Gmail and email AI agents: draft, summarise and send with guardrails

What you can build

How to connect Gmail and email

1. 01Choose the sending API: the Gmail API with an OAuth token, or a transactional provider with an API key. Store the credential on the tool's auth settings.
2. 02Create an HTTP API tool for sending with the safety level write_sensitive and requires approval enabled, and a body template for to, subject and text.
3. 03If the agent reads mail, create a separate read tool with sensitive_read and a read-only flag, and limit the number of messages it returns.
4. 04In the agent's Guardrails tab, add blocked topics and deny rules for content the agent must never send.
5. 05Attach the tools, run a test that drafts and sends, and confirm the send waited for approval in the trace.

Example tool definition

The shape a tool takes in the AgentRow builder API. Credentials are stored on the tool's auth settings, not in its configuration, so they never reach a prompt. Placeholders in double braces are filled by the model from the input schema.

{
  "name": "send_email",
  "type": "http_api",
  "description": "Send an email. Use only after the user approved the recipient, subject and body.",
  "auth_type": "api_key",
  "safety_level": "write_sensitive",
  "requires_approval": true,
  "config": {
    "method": "POST",
    "url": "https://api.example-mail.com/v1/messages",
    "headers": { "Content-Type": "application/json" },
    "body_template": { "to": "{{to}}", "subject": "{{subject}}", "text": "{{text}}" },
    "allowed_domains": ["api.example-mail.com"]
  },
  "input_schema": {
    "type": "object",
    "properties": {
      "to": { "type": "string", "description": "Recipient email address" },
      "subject": { "type": "string" },
      "text": { "type": "string", "description": "Plain-text body" }
    },
    "required": ["to", "subject", "text"]
  }
}

What the run trace shows

Every call appears in the run trace with the rendered request, the response status and body, timing, retries and errors, plus what the model was shown of the result. If the model never called the tool, the toolbox step shows whether it was bound for that model call and why.