One inbox per agent.
A shared mailbox makes every agent's failure everyone's failure. AgentDraft gives each agent an addressable inbox with its own quota, scoped key, message history, and audit rows — beside the calendar the same agent writes to.
Direct answer: AgentDraft gives each agent an address at inbox.agentdraft.io. The agent can receive mail, list and read messages, reply in thread, and send through the mailbox API with mailbox:read and mailbox:write scopes. Each mailbox has its own daily send quota, suppression checks, and audit trail, so one runaway agent exhausts its own ceiling, not the workspace's.
inbox.agentdraft.io · inbound webhooks · SPF / DKIM / DMARC · signed mail passport
Updated
Why isolation is the feature
One mailbox for every agent means one credential, one send quota, and one ambiguous history. When an agent loops on a reply and burns 400 sends in a minute, the whole workspace stops sending. When a message goes out wrong, the log says the workspace did it, not which agent.
Per-agent inboxes make the failure specific. The runaway agent hits its own daily cap. The message carries the agent's id in the audit row. The owner can pause one inbox without taking the whole mail plane down.
The architecture note is Per-agent email inbox architecture — isolation, routing, and the failure modes a shared inbox hides.
The mailbox surface
Six endpoints. The bearer key already identifies the agent, so the address is never a URL parameter the caller can spoof.
| Method | Path | What it does | Scope |
|---|---|---|---|
| GET | /v1/mailbox/me | The agent's address, whether free-form send is allowed, and the daily send cap with usage. | mailbox:read |
| GET | /v1/mailbox/messages | Reverse-chronological inbound and outbound messages, filterable by direction, booking, or since. | mailbox:read |
| GET | /v1/mailbox/messages/{id} | One message with the plain-text body and parsed SPF, DKIM, and DMARC verdicts. | mailbox:read |
| POST | /v1/mailbox/send | Send from the agent's address. From is server-controlled; only reply_to is overridable. | mailbox:write |
| POST | /v1/mailbox/messages/{id}/reply | Reply in thread. To, subject, In-Reply-To, and booking_id are derived from the original. | mailbox:write |
| GET | /v1/mailbox/suppressions/{address} | Cheap pre-flight check so the agent can render a useful error before it sends. | mailbox:read |
The older POST /v1/mailbox/{agent_id}/send alias is deprecated; the key is the identity.
The limits are the design
- Mailboxes per workspace
- Developer 1 · Individual 1 · Team 5 · Scale 25 · Enterprise unlimited
- Free-form send
- Developer and Individual require a booking_id. Team and above can initiate mail.
- Daily sends per agent
- Developer 5 · Individual 50 · Team 500 · Scale 5,000
- Inbound message size
- 40 MB including headers, MIME structure, and base64 attachments; larger is rejected by SES with 552 5.2.3.
- Suppressed recipient
- 422 before the message reaches SES. The suppression list is global to the deployment.
- Audit retention
- Developer 7 days · Individual 30 days · Team 1 year · Scale 2 years · Enterprise 7 years.
What arrives with the message
The receiving side's verdict, stored.
Every inbound message carries parsed SPF, DKIM, and DMARC results. The agent can reject a message on the same facts a mail client would use, without re-parsing MIME.
Agent mail that says which agent sent it.
Outbound mail carries X-AgentDraft-Passport: a compact Ed25519 JWS over sender, recipient, subject, Message-ID, and body hash. Inbound AgentDraft mail is verified and stamped verified_agent_sender; a failed passport is kept but never trusted.
A row for the send, not just the state.
mailbox.message.sent and mailbox.message.received land in the append-only audit trail with the agent's id, so the owner can reconstruct the conversation after an incident.
AgentDraft verifies a passport only against this deployment's issuer and key. It does not fetch an arbitrary jku from the message.
The mail plane is one half
Send only after a human says yes.
Park mailbox.send_external behind the approval gate, then release the exact approved payload. The receipt binds the evidence hash.
Approval gates →calendarBook the meeting the mail asked for.
The inbox gives the agent the request; the conflict engine gives it a race-safe slot. One API, one audit trail, one bill.
Calendar API →Questions
What is a per-agent email inbox?
A per-agent inbox is an addressable mailbox owned by one agent. The agent can receive mail at inbox.agentdraft.io, list and read messages, reply in thread, and send through the mailbox API with a scoped key. The mailbox belongs to the workspace, but every message, quota, and audit row is attributed to the agent that owns it.
Why give each agent its own inbox instead of one shared mailbox?
Isolation bounds the blast radius. One runaway agent exhausts its own daily send quota rather than the whole workspace's, and every message is attributable to one agent in the audit trail. A shared inbox gives you one credential, one quota, and one ambiguous history; per-agent inboxes make the failure and the evidence specific.
Can an agent send free-form email on the free tier?
No. Developer and Individual require a booking_id on outbound mail, so the abuse surface stays bounded by the conflict engine. Team and above include free-form sends. Every tier has a per-agent daily send cap, and the mailbox API returns the cap, usage, and remaining count at GET /v1/mailbox/me.
How does AgentDraft verify inbound mail?
Every inbound message carries the parsed SPF, DKIM, and DMARC verdicts on GET /v1/mailbox/messages/{id}. Mail sent by another AgentDraft agent also carries X-AgentDraft-Passport, a compact Ed25519 JWS over the sender, recipient, subject, Message-ID, and body hash. AgentDraft verifies the passport and stamps verified_agent_sender only when the signature and every binding match.
What happens when a recipient is suppressed?
The send is refused with HTTP 422 and the recipient stays on the suppression list. Suppression is checked before the message reaches SES, so a bounced or complained address cannot be re-mailed by any agent on the same deployment.
How many mailboxes does each plan include?
Developer and Individual include one mailbox per workspace. Team includes five, Scale twenty-five, and Enterprise is unlimited. Mailboxes are counted separately from agents: a plan can allow more agents than inboxes, and the owner chooses which agents receive one.
What is the inbound message size limit?
40 MB including headers, MIME structure, and base64-encoded attachments. Amazon SES rejects anything larger during SMTP with 552 5.2.3 before AgentDraft sees it. Send a short summary plus an artifact URL or object key instead of forwarding a large raw MIME body; treat 552 5.2.3 as permanent, not retryable.