What an email/calendar agent actually is.

From “chat about email” to an agent that reads it CORE

You have asked an AI for email help before. You pasted a message and said “how should I reply?” or you described a situation and said “write an email to my teacher about an extension.” The model gave you a draft. It was fine, usually. That was not an email agent.

What you used was a model with no access to your inbox. It saw the one message you pasted. It did not know who the sender is to you, what you have said to them before, whether they have sent you three other emails this week, or what is already on your calendar for the day you just proposed. It answered based on one paragraph in isolation. For a single reply, that is often enough.

An email/calendar agent is a different kind of thing. It is an agent with tools that can actually reach into your inbox and your calendar — read messages in a folder you have allowed it to see, search your threads, check your available times, draft a reply in your drafts folder, create a calendar event on a calendar you have designated. The agent has reach into your communication life the way the Module 4 research agent had reach into the live web.

That reach is why the agent can do things the paste-one-message chat could not. It can scan forty messages and give you a five-line digest. It can find the thread where you discussed the final exam date and draft a reply that matches the tone you used there. It can check your calendar, see the three windows that are actually free next week, and write a proposal message that names those three windows. That is real work.

It is also why Module 5 is the module where the safety norms get louder. An agent that can read your inbox can see things the model-with-one-pasted-message could not. An agent that can draft in your name can, if you let it, send in your name. An agent that can edit your calendar can, if you let it, cancel a meeting you had no intention of cancelling. The difference between useful assistant and problem is not model quality. It is how carefully you drew the fence around what the agent is allowed to read and do.

The four moves: read, categorize, draft, review CORE

Every email/calendar task a directed agent performs runs through four moves. The pattern is the same shape as the four moves of research, adapted to relational work. Naming them lets you direct the agent and audit what it did.

Read. The agent pulls the raw material — messages in a specific folder or with a specific label, events on a specific calendar, threads matching a query. Read is where scope lives: the agent can only see what you have permitted it to see. The default is nothing; you extend the default per task.

Categorize. The agent sorts what it read into buckets you can act on. Which of these twenty messages need a reply from you today? Which are newsletters that can wait? Which are commitments you owe a response on? Which calendar invites overlap with existing commitments? A good agent produces a small number of clean categories. A poor one produces a wall of text that recapitulates the inbox without reducing it.

Draft. The agent writes — an email reply, a meeting-prep brief, a proposed calendar invite, a polite decline. The draft goes into your drafts folder, or into a document you can review, or onto a calendar you have designated for draft events. The draft does not go to the recipient. The draft is a proposal the student will evaluate.

Review. A human — you — reads every draft before it leaves your account. You catch the tone mistake the agent could not catch because it does not know the recipient the way you do. You catch the factual error the agent made confidently. You adjust the greeting, the sign-off, the last sentence that sounded too formal or too casual. You click Send when you are satisfied, or you throw the draft away and write the message yourself.

As the director, the split is unambiguous. The agent does read, categorize, and draft well — often better than you would alone, because the agent does not get bored scanning forty messages and does not flinch at writing a difficult reply. You own review, completely. The agent’s confidence does not substitute for your judgment. A student who leaves Module 5 letting an agent send on their behalf has not learned the module; they have bypassed it.

Why Module 5 is different: other people’s trust CORE

Everything the agent touched in earlier modules was private to you until you chose to ship it. In Module 3, the agent edited your code on your machine; no other human saw it until you pushed the branch. In Module 4, the agent wrote a research brief you could read twice before you handed it in. Module 5 is the first place the agent sits next to other people.

Think about what sits in your inbox right now. A thread with a teacher about a late assignment. A message from a cousin you have not answered. A discussion with a potential employer about a summer job. A string of messages from a friend. These are not abstractions — each of them is a person who knows you and who will read whatever comes from your account as if you wrote it. They trust the name on the envelope.

An agent that can draft in your name is, unavoidably, handling that trust. If the agent sends the wrong thing, the recipient does not know there was an agent in the loop. They just think you sent the wrong thing. If the agent cancels a meeting by mistake, the person whose time was respected is the one who shows up to an empty room. If the agent replies too fast with the wrong tone, the relationship absorbs the damage, not the system.

This is not a reason to keep the agent out of your email. Done well, an email agent is one of the highest-leverage tools in this course — the people who have used one for a month do not go back. It is a reason to draw the fence carefully and to keep a human in the sending step until you have lived with the agent’s judgment long enough to know where it is reliable and where it is not. The two safety norms of this module are not paranoia. They are how adults who rely on these tools actually operate.

One more thing before we name the norms. The agent’s drafts will often be better than what you would have written — more patient, more complete, less cranky at 10 p.m. when a difficult email has been sitting in your inbox for three days. That is part of the point. It is also the exact condition under which the reviewing habit slackens. The trap is not the agent writing a bad draft. The trap is the agent writing a draft so fluent that you stop reading it carefully. Review is the discipline that survives the agent being good.

The two safety norms of Module 5 CORE

This module has two non-negotiable operational rules. Both appear on every recipe callout. Both must be visible on every capstone entry.

Drafts, not sends. An agent reads, categorizes, and drafts. A human reviews and sends. Applied uniformly — email replies, meeting invites, calendar RSVPs, any outbound action that another person will see. The agent puts the draft in your drafts folder, in a tentative calendar slot, in a document you can review. The student is the one who clicks Send or Confirm. In this module, no exceptions. After the module, with enough lived experience, you may choose to relax this rule in specific narrow cases (a recurring weekly status email to yourself, say). You do not relax it here.

Least access for the task. Every permission granted to an agent is scoped to the specific job and revoked when the job is done. The student’s default posture is no access, extended deliberately per task and reduced again afterwards. Applied uniformly — the agent does not see your whole inbox to draft one reply, does not touch your whole calendar to prep one meeting. You set the bounds first, then you give the agent work inside them.

These two norms sit together. The first is about what the agent does. The second is about what the agent sees. Either without the other is incomplete. A scoped agent that can still send is dangerous. An unscoped agent that only drafts is reading things it has no reason to read.

You can remember them as a pair: the agent has a small window on your life and a short leash on what it can change. Your job is to set both.

What you are about to do: the bounded access surface CORE

The rest of this module assumes you have done one short setup task: you have set up a bounded access surface — a specific label on your email and a specific dedicated calendar — that is the only place the agent works during the module. Everything the agent reads, drafts, triages, or proposes in Module 5 happens inside that surface.

Email: an agent-accessible label. You create a label (or folder, depending on your provider) called something like agent-access or AI-triage. You set up a filter or a manual habit that moves messages into it when you want the agent involved — the parent’s small-business inbox subset, a subset of school-related mail, a project you are coordinating with friends. The agent is granted read access to that label only. It does not see your private threads, your family group thread, or the email from the doctor’s office. If you later want to extend access, you do it deliberately, one label at a time.

Calendar: a dedicated Agent Access calendar. You create a new calendar in your calendar app called Agent Access (you can pick the name). The agent is allowed to propose events on this calendar, move drafts here, and reference your other calendars read-only for conflict-checking. Final events — the ones you actually commit to — move onto your real calendar when you confirm them. The agent’s drafts live on the Agent Access calendar until then. It is a sandbox for calendar work.

These two surfaces are not permanent. They are the blast radius for the module. After Module 5, you will decide based on your own experience whether to widen, narrow, or dismantle them. What matters right now is that you start from a small, known surface — not from full inbox access granted because it was the default.

A careful way to think about it: you are not giving the agent access to your email. You are giving the agent access to the corner of your email you chose. There is a large difference. Module 9 returns to this distinction and formalizes it; Module 5 installs it as habit.