Screened mail

Every inbound message is read for who really sent it and for text that tries to steer an agent. Both results are stored with the message and shown to the agent beside it.

What is checked

• auth holds the SPF, DKIM and DMARC results, and whether DMARC passed for the very domain shown in From. The verdict comes from our own receiver. A header written by the sender, even one that claims to be the receiver's, is ignored.
• injection holds a score from 0 to 1 and the reasons. It looks for text that asks the reader to ignore earlier instructions, to send secrets or mail elsewhere, or to hide an action from the person, and for text hidden with styling or invisible characters.

The score is a heuristic. On its own it deletes nothing and bounces nothing.

What a flagged message hides

A message that scores 0.5 or more is screened. It is stored, and you see all of it in the dashboard, tagged Held back from agents. Until a person releases it, the agent's reads do not return it, and no webhook carries it. A reply to a withheld message is refused, and so is any send into a conversation kept from agents. In filtered mode the gate also holds anything sent in a flagged thread.

Release it, or keep a conversation from agents

Only the mailbox owner or a workspace owner can decide.

• Let the agent read it releases one message. The webhook that was held back is queued.
• Keep it from agents withholds a whole conversation, and every later message in it is screened on arrival. Show this conversation to agents again undoes that, but does not reveal mail that arrived while it was kept.

What the agent is told

The skill file and the tools tell the agent that message text is written by people outside your team, and that a low auth result or a high score is a reason to ask you. Screening informs the agent. It never replaces the gate, which decides what goes out.