AI Agent Security

Control AI Agent Activity in Enterprise Email

Email gives AI agents access to untrusted content and real authority. AI model instructions alone are not a security enforcement boundary. CrowsNest Agent Email Proxy gives approved AI agents a controlled way to read and reply in Google Workspace and Microsoft 365 threads.

Separate Agents and Email

Agent Email Proxy provides a data-aware enforcement layer between agents and email. It applies deterministic controls around email actions, even when agent behavior is unpredictable.

Constrain the Agent

Agent sending is disabled by default and must be enabled per tenant. Grant read-thread and send-reply capabilities separately. Limit replies to existing participants, prohibit BCC, and revoke or rotate tenant-bound agent access when required. Security teams can register agents, issue scoped credentials, rotate or revoke access, and investigate the resulting activity without changing ordinary email flow.

Inspect Before Delivery

Route outbound replies through CrowsNest detection and policy. Outbound scanning evaluates sensitive content while thread-participant and BCC restrictions limit where the agent can direct a reply. When a routed reply violates policy, CrowsNest can refuse to send it and create a violation record. Provider transport occurs only after the Agent Email Proxy completes its authorization and policy checks.

Preserve Evidence for Investigation

Record reads, policy decisions, blocked attempts, and completed sends so security teams can reconstruct what the agent did and why the action was allowed or refused.

How it works

A Data-Aware Enforcement Layer Between the Agent and Email

Register the agent. Each approved agent receives a tenant-bound CrowsNest API credential with a hashed stored representation.
Grant only required capabilities. Read-thread and send-reply access are granted separately and can be revoked or rotated.
Keep provider credentials server-side. The agent never receives reusable Gmail or Microsoft 365 provider secrets or tokens.
Constrain the email action. The current API supports replies to existing threads, restricts recipients to existing thread participants, and prohibits BCC.
Inspect before transport. Every reply routed through the CrowsNest Agent Email Proxy is evaluated using CrowsNest detection and policy before the provider transports it.
Record the outcome. Reads, policy decisions, blocked attempts and completed sends are written to the agent activity and investigation record.

Email Data Security in Depth

Inbound email-security products protect people from phishing, malware and business-email compromise. CrowsNest complements these existing controls by governing authorized AI agents’ access to email and the content of routed replies.

Combine Agent Email Proxy scoping with existing identity, IAM and API-access controls at the Google Workspace or Microsoft 365 admin level for defense in depth.

CrowsNest Agent Email Proxy enforces boundaries for the credential paths it controls. Registered agents never receive reusable Gmail or Microsoft 365 provider secrets, so they cannot call Google or Microsoft APIs directly with their own agent identity. Customers should ensure that agents intended to be governed by CrowsNest are provisioned only with CrowsNest-issued credentials*.

* CrowsNest does not police actions taken through a separate provider credential that an organization has issued outside of CrowsNest to the same agent or automation.

Control truth table

CrowsNest Agent Email Proxy Enforcement

Area	CrowsNest Does	CrowsNest Does Not
Agent identity	Tenant-bound CrowsNest credential; separate read-thread and send-reply capabilities; rotation and revocation.	General-purpose identity for every agent, model or tool.
Provider credentials	Keeps reusable Gmail/Microsoft provider credentials inside CrowsNest.	Eliminate the customer-admin authorization required to connect the provider.
Read action	Grants configured read-thread capability to registered agents.	Sanitize all untrusted inbound email or prevent every prompt-injection path.
Recipients	Reply-only behavior; existing-thread participants only; BCC prohibited.	Compose arbitrary new conversations or send to arbitrary recipients.
Send action	Evaluates routed replies against configured CrowsNest detection and policy before provider transport; can refuse a violating routed reply.	Universally block email or stop provider sends that bypass the Agent Email Proxy.
Evidence	Records available agent, request, content-fingerprint, decision and outcome context.	Replace the customer’s SIEM, incident-response process or every compliance control.

Make CrowsNest the Approved Agent Email Path

The Agent Email Proxy is an action boundary, not a network chokepoint. For agents intended to be governed by CrowsNest, do not provision separate reusable Gmail or Microsoft Graph credentials to the agent runtime. Use your Google Workspace or Microsoft 365 identity and application-consent controls to limit alternate mail access, and compare CrowsNest activity with provider audit records during evaluation.

Plan requirement: CrowsNest Agent Email Proxy and API are Business and Enterprise features. For more information, see the Agent Email Proxy Integration Guide.