Email inbox triage & auto-response agent

Email remains the default intake channel for inquiries, orders, complaints and internal requests, and shared mailboxes are sorted by hand. An LLM agent reads each message, decides what it is and how urgent it is, looks up context, drafts an answer from approved knowledge, and routes or files it. Routine classes can be answered automatically; everything ambiguous, sensitive or high-value goes to a human as a ready-to-send draft. The result is shorter response times and less manual sorting.

Problem & value

• Today: staff read every message, forward it to the right colleague, copy data into CRM or ticket systems and write near-identical answers. Shared mailboxes suffer from ownership gaps, duplicate handling and missed urgent mails.
• AI value: consistent classification in any language, instant acknowledgement and first drafts, context lookup (customer, order, contract), automatic filing, and spam/phishing separation.
• Benefit evidence: McKinsey Global Institute estimated that knowledge ("interaction") workers spend about 28 % of the workweek managing email [1]. That figure dates from 2012, so treat it as an order-of-magnitude indicator, not a forecast for your team. Measure your own baseline (see KPIs).

Variants

• Shared functional mailbox (SMB): info@, service@, bookings@ with FAQ-style answers and routing.
• Back-office intake: orders, invoices, applications and claims are recognised and handed to specialised pipelines (AGENT-004, DOC-008) instead of being answered.

How it works

1. mailbox event (Microsoft Graph webhook / Gmail push / IMAP IDLE)
2. pre-filter (spam, phishing, auto-replies, loops, internal noise) [SEC-002]
3. sanitise (strip HTML/hidden text, quote chains, signatures; PII masking if needed)
4. classify (intent, topic, language, urgency, sentiment, sender type)
5. enrich (CRM/ERP/ticket lookup, thread history, calendar)
6. decide policy: auto-reply | draft for review | route only | escalate | ignore
7. generate reply with retrieval from approved knowledge (RAG), cite internal source
8. guardrails (no commitments/prices/legal statements outside allow-list, tone, language, PII leak check)
9. execute with least-privilege tools (draft, label, move, create ticket, send)
10. log decision + rationale; learn from human edits

• Classification: a small LLM or fine-tuned encoder is usually enough and cheap; a larger model is called only for drafting or hard cases. Confidence below a threshold means human routing.
• Drafting: retrieval over FAQs, product docs, policies and previously approved replies; the agent should say "I do not know" and escalate rather than improvise.
• Autonomy ladder: (1) label and sort only, (2) draft in the mailbox, (3) auto-send for a small allow-list of low-risk classes (receipt confirmations, opening hours, status look-ups), (4) wider autonomy only after measured quality. Sending always uses an outbound allow-list and rate limits.
• Human-in-the-loop: complaints, legal threats, financial commitments, health or HR matters, VIP senders, anything with low confidence, and all first-contact external replies in the pilot.

Data preparation

The agent needs three kinds of data: the incoming mails themselves (shared mailboxes such as info@, support@, orders@, usually Exchange/M365 or IMAP), the answer knowledge (FAQs, product sheets, price lists, policies, past answered mails, often scattered across file shares, DMS and individual Outlook folders) and sender context (CRM, ticket system, ERP). Typical gaps are outdated or contradictory FAQs, knowledge that exists only in the heads of long-serving staff, attachments that are scans or photos, duplicate threads, no agreed categories and shared mailboxes with unclear access rights.

Concrete steps: (1) agree on 8-15 categories and an escalation matrix first (PREP-019); (2) export 500-1,000 historic mails and let two employees label a sample as a test set (PREP-018, PREP-020); (3) curate the approved answer base and retire old versions (PREP-013); (4) OCR attachments (PREP-006); (5) pseudonymise exports used for testing (PREP-022) and check mailbox permissions (PREP-023). Tools: Paperless-ngx or an OCR service, a spreadsheet for labelling, n8n for export jobs. Expect roughly 30-40% of total effort to go into data and knowledge preparation, mostly knowledge curation. See also GUIDE-003.

Implementation paths

Which path for whom

• SMB: B. Mailbox, CRM and ERP context have to be wired together, and no off-the-shelf product covers a typical shared-mailbox mix; a thin cloud-API workflow with human approval fits.
• Enterprise: B. Intake is a core customer process with high volume, so API cost, routing logic and audit trail should be under your own control, ideally on a shared internal AI platform.
• Developer: C. Open-weight small models plus a vector store keep message content in-house and are cheap to iterate on.
• Public sector: C. Citizen correspondence is sensitive and procurement favours sovereign hosting, so a self-hosted stack in a government cloud is the safer default.

Path A — Buy (off-the-shelf)

• Mailbox-native assistants: Microsoft 365 Copilot in Outlook (summaries, drafts, and in 2026 Frontier preview inbox actions and rules from chat [2]) and Gemini in Gmail / Google Workspace. Good for personal productivity; limited for shared-mailbox routing with business logic.
• Customer-service email automation: Zendesk, Freshdesk, Intercom (Fin), Salesforce Agentforce Service, plus EU vendors such as Parloa, Userlike, Cognigy (NiCE), Ada-class tools. Pick those with EU hosting and a DPA.
• Email-first tools: Superhuman, Shortwave; EU: Missive (shared inbox with AI). Check data residency and training opt-outs.
• Choose A when: the channel is standard customer service or a personal inbox, and the vendor connects to your ticket/CRM system.

Path B — Build on cloud APIs

• Mailbox access: Microsoft Graph Mail API (change notifications, drafts, categories) [3] or Gmail API with push notifications [4]; IMAP for others. Use app-only or delegated permissions scoped to specific mailboxes (Exchange application access policies).
• Models: EU-hosted options such as Mistral (Mistral Small/Medium via La Plateforme, EU provider), Azure OpenAI in an EU data zone, Claude via AWS Bedrock or Google Vertex AI in EU regions, Gemini on Vertex AI (EU). Use a small/fast tier for classification and a larger one for drafting; structured outputs for the decision record.
• Orchestration: n8n (German-origin, self-hostable), Power Automate, Make, or code with an agent framework (LangGraph, Microsoft Agent Framework, OpenAI Agents SDK, Claude Agent SDK). Tools via MCP or direct APIs, with write actions restricted to drafts/labels/tickets unless auto-send is enabled.
• Choose B when: you need custom routing, ERP/CRM context, and control over the autonomy ladder.

Path C — Self-host (open source)

• Models: open-weight instruct models such as Mistral Small, Qwen3, Llama 3.x or gpt-oss-class models; small encoders (multilingual BERT, bge-m3 embeddings) for classification and retrieval.
• Stack: n8n, Ollama or vLLM, Qdrant/pgvector, Zammad (German open-source helpdesk).
• Hardware: HW2 handles thousands of mails/day with a ~14-30B quantised model; classification-only fits HW1. Operations effort: model updates, monitoring, evaluation set upkeep.
• Choose C when: mail content is highly sensitive (law, health, public authorities) or data must not leave the premises.

Path D — Custom training

Only at high volume: fine-tune a small encoder or LLM on a few thousand labelled mails (reviewer corrections are the data).

State of the art (2026)

• Agentic mailbox features are now built into the major suites: summaries, drafting, rule creation and multi-step actions from chat in Outlook and Gmail. Details and defaults differ by tenant and rollout ring, so verify the vendor documentation [2].
• Cheap routing models make classification economical; the hard part is evaluation. Keep a labelled test set of real mails and re-run it on every prompt or model change.
• Prompt injection is the central security risk. Email is untrusted input that an agent with tools reads; hidden text or crafted messages can try to make it forward data, send mail or change rules (OWASP LLM01 prompt injection, LLM06 excessive agency [5]). Mitigations: separate reading from acting, no autonomous forwarding or external sending of retrieved data, least-privilege tokens, human approval for side effects, output filtering, and quoting mail content as data, not instructions.
• Limits: legal nuance in complaints, long threads, hallucinated commitments (prices, dates), reply loops with other auto-responders.

Shared resources & combinations

• Same building blocks (llm-small + text-classifier + RAG): LANG-012 generic text routing, LANG-002 correspondence drafting, DOC-008 mailroom classification, ticket-resolution agents.
• Downstream specialised agents: AGENT-004 (orders from email), DOC-001 (invoices arriving by mail), AGENT-012 (scheduling replies), AGENT-002 (workflow engine reused).
• Security: SEC-002 phishing detection runs before the agent; share the quarantine and reporting flow.

Effort, cost & KPIs

• Effort: A days to weeks (per-seat or per-resolution pricing); B 4-10 weeks for a pilot; C 2-4 months plus operations. Measure token cost per mail.
• KPIs: first response time, time to correct owner, share of mails auto-handled vs. drafted vs. escalated, draft acceptance rate and edit distance, misrouting rate, customer-satisfaction score, wrong-send incidents (target zero), and security events blocked.

People & change

Involve management and the mailbox owner (department lead) first to fix scope and the rule that nothing leaves the house unapproved at the start. IT and IT security set up mailbox access, service accounts and prompt-injection protections; the DPO is needed early because mails contain personal data, so an AVV with every model provider and a DPIA check are required (systematic processing of correspondence at scale; see GUIDE-005).

Works council: yes in practice. The system reads and logs mail traffic and handling times, so it is objectively suited to monitor behaviour or performance (§87(1) no. 6 BetrVG, BAG); §90(1) no. 3 requires timely information on AI-planned work processes, and the council may call an expert under §80(3). Agree a works agreement that excludes individual performance evaluation (GUIDE-004). In the public sector the Personalrat applies.

Start with a pilot group of 3-5 mailbox users who also act as AI champions. Typical concerns are job loss, wrong replies and surveillance; address them with drafts-only mode, visible confidence flags, an easy override and transparent logs. Measures to support AI literacy (prompt basics, spotting hallucinations, handling injected content) belong in the rollout (GUIDE-006, GUIDE-008). Humans stay in control: approval gates for every new reply class, regular sample audits, and a kill switch.

Risks, regulation & compliance

• EU AI Act: typically limited risk. If the agent replies to people, tell them they are interacting with an AI system unless obvious (Art. 50(1)); AI-generated text published to inform the public on matters of public interest has separate labelling rules. Not high-risk by default, but it becomes high-risk if the same system is used for e.g. prioritising emergency or essential-service requests or assessing job applicants (Annex III). Art. 4 AI literacy applies to staff [6]. Art. 5: do not use the agent for emotion inference on employees' mail.
• GDPR: mailboxes contain personal data and sometimes special categories (Art. 9). Needs a lawful basis, a data processing agreement, EU data location or transfer mechanism, data minimisation (mask before sending to a model where possible), retention rules and a DPIA for broad deployments. Solely automated decisions with legal or similarly significant effect (Art. 22) must be avoided or safeguarded [7].
• Mitigations: allow-lists, draft-by-default, rate limits, audit log, kill switch, sampling of auto-sent mails.

Getting started

1. Export 500-1000 recent mails from one shared mailbox, anonymise, label by category/owner, and measure the baseline.
2. Start at autonomy level 1-2: classify, label and draft only; no automatic sending.
3. Build the evaluation set and compare 2-3 models (a small EU-hosted one against a larger one).
4. Add retrieval over approved FAQs; enable auto-reply for 1-2 trivial classes with an outbound allow-list.
5. Complete DPA/DPIA, works-council agreement and prompt-injection tests; review KPIs weekly before widening scope.

Sources

1. McKinsey Global Institute — The social economy (2012) — https://www.mckinsey.com/industries/technology-media-and-telecommunications/our-insights/the-social-economy
2. Microsoft 365 message center MC1293485 — Copilot in Outlook inbox management (Frontier) — https://www.itelio.com/en/microsoft-message-center/MC1293485
3. Microsoft Graph — Outlook mail API overview — https://learn.microsoft.com/graph/outlook-mail-concept-overview
4. Google — Gmail API push notifications — https://developers.google.com/gmail/api/guides/push
5. OWASP — Top 10 for LLM Applications — https://genai.owasp.org/llm-top-10/
6. Regulation (EU) 2024/1689 (AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj
7. Regulation (EU) 2016/679 (GDPR), Art. 22 — https://eur-lex.europa.eu/eli/reg/2016/679/oj
8. n8n — workflow automation (self-hostable) — https://github.com/n8n-io/n8n
9. Zammad — open-source helpdesk — https://github.com/zammad/zammad