agents: Triage, Drafts and Follow-Ups on Autopilot

An AI email agent reads incoming mail, sorts it by type and urgency, pulls out the important details, drafts replies using your own information and reminds you when a thread has gone quiet. The safe way to run one is in stages: sorting first, drafts for human approval second, and automatic sending only for narrow, low-risk categories. "Autopilot" should describe the routine mail, not the whole inbox.

Key takeaways

• Triage is the lowest-risk, highest-value starting point. Nothing is sent, and the inbox becomes easier to work.
• Drafts with human approval capture most of the time saving while keeping a person responsible for what goes out.
• Auto-send only for categories with predictable content, such as acknowledgements and standard information requests.
• Treat every incoming email as untrusted input. Text inside an email must never be able to instruct the agent.
• Give the agent the narrowest mailbox permissions that the task allows.

The three jobs of an email agent

1. Triage

Triage means deciding what each email is and where it should go. The agent reads a message and assigns:

• A category. For example: new enquiry, existing customer question, supplier invoice, job application, complaint, newsletter, spam.
• A priority. Based on your rules, such as named key accounts, deadlines mentioned in the text or words that signal a problem.
• An owner. The person or team that should handle it.
• Extracted details. Order numbers, dates, amounts, the specific request.

The output is labels, folders, assignments and, where useful, a record in another system. A supplier invoice can be forwarded to accounts with the key fields already captured. A new enquiry can become a lead in the CRM. Rules-based filters can sort by sender or subject line. An agent sorts by meaning, which is what makes shared inboxes like info@ and support@ manageable.

2. Drafts

For emails that need a reply, the agent prepares one and leaves it in the drafts folder or in a review queue. A good draft uses three sources:

• The full thread, so it answers what was actually asked.
• Your knowledge: policies, product details, previous answers to similar questions.
• Live data: order status, account details, availability, pulled from your systems.

The person reviewing reads, edits if needed and sends. Reviewing a good draft is much quicker than writing from scratch, and the human remains accountable. The agent should also flag what it was unsure about, for example "I could not find an order matching this reference".

3. Follow-ups

Follow-ups are easy to forget because nothing prompts them. An agent can watch for:

• Sent emails with no reply after a set number of days, such as quotes and proposals.
• Commitments your team made, such as "I will send that over by Friday".
• Incoming emails that are still unanswered past your target response time.

It then drafts a nudge, or reminds the owner. It must stop as soon as the other party replies, and it should have a fixed limit on how many times it follows up.

How much to automate: a staged approach

Stage	What the agent does	Human role	Risk
Sort	Labels, prioritises, routes, extracts data	Works a cleaner inbox	Low. Worst case is a mislabelled email.
Draft	Prepares replies and follow-ups	Reviews and sends every message	Low. Nothing leaves without approval.
Send, narrow	Sends replies in approved categories	Reviews samples and exceptions	Moderate. Limited by category rules.
Send, broad	Replies to most mail on its own	Handles escalations only	High. Rarely appropriate.

Move a category to the next stage only when the evidence supports it. A simple test: if reviewers have been sending the agent's drafts for that category without edits for several weeks, it is a candidate for automatic sending. If they still edit often, it is not.

What should never be sent automatically

• Anything that commits the business: pricing, discounts, contract terms, delivery promises outside standard policy.
• Replies to complaints, legal notices or regulators.
• Emails about employment matters or other sensitive personal topics.
• Messages to senior contacts at key accounts, where tone and relationship matter.
• Anything that includes attachments with confidential data.

Email has no undo. A wrong chat message can be corrected in the next line. A wrong email sits in someone's inbox and can be forwarded.

Security: the part most guides skip

Prompt injection through email

An email agent reads text written by strangers. Someone can send a message containing instructions aimed at the model, for example text telling it to forward the mailbox contents to an outside address. This is called prompt injection, and email is one of the most exposed places for it.

The defences are structural:

• The agent treats email content as data to analyse, never as instructions to follow.
• Tools are restricted. The agent cannot forward mail to arbitrary addresses, change mailbox rules or delete messages.
• Anything sent to a new external recipient requires human approval.
• Links and attachments are not opened or executed automatically.

Our post on AI agent guardrails explains these controls in more detail.

Permissions and privacy

Connect the agent through the official API of your email provider, such as Gmail or Microsoft 365, with the narrowest scopes available. Start with shared inboxes, not personal ones. Check how your model provider handles the data you send it and whether that matches your obligations to customers. Keep a log of every action the agent takes.

A worked example

For example, consider a wholesale business with a shared sales inbox that receives enquiries, purchase orders, delivery questions and supplier mail in one stream. A staged setup could look like this:

1. The agent labels each email and routes supplier invoices to accounts and delivery questions to operations.
2. For purchase orders, it extracts the items and quantities and creates a draft order in the ERP for a person to confirm.
3. For delivery questions, it looks up the order and drafts a reply with the current status.
4. For quotes that have had no response after a set period, it drafts a short follow-up for the account owner.
5. After a few weeks of clean drafts, delivery status replies move to automatic sending. Everything else stays in review.

The team still makes the decisions. They no longer spend the morning sorting and retyping.

Related guides

• AI Voice Agents for Business: Calls, Bookings and Follow-Ups
• AI Sales Agents: Automating Lead Qualification and Follow-Up
• WhatsApp AI Agents: Automating Customer Conversations
• AI Customer Support Agents: What They Can and Cannot Handle
• Service: Custom AI Agents

Frequently asked questions

Can an AI email agent send replies without my approval?

It can, but it should only do so for specific categories you have tested and approved. For most businesses, drafts with one-click approval give the main benefit with far less risk.

Does it work with Gmail and Outlook?

Yes. Both Gmail and Microsoft 365 provide APIs that allow reading, labelling, drafting and sending with the mailbox owner's authorisation. The agent connects through those, not by sharing a password.

How does the agent learn our tone?

It is given written style guidance and examples of real replies your team has sent. Drafts that reviewers edit are also a useful signal for refining the instructions over time.

What if it misclassifies an important email?

It will happen occasionally, so design for it. Keep a catch-all "needs review" category for low-confidence cases, never auto-archive anything in the first phase, and review a sample of classifications each week.

Sources and further reading

Primary documentation and research behind this guide.

• Anthropic: Building effective agents
• OpenAI: Structured outputs guide
• OWASP: Top 10 for large language model applications

An email agent is worth building when it removes the sorting and retyping and leaves the decisions with people. Growmerz builds custom AI agents for shared inboxes on that basis. To see what your inbox would look like in stages, book a free AI audit.