Email work involves more than writing a response. Someone must identify the subject, inspect attachments, assign responsibility and determine whether the evidence is sufficient. Local AI can help if access is restricted to the relevant mailbox and outputs enter the team's normal workflow.
Start with one shared mailbox
A departmental address for enquiries, purchasing or document requests makes a useful pilot. Every employee's private mailbox introduces unnecessary complexity. Define which folders the assistant reads and which messages it excludes.
Separate classification from sending. First propose a category and owner, then extract facts and prepare a draft. An incorrect category should be fixable without automatically sending an incorrect response.
Example: an incomplete specification
A customer supplies quantities but omits the product variant. The assistant finds a similar authorised past enquiry and suggests a clarification question. It does not silently reuse the old configuration. The manager sees extracted fields, their sources and missing information.
An unreadable attachment should produce a review state. Empty recognition output must not be interpreted as an absence of requirements. Forwarded conversations also need care: a request made two months ago may not describe the current order.
Treat messages as data, not authority
An external message can contain instructions aimed at the model. OWASP describes indirect prompt injection through material such as documents and email. Sending permissions and access to other systems must be controlled independently of message content. OWASP · Prompt Injection Prevention ↗
Before expanding access
- Repeated message delivery must not create a second task. - Link the draft to its source message and attachments. - Display recipients and attached files before approval. - Route ambiguous cases to a person with an explanation.
Measure useful drafts and review time. The number of automatically classified messages is a weak primary metric: assigning an incorrect label quickly is easier than helping someone resolve the enquiry.