The assistant gets a key to Postern Mail. Never a key to your mail.

Your personal account, the shared team inbox, the company address: each becomes a named mailbox in Postern Mail with its own settings. You manage all of them on one page, and your assistant reaches all of them through one connection.

Most assistants connect to one account at a time, and the built-in connectors that exist are all-or-nothing: the assistant can do everything the provider allows, or nothing. Postern Mail is where you say "read-only on my personal inbox, drafts but no sending on sales, everything on my work account" — and where you change your mind later without touching the assistant at all.

An assistant can be talked into things. A rule in its instructions can be overridden by a later instruction, a cleverly worded mail, or a plugin it trusts. Postern Mail does not rely on the assistant behaving.

Every call the assistant makes is checked against your mailbox settings on our server, freshly, before anything happens. Switch send off for a mailbox and the very next attempt is refused — mid-conversation, with the reason — so the assistant can offer to draft instead. Nothing you did not allow is ever carried out.

The assistant's own tool settings are irrelevant to this. You can enable every Postern Mail function in Claude or ChatGPT and let it run without per-call prompts: the permission that counts is the one you set in Postern Mail.

When the assistant replies to a message, the reply is addressed by the mail provider to the original sender — or, if you asked for reply-all, to the people already on the thread. There is no field for adding a recipient. The tool physically cannot be used to send your reply, with its quoted history, to someone new.

Sending a brand-new mail to an address of the assistant's choosing is a different function with its own switch, send mail, that you enable separately. Replying and composing never imply each other; drafting never implies sending.

Nine switches per mailbox, each independent. None implies another: being allowed to read never means being allowed to delete; being allowed to move a message never means being allowed to move it into the trash.

• read messages — inbox listing, full messages, attachments
• search messages — every folder at once
• list folders — the folder structure
• move or archive messages — between folders, never into the trash
• delete messages — to Deleted Items only, never permanently
• draft replies and send replies — to the existing thread only
• create drafts and send mail — new mail, to any address

Start with two switches on. Open up when you have seen how the assistant behaves. Every change takes effect on the next call.

To reach a mailbox directly, an assistant needs a credential for it: an OAuth grant on your Microsoft 365 or Google account, or an IMAP password. Those credentials are rarely scoped to mail alone. A Microsoft 365 grant that reads mail often reads your calendar, your contacts, your files and your Teams chats as well — the whole office, handed to a third-party model provider.

With Postern Mail, the provider credential is stored encrypted on our side and is decrypted only in memory, for the duration of one call. The assistant holds a key to Postern Mail, nothing else. That key opens exactly the switches you set, and you can revoke it in one click under Account → Connected assistants. Revoking it cuts the assistant off on its next call; your provider credential is untouched.

No token, password or provider identifier ever appears in anything the assistant receives — not in a result, not in an error message.

Business people rarely have one mailbox. A private account, a first and a second business account, a support alias, a shared sales inbox. Built-in connectors handle one of them; switching means reconnecting.

Through Postern Mail, the assistant sees all of them by the names you gave them. "Read sales and tell me what needs an answer today." "Draft a reply to Acme from my work account." "Search all my mailboxes for the Q3 invoice." One connection, every mailbox, each with its own limits.

A refusal names the switch that is off. The assistant can tell you, and can offer what is allowed instead — a draft rather than a send, a move rather than a delete. There is no silent failure and no guessing.

Refusals are also honest about what they do not reveal. Asking about a mailbox you do not own, or presenting a message identifier from another mailbox, gets the same answer as asking about a mailbox that does not exist. Nothing about someone else's mail leaks through an error message.

Postern Mail connects Microsoft 365 and Outlook mailboxes today. Gmail and generic IMAP/SMTP mailboxes are planned and are built behind the same permission model; they are not available yet.

Outgoing mail is text and HTML only — attachments on drafts, replies and new mail are planned. Forwarding a message to new recipients is deliberately not offered yet; it is a different permission question and will arrive with its own switch.

The full list of what the assistant can do is on the features page.