Multi-tenant email: isolate inboxes the way you isolate data
Per-tenant inbox groups and scoped keys. Reputation is per domain, not per data partition. Offboarding means revoking the tenant's inboxes.
Discuss this post in AI
Send a pre-filled prompt to ChatGPT, Claude, Gemini, or Perplexity — get a summary, ask follow-ups, or compare ideas from this guide.
SaaS teams learn early to isolate tenant data. They learn later—usually after a spam incident—that email reputation does not follow the same partition lines. Multi-tenant agent email needs both: inbox isolation for confidentiality, and domain strategy for deliverability.
Inbox groups and scoped keys
Give each tenant a group of inboxes for its roles. Scope API keys so a compromised integration cannot list another tenant’s threads. Agent Inbox is designed as an inbox API: create inboxes, read history, send replies, extract attachments—under credentials you control.
from agentinbox import AgentInbox
client = AgentInbox()
inbox = client.inboxes.create(username="tenant42-support", domain="agentinbox.space")
On Neuro OS, map those inboxes to tenant-scoped roles and connectors. Server-side brokerage keeps secrets out of the model sandbox. Ask remains the default for outbound.
Reputation is not a database row
Filtering systems score domains and sending infrastructure. Two tenants can share an application database boundary and still destroy each other’s mail trust if they share a sending domain carelessly. Decide explicitly:
| Isolation need | Mechanism |
|---|---|
| Confidential threads | Per-tenant inbox groups + scoped keys |
| Independent reputation | Per-tenant or per-risk-class domains |
| Fast offboarding | Revoke keys + disable inboxes + freeze domains |
| Shared product mail | Separate subdomain from tenant outbound |
See deliverability 101 and the decision table in the definitive guide.
Offboarding equals revoke
When a tenant leaves, do not only delete rows. Revoke inbox access, rotate keys, stop forwards, and retain audit evidence under your retention policy. Agents must not keep speaking as a customer that terminated. Humans approve any final notices through Ask.
Forwarding across boundaries
Forwarding is powerful and dangerous in multi-tenant settings. Allow lists should prevent tenant A mail from entering tenant B roles. When a human must review, forward inside the tenant’s ownership graph. Cross-tenant human support needs its own audited path.
Enterprise systems
Tenants may run 1C, Bitrix, or amoCRM. Those systems can forward into agent inboxes without becoming a shared global mailbox. Keep connector credentials tenant-scoped. Honor 152-FZ placement requirements with self-hosted Neuro OS when contracts demand it.
Product posture
Speak in architecture, not SKUs. Isolate inboxes the way you isolate data—and isolate reputation the way mail actually works. Agent-first APIs with human Ask gates scale cleaner than a pile of shared aliases pretending to be tenancy.
Related: email API vs inbox API, email as identity, build email agents.
Testing isolation
Add automated checks: a key for tenant A cannot read tenant B threads; a forward allow list rejects cross-tenant senders; a load test on tenant A outbound does not change tenant B’s configured domain. Run chaos drills that revoke a tenant and verify sends stop within the expected window.
Shared platform, separate blast radius
Platform teams want shared components. That is fine for code and control planes. It is not fine for silent coupling of reputation and credentials. Document which layers are shared and which are partitioned. Make the partitions visible in runbooks so incidents do not turn into guesswork about who shares whose DKIM.
Agent Inbox gives each role a mailbox people can reply to, with forwarding into Neuro OS when a human must see the thread. Outbound mail defaults to Ask. Run the role on Neuro OS. To scope the first inbox, get started.