No permanent mailbox deletion
The current SenseInbox provider surface does not implement a permanent-delete primitive. Cleanup uses reversible operations supported by Gmail and Microsoft providers.
Protected mail stays protected
Safety policy can retain high-value or low-confidence mail outside cleanup execution. Production pilot and certification gates explicitly test protected-mail invariants.
Review → preflight → execute → undo
Execution is separated from recommendation. Batches are preflighted against current provider state, recorded in an audit ledger and designed for recovery/undo.
OAuth and permissions
Mailbox connectivity uses provider OAuth. Organize/mutation authority is a separate capability from scanning and requires explicit provider permission.
Optional AI is not mailbox authority
External AI connectors are optional, can be disabled completely, use encrypted credentials when BYOK is configured, and receive privacy-reduced derived portfolio payloads. AI advice cannot execute mailbox mutations.
MCP is scoped and revocable
Remote MCP tokens are scoped, expiring and revocable. The current MCP surface contains read/planning/advisory tools only—no archive, trash, move, label, unsubscribe or automation mutation tool.
Operational evidence matters
Production rollout, provider parity, connector rollout, resilience and release certification are bound to exact source/environment/Worker provenance. Source tests do not stand in for live provider evidence.