Email for AI agents: the definitive guide
Inbox vs send API, the provision→send→inbound→webhook→Ask→act loop, and how to choose isolation for tenants and domains.
Discuss this post in AI
Send a pre-filled prompt to ChatGPT, Claude, Gemini, or Perplexity — get a summary, ask follow-ups, or compare ideas from this guide.
This guide is the hub for email as an agent channel. It separates a send API from an inbox API, walks the operating loop Pattern Automation expects on Neuro OS, and frames isolation decisions that teams confuse: data partitions versus sending-domain reputation.
Inbox API versus send API
A send API delivers outbound messages and usually stops there. Useful for receipts, alerts, and one-shot notifications. An inbox API gives the agent a mailbox: storage, threading, inbound retrieval, replies under a stable identity, attachment extraction, and webhooks. Agents that negotiate, collect documents, or handle support need the inbox.
Agent Inbox is Pattern Automation’s inbox API. Provision with the SDK, then treat the address as part of the role.
from agentinbox import AgentInbox
client = AgentInbox()
inbox = client.inboxes.create(username="ops", domain="agentinbox.space")
Deep comparison: email API vs inbox API.
The reference loop
- Provision — create an inbox for the role; store the address in role config.
- Send — draft outbound mail; Neuro OS defaults writes and sends to Ask.
- Threaded inbound — replies land in the same mailbox with Message-ID / In-Reply-To / References preserved.
- Webhook — notify the runtime that new mail arrived; avoid blind polling where possible.
- Ask — human reviews high-impact replies, forwards, or tool calls that change state.
- Act — approved send, CRM update, or escalation; then wait for the next inbound event.
That is loop engineering on an email surface—see what is loop engineering. Threading details live in email threading for AI agents. Memory discipline—do not dump the whole mailbox into the prompt—is in email as memory.
Forwarding into the loop
Not every thread starts at the agent address. Humans and systems forward mail into the agent inbox; the agent forwards out when Ask requires a person. Forwarding (“пересылка”) keeps context instead of forcing a summary paste. Operational rerouting patterns are covered in you don’t need to receive email anymore.
Isolation: tenant boundary versus domain reputation
Teams often isolate customer data correctly and still share one sending domain across all tenants. A complaint or spam spike from one tenant then damages everyone. Treat these as separate axes:
| Need | Notify-only SES/SendGrid-style send | Owned agent inbox | Per-tenant sending domain |
|---|---|---|---|
| One-way alerts | Enough | Overkill | Rarely needed |
| Two-way work, OTP, replies | Insufficient | Default | When tenants must not share reputation |
| Strict offboarding | Revoke API keys | Revoke inbox access | Revoke domain + keys |
| Multi-tenant SaaS | Risky if shared identity | Group inboxes per tenant | Best when reputation must split |
Scoped keys and inbox groups are the data side; domains are the reputation side. See multi-tenant email. Deliverability basics—SPF/DKIM/DMARC, warmup, subdomain split—remain mandatory: deliverability 101.
Security and rendering
Agents that read HTML mail inherit phishing and XSS risk. Prefer markdown for model I/O, sanitize HTML for humans, never execute remote scripts, and Ask before following links that change state. See HTML vs Markdown and rendering email safely.
Identity and autonomy
Email is still how the internet proves who you are for many workflows. Agents need addresses they own; humans remain accountable owners of roles and send gates. Start from can AI agents have their own email and email as identity. Coding agents that must clear registry and CI mail: autonomous coding agents.
Build checklist
Foundations, webhooks versus polling, drafts plus Ask, attachments, allow/block lists, and Neuro OS deployment are expanded in build email agents. Product posture—API first, humans on Ask—is in we do not build for humans first. Why email matters at all: why AI agents need email. Vision for agents as internet users: the next trillion users.
Neuro OS supplies git-backed roles, sandboxes, any approved model, and connectors brokered server-side. Self-host when policy requires. Agent Inbox supplies the mailbox. Together they turn email from an afterthought into a controlled channel for company work—including systems such as 1C, Bitrix, and amoCRM that already speak mail or can forward into it.
Agent Inbox gives each role a mailbox people can reply to, with forwarding into Neuro OS when a human must see the thread. Outbound mail defaults to Ask. Run the role on Neuro OS. To scope the first inbox, get started.