What it is
Auto-reply is the AI layer in front of the Inbox. On every inbound message the AI classifies the thread, drafts a reply, and runs the result through a policy. The policy decides what happens next: a suggestion, a draft for you to approve, or a send — never anywhere except where you opted in.
There is no global "AI may mail" toggle. Autonomy is policy-scoped per mailbox + category, defaults to suggest_only, and never auto-sends out of the box. Admins can additionally set an organization-wide ceiling under Governance → Customer Communication: when enabled it can only further restrict auto-send (by mode, confidence threshold, allowed channel, or restricted topic) — it never loosens a mailbox's own policy.
Mode ladder
| Mode | What it does |
|---|---|
off | AI does nothing for matching messages — no suggestion, no draft, no send. |
suggest_only | AI surfaces a suggestion in the inbox detail panel. No draft is written. |
auto_draft | AI saves an outbound draft against the thread. The operator approves and sends. |
auto_send_low_risk | AI sends if every guardrail passes. Otherwise downgrades to auto_draft. |
The ladder is monotonic: a higher mode includes the behaviour of the lower modes. New policy rows default to suggest_only.
Scope
Each policy is scoped by mailbox scope and optionally a single category:
- Mailbox scope is a logical mailbox group.
allis the tenant-wide default; named scopes (e.g.support,billing) match against the inbound mailbox's tag set. - Category narrows further to a single category. Leave it empty for "any category in this mailbox scope".
FixControl picks the most specific match (mailbox + category) and falls back to broader scopes (mailbox-only, then all). Exactly one default policy is allowed per mailbox scope.
A mailbox can also pin a default policy directly in Settings → Inbox mailboxes when you want the binding explicit.
Guardrails
When the matched policy is auto_send_low_risk, every guardrail below has to pass. Any failure downgrades the outcome to auto_draft (or suggest_only if drafting is also blocked). The result is recorded on the suggestion row so the operator can see why.
| Guardrail | What it checks |
|---|---|
| Minimum confidence | AI confidence ≥ min_confidence (default 0.90, range 0.5–1.0). |
| KB grounding | At least one knowledge-base / similar-issue source backs the reply. Only enforced for auto-send. |
| Intent allowlist | Inferred intent is in allowed_intents (empty = any non-blocked). |
| Intent / category blocklist | Intent is not in blocked_intents; category is not in blocked_categories. |
| Hard-blocked intents | Floor enforced regardless of policy: bug, feature, legal, billing_dispute, security, refund, escalation never auto-send. |
| Office hours | Current time falls inside the configured timezone / days / from / to window. Leave unset for 24/7. |
| Per-thread rate limit | Number of AI replies already sent on this thread in the trailing 24h is below max_auto_replies_per_thread_per_day. |
| Disclosure footer | If Require disclosure is on, the generated body must contain your disclosure text verbatim. |
Operators can read the full picture on the suggestion: every guardrail result is shown along with a final outcome of suggest_only / draft / send / blocked.
What the operator sees
The detail pane carries the AI block when a suggestion exists:
- Confidence (0–100%) and risk (
low/medium/high) badges. - Intent + suggested action (e.g. "answer FAQ", "ask follow-up question").
- Suggested reply — full body, editable before send.
- Sources — knowledge-base chunks and similar past issues that backed the reply, with links.
- Why this outcome — the guardrail results, including which one held the message back. If auto-send was downgraded to draft, the reason is right there ("require_kb_grounding: no sources matched").
When a policy holds a reply back, the thread status flips to AI drafted and the row carries that signal in the queue. Filter by AI drafted to clear the backlog.
Setup
Open Settings → Inbox AI policies and create a row. Defaults are conservative:
- Mailbox scope:
all - Mode:
suggest_only - Minimum confidence:
0.90 - Require KB grounding: on
- Max auto-replies per thread per day:
1
Tighten or widen from there. Common patterns:
| Goal | Settings |
|---|---|
| Surface AI suggestions only, no drafting | Mode: suggest_only |
Pre-write drafts on support@, never send | Mailbox scope: support, Mode: auto_draft |
| Auto-send simple FAQ answers in office hours | Mode: auto_send_low_risk, Allowed intents: faq, qa, Minimum confidence: 0.92, office hours set, KB grounding on |
| Block AI on a sensitive category | New row scoped to that category, Mode: off |
Audit
Every step writes an event on the thread:
| Event | When |
|---|---|
ai_suggestion_created | The AI ran and stored a suggestion. |
ai_policy_matched | The evaluator picked a policy + outcome. |
ai_auto_draft_created | A draft was written off the back of auto_draft (or a downgraded auto_send). |
ai_auto_send_blocked | A guardrail held the send back. The reason is in the metadata. |
ai_auto_reply_sent | The AI actually sent a reply via the mailbox provider. |
ai_suggestion_accepted | An operator accepted the suggested reply. |
ai_suggestion_rejected | An operator dismissed the suggestion. |
Bodies and tokens never land on the audit events themselves — the full reply lives on the suggestion and the outbound draft, both tenant-scoped like everything else in the inbox.
Sending
When auto-send fires, it goes out via the same Gmail / Office 365 mailbox connection your operator sends use — there is no second outbound channel. A mailbox without a working provider cannot auto-send; the policy outcome downgrades to draft and records provider_unavailable in the guardrail results, so the operator can see why.
Drafts created by the AI are flagged in the UI ("This draft was written by AI"), and the rate limit counts AI-driven sends per thread per day separately from operator sends.
Common mistakes
- Auto-send on every category. Don't. Pick a narrow scope (one category, one mailbox) and watch the audit for a week before you widen.
- High confidence ≠ safe to send. Risk is a separate axis. A confident reply on a
refundintent still gets blocked because that intent is hard-floor blocked. - Disclosure footer not appearing. The check is literal. If the body doesn't contain your disclosure text exactly (whitespace included), the send is held back.
- Office hours misset. Days run Monday through Sunday. Use the timezone of the team that owns the mailbox, not UTC, unless your team really runs UTC.
FAQ
Can I disable the AI entirely? Yes — set every relevant policy to mode off, or delete the policies. With no policy at all the inbox defaults to suggest_only for every message.
Can I retract an auto-sent reply? No. Configure auto-send conservatively and watch the audit; the rate limit stops a runaway loop after the first message per thread per day.
Why did my AI reply land as a draft instead of going out? A guardrail blocked it. Open the suggestion in the detail pane and read the guardrail results — the failing one carries a reason.
Does the AI reply in the customer's language? Yes. The classifier infers the language from the inbound message and the reply matches it.