Everything your AI can do with your email, and exactly how much you let it.

Reads your email the way you would, and marks nothing read

Ask what came in overnight and it lists the folder with the first line or 2 of every message, the quoted history and the signature stripped off, so the shortlist is built without opening anything. Ask for the invoice from the plumber and it searches the mailbox itself, as many as 25 folders in one call, matching the words you gave it. Ask to be caught up on the thread with the surveyor and it reads the whole conversation in one call, oldest first.

Reading never marks anything read. Marking a message read is an action you ask for, never a side effect of the AI looking at it, so your unread count still means what it meant this morning. That is one of 5 promises, each checked by opening the mailbox in a mail client afterwards rather than by trusting what our own code reported, on a live mailbox of 26,930 messages.

So the AI can go through your inbox for you, and you still open Outlook to the inbox you left, with nothing touched that you did not ask to be touched.

Sends, replies and forwards in the thread, from any of your addresses

A reply carries the 2 headers a mail client reads to decide where it belongs, In-Reply-To and References, so it nests under the original in Outlook and Gmail exactly as if you had written it, and the original is marked answered so your own client shows the reply arrow. A forward carries the original's attachments and inline images under the forwarded-message block a real mail client produces. A reply-all subtracts every address on your mailbox, so you are never copied in on your own thread.

If your mailbox can send as more than one address, so can this, and each alias carries its own display name and signature, set in your account rather than by the AI. Exactly one copy is filed in Sent Items, with the same Message-ID the recipient received. Attachments arrive byte for byte: a real send of a JPEG and a ZIP came out SHA-256 identical at the far end. About 5 seconds to an external domain through Microsoft Graph, about 10 over SMTP, both timed.

So what your AI sends looks, threads and files exactly like what you send, and the person at the other end cannot tell the difference.

Files, flags, archives and junks, in bulk when you ask

Up to 500 messages move between folders in a single call, which turns "file a year of newsletters" from an afternoon into one request. Folders can be created, renamed, or moved under a different parent with their sub-folders, and a folder it creates is subscribed, which is the difference between a folder that appears in Outlook and one that exists but never shows up. Messages are marked read, unread or flagged in the same batches. Deleting moves a message to Trash, exactly as your own delete button does, so it is recoverable.

Archiving goes where your own Archive button would have put it, and that is a different place on each service: Microsoft 365 has a folder called Archive, most IMAP hosts have none until one is created, and Gmail has no archive folder at all, because archiving there means the message leaves the inbox and carries on living in All Mail. Reporting spam is the same move your spam button makes, which is what teaches your mail server's filter to catch the next one, and rescuing a message the filter got wrong returns it to the inbox with the date it originally arrived.

So the tidying happens the way you would have done it, and nothing is filed anywhere you would not have put it. The filing guide walks through a real clear-out.

Your calendar too: Google, Microsoft 365 and CalDAV

Connecting a mailbox does not connect a diary. That is a separate step, and there are 3 routes to it: calendar access approved on a Microsoft 365 sign-in, a Google sign-in for Google Calendar on any mailbox, or the address of a CalDAV calendar server, which Fastmail, iCloud, Nextcloud and most mail hosts run beside the mail. Once one of them is connected, the AI reads the diary, checks who is free, finds a time that works, and books, moves and answers meetings, with the 21 calendar tools arriving in full on Microsoft 365 and in whatever set the other route supports.

Unknown is never rendered as free. When somebody's calendar cannot be read, a different organisation or a permission never granted, the answer for that person is unknown, and what comes back for other people is busy and free, never the subjects of their meetings.

So a meeting is booked into a slot the AI could actually see, and the invitation goes out in your name only at the level you allow. The scheduling guide covers a week of real bookings.

Read only, draft, or send: a permission level per connection

Every connection an AI client makes by signing in carries one of 3 permission levels, chosen on the consent screen when you approve it. Read only: looks, and changes nothing. Draft and file: prepares and tidies, and nothing leaves. Send and delete: everything, including what cannot be taken back. Each contains the one below it, and a calendar switch beside the level decides whether the diary comes with it.

It is per connection, not per mailbox. Claude on your laptop can be Read only while ChatGPT on your phone is Draft and file, on the same mailbox, and either is changed on the mailbox's Connector tab in the control panel without reconnecting, obeyed on that client's next call. Whether to let Claude send emails at all is the same choice: only Send and delete can. A connection below the top level is not shown the tools above it at all, so the model is never offered send_email and never spends a turn finding out it cannot use it. The tool reference lists every tool under the level that reaches it.

So AI email read-only access, "can I let it read my email but not send anything", is a setting you make once, per client, rather than a promise the client makes.

A refused tool says what it is, so the AI stops asking

A client that calls a tool its level or the mailbox limit does not allow is refused as an ordinary tool result, before the call is metered, with one sentence naming what refused it and where to change it. When the limit is what refused it, the sentence names the limit rather than the connection, because the limit is the control you would have to change. This is the sentence a mailbox limited to Read only hands back to any client that tries to send from it:

This mailbox is limited to "Read only" in the control panel, so no connection can send from it. The mailbox owner can change that under the mailbox's Connector tab.

A tool no level has ever placed, a typo or a name the model made up, is answered with there is no tool called that on this connection, with the name quoted back. A refusal by the level or the limit is recorded on the Activity tab as a failed call, with Not allowed on this connection: in front of the reason, and the note ends (mailbox limit) where the limit was the wall.

So the AI is told, in words it can relay to you, what it may not do, instead of trying again or telling you something went wrong.

Every call the AI made, on the Activity tab

Every call any AI client makes to your mailbox is a row on the Activity tab: when, which tool, which mailbox, who made it, whether it worked, how long it took and the address it came from. Filter by period, mailbox, tool and outcome, and the chips count reads, writes and irreversible calls separately. A call that partly succeeded says how far it got rather than rounding itself up to a success.

The record holds the fact of the call, never the contents: no subject, no address, no line of a message, because none of that is stored anywhere. A refused call is recorded as failed, with the reason; a download or an upload is recorded as the message and a file count, never a filename. Until 12 September 2026 every row was recorded as a success whatever the tool returned, and the changelog says so rather than leaving you to trust the older rows.

So "what did the AI actually do in my mailbox last week" is a screen you open, an audit log of what the AI did, rather than a question you have to put to the AI.