Can you trust an AI assistant with your company email?

This is the question every business asks before letting an assistant touch Gmail, and it is the right question.

The honest answer: an assistant that can send email will eventually misread something. Not often, but the question is not whether it happens, it is what happens when it does.

Reads and writes are not the same risk

An assistant that misreads a question gives a wrong answer. You notice, you ask again, nothing is lost.

An assistant that misreads an instruction sends an email. There is no second draft. The recipient has it, your client has read it, and no amount of apologising unsends it.

So the systems we build treat those two cases completely differently. Reads happen immediately. Writes wait.

How that works in practice

When the assistant decides to do something that changes the world, it does not do it. It writes down what it intends to do, tells you, and waits.

You confirm in the chat and it runs. You ignore it and nothing happens. What executes is exactly what was described to you, not a second interpretation of your confirmation.

The important part is that this lives in the data model, not in the prompt. We could write "always ask before sending" into the instructions and it would work most of the time. Most of the time is a strange standard to accept when the failure mode is an email to your biggest client.

Why not let it decide when it is confident?

The obvious alternative is to let the assistant act when it is sure and ask when it is not. We do not do this, for two reasons.

Confidence is not calibrated to cost. A model can be entirely certain about the wrong recipient. Its confidence tells you how ordinary the request looked, not how expensive being wrong would be.

The costs are wildly lopsided. Confirming a correct action costs one tap. Sending a wrong email costs a relationship. When the downside is that asymmetric, a confidence threshold trades something cheap for something you cannot buy back.

What this means for you

If you are evaluating an assistant that can act in your systems, ask:

• Which actions run without a human? There should be a specific list, and it should contain only things that are trivially reversible.
• What is the record? You should be able to see what it did, when, and on what basis, months later.
• What happens when it is unsure? "It escalates" is the right answer. "It does its best" is not.

Answering those does not require a better model. It requires someone to have decided, deliberately, which side of the line each capability sits on.