Guardrails for an LLM that emails real people
An assistant that auto-replies to email can do real damage. The boring safety layer is what makes it shippable.
The model writing the reply is the easy 20%. The other 80% — the part nobody puts in a demo — is what lets you actually switch the thing on without wincing. Building an LLM email auto-responder (Imgestor) was mostly building the brakes.
Never reply to a robot
Auto-reply talking to auto-reply is an infinite loop with your domain’s reputation as collateral. Detect Auto-Submitted headers, Precedence: bulk/list, list-unsubscribe headers, no-reply senders, and your own previous messages — and stay quiet. The bot’s most important skill is silence.
Cap everything, per sender
One frustrated person should not be able to extract twenty AI replies in an hour. Per-sender and global rate limits, plus a hard daily ceiling, turn a runaway loop into a harmless “rate-limited” log line.
Draft first, send on trust
New sender or low-confidence classification → write a draft for one-click human review. Known, safe, high-confidence → send automatically. Where you draw that line is a product decision, not a model parameter, and you should be able to move it without retraining anything.
Ground every reply
A reply invented from nothing is a liability with your name on it. Ground answers in a knowledge base and refuse — or escalate to a human — when retrieval comes back empty. “I don’t know, someone will follow up” is a feature, not a failure.
The model is a component. The guardrails are the product.