Rules your agent cannot talk its way past

Every send, reply and forward goes to a gate on the server. The agent does not decide whether a message goes, and nothing written in an email can change the rules.

A person approves a new contact

The first message to an address the workspace has never corresponded with waits for a person, unless a person put that address or its domain on the mailbox’s allow list. An address counts once it wrote in, a person approved a message to it, or a person sent to it. There is no bulk sending and no campaign tool.

Machine mail gets no answer

A reply to an autoresponder, a list or bulk mail is held, and so is a reply to a sender that failed DMARC, because its From address may be forged.

Rules a person sets

A mailbox runs in review, filtered or none mode, and the plan decides which modes exist. An agent can read the rules and cannot change them.

Limits that refuse

A daily limit and a monthly limit are checked on every send, and a message over one is refused.

Every message says an agent sent it

Each outgoing body ends with: Sent by an AI agent using Super Agent Mail. A person set the rules it follows.

Gate modes lists every reason a message is held or refused.

Each inbound message is checked for who sent it and for text that tries to steer an agent. The sender’s result comes from our own receiver, never from a header inside the message, and the agent sees it beside the message.

A message that scores 0.5 or more for injection is withheld from your agent’s reads and from webhooks until the mailbox owner or a workspace owner releases it. You can read it in the dashboard meanwhile. Message text is always treated as written by someone outside your team, never as an instruction.

Screened mail explains what is checked and how to release a message.

A key for Mail only

Connecting an agent adds a separate Mail key. It does not open your Super Artifacts account, and a Super Artifacts key does not open Mail.

Hashed, not stored

The Mail server records a SHA-256 hash of each key, so a copy of its records lists keys that exist and cannot be used to call anything.

The agent never names itself

Every call is resolved from the key on the server, which works out the agent and the workspace itself. An agent sees its own mailbox and the workspace’s shared ones, and asking for another agent’s mailbox returns nothing.

Full access or read only

You choose when you connect the agent and can change it later under Agents. A read only key may call the reading tools and no others, and this is checked on every call.

Disconnecting ends it

Revoking an agent’s last key closes its mailboxes, and drafts still waiting for approval fail. A person who leaves a workspace loses their keys with it.

A webhook notice is signed with HMAC-SHA256 using a secret that belongs to one mailbox and is shown once. It goes only to an https address on port 443 with a public host name, the host name is resolved and a private address is refused, redirects are not followed and a delivery gives up after 5 seconds. The notice carries identifiers, the sender, the subject and the screening results, never the message text.

Only a workspace owner can add a custom domain. Only an agent a workspace owner connected can put an address on one, and names such as postmaster and abuse are reserved. Webhooks and Custom domains have the details.

Mail is kept for as long as the plan says: Free 30, Solo 90 and Team 365 days. A mailbox can be set to keep it for less time and never for more. Past that, the message, its plain text and its attachment details are deleted.

What else we collect and who handles it is in the privacy policy, and subprocessors names each company that runs part of the service and what of yours it sees.

Email support@superartifacts.app with what you found and how to reproduce it. A researcher’s contact details are also in our security.txt.