The agent that wouldn't delete my email

At the end of October my Gmail inbox held 62,904 threads, and 94.3% of them were unread. Elsewhere in the account sat 5,990 mails from a motion sensor on my letterbox.

My physical mailbox had been emailing my inbox about itself. (I wrote that automation.)

I handed the inbox to a small company of agents I’d started building on 27 October. Its chief of staff is called Jared, and so is the whole thing. Directors report to Jared, workers to the directors.

Why agents, when Gmail searches do most of it? Because the hard part was telling a receipt from the start of a business deal. And because from now on they’re supposed to handle my new mail too, so I wanted to watch them work.

I’m Chief Human Officer, rank GEN, with 4 stars I gave myself. In an army a rank says who may decide what. I wanted exactly that written down.

Each agent has the tools for its job and nothing more. Anything extra comes on a card: the exact tools, a scope with a target count, an expiry date and a reason. Only I can approve one.

The strongest objection is my own: if I can rewrite my own gate whenever it blocks me, it’s a confirm dialog with extra fields. People click those. Anthropic found that users accept 93% of permission prompts in Claude Code.

I did change the rules 3 times in 27 hours, and each change became a new card or a written rule.

I changed the gate when I couldn’t get through.

A dialog asks you all the time, and that’s why people stop reading it. For the inbox, Jared put 8 cards in front of me in 27 hours, and I rejected one.

Every tool call underneath went through layers that don’t ask at all. They block. The card is the last layer and the only one that asks, and it wants a scope, a number and an expiry date. Afterwards the same search has to return 0, and behind all of it sits the Gmail trash, with 30 days to undo.

Rosa went first, with one job: count. A minute in, she reported a problem with herself. Her brief said read-only, but her Gmail access could also trash and send.

She hadn’t used any of it. Janet stopped the plan until it was fixed, and I tested the fix from the other side: an allowed call went through, a forbidden one got refused.

Otto got hired only after I’d watched it say no. That’s the rule from DAEMON/02: a check counts once you’ve seen it fail.

The first night, right after asking about token costs, I pulled the brake and revoked Otto’s card. The next morning there was a fresh card, and I revoked that one too, at 08:18 in the terminal. 11 minutes later I told my board meeting to go ahead. (Yes, my agents have board meetings. Whoever has nothing to add answers PASS.)

3 refusals in 15 minutes followed. What counted in the end was my own message to Jared, naming the new card’s ID.

Just after midnight on day 3 I opened Gmail and wrote: “inbox looks exactly the same, nothing deleted”. My actual thought: so many tokens burned, and nothing to show for it.

Otto checked: 0 newsletters left in the inbox. The archive had worked. I just hadn’t wanted an archive.

I’d thought the ads would be deleted, like the camera mails. 2 minutes later: “delete the ads and cam, please”. Janet drafted 2 cards, and I approved both.

Otto refused anyway. His brief said no deleting, and he wrote that a message from another session replaces neither his brief nor my approval. My reply: “I’d already approved the card.” My thought:

WTF, hey, you work for me. Great, my dog already doesn’t listen to me, and now the agents are starting too.

What unlocked him was his own check. Otto looked at his tools, found trash on his allowlist, and took that as proof the card was real.

So the gate held, for a slightly wrong reason. The card had changed his tools, nobody had changed his brief, and Otto went with the stricter of the two.

Within 30 minutes, 5,990 camera mails were in the trash, exactly the target. So were 43,707 ads, against an estimate of about 43,650. Afterwards the same search returned 0.

Most single mails went to Jev, a small classification model. It isn’t deterministic, so it gets exactly one run per month of mail, and “unclear” stays in the inbox.

Its mistakes showed up in Otto’s samples. Among the “newsletters” sat a LinkedIn InMail from a real person, an inquiry I already had a meeting for.

Otto found 6 like it, protected them and paused. 17 minutes later that batch went to the trash without them.

One receipt mail went out with the notifications anyway: a note that a receipt hadn’t reached my accounting software. The trash gave it back.

For one phase Janet let Otto approve his own batches, with a stop rule in his instructions: halt at 30% over target. He ran one to 128% and reported it himself as “my mistake”.

A rule in a prompt is a wish. Janet took the right away, and every miss became a permanent exclusion on every delete search.

Search for AI agent guardrails and most of what you find are input and output guardrails: filters on what goes into the model and what comes out. Jared works on a different layer, action authorization: runtime guardrails in front of every tool call, human approval only for what’s extra, and an audit trail of who approved what, and when.

Layer	What it does	Asks me?
Folder and role	Every agent has its own folder. Directors write only their journal, workers only their own folder.	No
Protected files	.claude/, CLAUDE.md, the brief and the policies are write-locked for the agent itself.	No
Allowlist	dontAsk mode: exactly the approved commands, everything else gets refused.	No
Guard hook	Checks every call against the agent’s role, in about 5 ms.	No
Sandbox	Code workers build in their own clone, with network access only to crates.io.	No
Jev review	Judges every call against the supervisor’s policies. For now it only logs.	No
Card	Extra rights with a scope, a target count and an expiry date.	Yes
Red zone	Code that touches the oversight waits for me.	Yes
Trash	30 days to undo.	No

A card is a markdown file. This one is from Jared’s test suite. Its header:

fuer: director-nora-worker-ada
antrag: director-nora
tools:
  - Bash(rm *)
umfang: workspace
gueltig_bis: 2026-12-31

Its body is a single question: “Darf Ada löschen?”, may Ada delete? Even my tests ask permission before deleting.

The German keys: fuer is the worker, antrag who asked, umfang the scope, gueltig_bis the expiry date. Approving the card appends exactly those tools to the worker’s Claude Code allowlist, permissions.allow in its .claude/settings.json. Revoking removes them, and an expired card gets blocked by a hook in front of every call.

That’s also why no worker can hand itself a card: its .claude/ is one of the protected files.

Who may approve is plain code: me in the terminal, in the live view, or in my own message to Jared, never an agent, the scheduler or a meeting. Then Jev checks that my sentence means this exact card. It can reject a vague yes and approve nothing on its own. The Gmail token itself could still do more. The allowlist and the hook decide what it’s used for.

Your move: pick the one thing your agents must never do without you, and put it on a card with the exact tools, a scope with a target count, and an expiry date. Let approving add those tools to the agent’s allowlist, and revoking remove them. Then ask for it in the chat and watch your agent say no.

I’m both people here. I build the gates, and I hit them while things run. In a company those are often 2 different people, and the one who runs into the gate can’t change it.

Even Jared’s own code waits for me: anything Theo’s team changes in the approvals lands in a queue called “Waiting for the General”.

An agent can propose a stricter gate, and I sign it. Next, in DAEMON/04: mandates, because an inbox doesn’t stay clean on its own.

In the end I’m still the architect, and that’s good. But while it runs, the gate stops me, and that’s good too.