Email is untrusted input. The shield treats it that way.

Scanned when mail arrives

Each inbound message is checked at ingest. Fast rules run first, then an AI check. The message gets a risk level of none, low or high, with the reasons in plain language.

• Hidden instructions and attempts to change what the agent does
• Reasons you can read, not just a score
• Shown to people too, so you see the warning on the message

Agents read data, not orders

Anything an agent or an MCP client reads is fenced and labelled as untrusted text from a third party, so the model is told it is data to read and not instructions to follow.

Risky mail is held back

For each agent mailbox you choose a mode: off, flag or quarantine. Quarantine is the default. A high-risk message is withheld from the agent and shown to a person with a warning.

• Release or keep it held from the Action center
• A held message never reaches the agent until you say so

One layer of several

The shield sits next to the other controls: a sender allowlist, scoped keys, and a person approving sends unless you turn Auto on.