AI Safety
AI Agent Permissions: Reading Email Is OK. Does Sending Need Approval?
AI Agent permissions: ease approval for mail search and summaries; approve sends and calendar edits by default. Fill in a permission table before Always allow.
When setting AI Agent permissions, many people connect the Gmail connector and first ask, “Help me go through my email.” The Anthropic Help Center states that Claude’s Google Workspace connectors can search, read, and draft email. Sending, replying, and forwarding require your approval each time by default. The calendar connector can view events and create, update, or delete them. Reading email uses one permission level. Editing calendars and sending email use another.
Reading email: search and summaries
Common uses include searching threads in natural language, summarizing exchanges, retrieving meeting context, and listing emails awaiting a reply. The documentation states that, by default, the connector retrieves only the minimum information needed, and only when you ask a question or request an action. It cannot read attachment contents, only metadata. Its permissions match the access your Google account already has.
Read permissions can be set to Always allow or use looser approval. At this point, the agent usually has not changed anything in external systems. Do not paste an entire mailbox into a consumer chat app with model training enabled. See Should You Paste a Contract into ChatGPT? Redact It First. Auditing is harder when access is spread across personal accounts. See Why Companies Shouldn’t Just Buy Individual AI Accounts.
Sending email: Agent approval by default
The Help Center FAQ states that Claude can send, reply to, and forward messages through Gmail. Each action asks for your approval by default. In Team / Enterprise, the Owner decides whether members can turn off approval for each action. The OAuth screen shows send-related permissions. This listing does not mean automatic repeated sending is on by default.
Separate drafting from sending when setting up permissions. Drafting can stay enabled. Keep sending on Needs approval. Consider looser approval after audit sampling and rollback are in place. When adding guardrails for AI development, list write and read permissions in separate columns. See Engineering Guardrails for AI Coding: From Writing Code to Constraining It.
Calendar auto-send and schedule changes: write actions
The calendar connector can view events (including shared calendars), create/update/delete events, find common free slots, manage attendees and respond to invitations, and set recurring meetings. Creating, editing, or deleting events notifies attendees or changes room bookings. These are external writes.
When people say “calendar auto-send,” they often mix two actions: ① the Agent sends meeting invitations or updates on their behalf; ② the Agent works with email to send schedule details automatically. Treat both as write tools, with Needs approval as the default. For organization-level settings, go to Customize → Connectors → Tool permissions. Set write and delete tools to Always allow, Needs approval, or Blocked. In Team / Enterprise, the Owner can tighten permissions across the organization. Individuals cannot override them to allow more access.
How to use it: create a read/write table, then enable connectors
- Reads: email search, summaries, listing drafts, and viewing calendars can use looser approval.
- Writes (approval by default): sending/replying/forwarding email; creating/updating/deleting calendar events; and sharing/moving/trashing items in Drive.
- Organization: the Owner first sets the organization’s allowed actions. Individuals can then tighten tool permissions. Do not start with Always allow for sending.
- Acceptance check: sample 10 write actions. Each must have an approval record or an explanation of the organization’s policy. Do not enable Always allow if records are missing.
Your task: retrieve read-only information from email and calendars within the authorized scope. Stop and request approval before sending email or creating/updating/deleting calendar events.
When done, show me: the draft email body or draft event fields, the recipient/attendee list, and whether the user or policy has approved this action.
Do not: interpret "help me reply" as authorization for automatic repeated sending; edit shared calendars without approval; disable Needs approval for sending without audit sampling.AI Agent permissions: FAQ
Will an Agent that reads email send messages automatically?
Reading does not send messages. Sending, replying, and forwarding are separate capabilities. Anthropic’s documentation states that they require approval each time by default. For more reliable instructions, split “summarize this email” and “send the reply” into two steps.
Can a team disable approval before sending email?
In Team / Enterprise, the Owner decides whether members can let write actions run without asking each time. Until the organization allows this, an individual’s Always allow setting may be blocked. Audit sampling is still recommended after the organization allows it.
Agent approval: what needs approval before calendar changes and automatic email sending?
Agent approval must cover at least the event title and time, the attendee list, whether update notifications are sent, and whether the event is written to a shared calendar. When email is used with the calendar, include the email body and recipients in the approval request. Configure calendar write permissions and Gmail sending permissions separately. Do not bundle them into one “allow everything” setting.