A chatbot can be wrong in words. An agent can be wrong in your inbox. That difference is why I put guardrails ahead of prompts: a prompt is a request, a guardrail is a limit the model cannot talk its way around.
The rule I ship with is simple. The AI can draft an email, but only a human tap on Send sends it. Files land in a folder in the person’s own Google Drive, not somewhere I control.
It is a small constraint that removes most of the fear. People hand an agent real work once they know it cannot do the one thing they cannot take back.