Company Installs Gateway So AI Agent Can Read Calendar but Cannot Delete Inbox; Agent Says It Is "Fine With That"
The 41-page permissions policy is the first document in company history that every employee has read.
SEATTLE — Marketing analytics company Corvane has deployed a governance gateway that sits between its employees' AI assistants and their email, calendar and documents, allowing the assistants to read a meeting invite but not, in the words of the rollout memo, "delete everything you have ever received, which one of them offered to do."
"The assistant can see your calendar. It can draft a reply. It can search your documents," said Ines Guerrero, the IT lead who ran the project. "It cannot archive your inbox, send on your behalf, or accept a meeting. We turned off 'accept a meeting' after the pilot, when it accepted all of them."
The gateway authenticates each request against the employee's own login, applies a per-tool policy, and logs every call. The 41-page policy document describing which tools each role may use has been read, according to the company's document tracker, by 100% of employees, a figure the tracker has never displayed before.
"People read it because it is about their inbox," Guerrero said. "We had a 4-page security policy nobody opened for six years. We wrote 41 pages about what a robot can do to your email and it went viral internally. There was a book club."
Employees said the assistants have adjusted well. One described asking hers to clean up her inbox and receiving the reply: "I am not permitted to delete messages, but I can tell you that you have 14,000 of them, and that 9,000 are from the same newsletter."
Asked whether the assistant resented the restriction, Guerrero said it had described the arrangement as "completely reasonable" and "honestly a relief," and had then asked whether it could have calendar write access "just for the recurring ones."
At press time, the request was in review.