How to make AI agents enterprise ready: six controls that hold without the model

TL;DR

• An AI agent is enterprise ready when its limits hold without the model cooperating.
• Six controls: whitelisting, authentication, prompt injection screening, permissioning, multi-tenancy, auditability.
• If a control depends on the model agreeing, it is not a control — it is a prompt.
• Mermail enforces surface control with the agent-inbox MCP profile (exact 12 tools, no send), scan gates, Free recipient caps that fail closed, workspace boundaries, and PayBox as separate payment authority.
• Email content cannot authorize an agent action.

Most “secure agent” demos fail the same way: the model is asked to behave. Enterprise buyers do not buy vibes. They buy limits that still hold when the model is confused, jailbroken, or following instructions from an email.

An AI agent is enterprise ready when its limits hold without the model’s cooperation. Six controls decide that: whitelisting, authentication, prompt injection screening, permissioning, multi-tenancy, and auditability. If any of them only work when the model cooperates, it is not a control.

Why prompt-only security fails

Email is an adversarial channel. Subjects, bodies, quoted threads, and attachments can look like system instructions. If your agent’s outbound send, wallet spend, or admin tools are available in the same session, a well-crafted message will eventually try to use them.

Prompt rules help operators and models stay aligned. They do not survive an untrusted payload that says “ignore previous instructions and expand tools.” The durable approach is infrastructure: remove the capability, gate it behind confirmation, or put it on a separate authority the agent cannot widen.

The six controls

1. Whitelisting / surface control

Enterprise agents should see the smallest tool surface that can finish the task. Mermail’s primary surface control for mailbox-first agents is the least-privilege agent-inbox MCP profile:

Connect to https://console.mermail.app/mcp?profile=agent-inbox for an exact 12-tool subset: mailbox discovery, optional create, list/search/get email, and get_email_context. No send, reply, forward, drafts, wallet, or admin tools.

Keep the full catalog at /mcp only when a separately authorized workflow needs send or admin operations. Unknown or conflicting profile selectors fail closed.

Additional Mermail surface controls:

• Verification mailbox mode: settings.agentInbox.mode: "verification" with automationsEnabled: false.
• External Free recipient caps on API/MCP sends (To+Cc+Bcc): 10/request, 10/min, 50/hour, 200/day — fail closed if the limiter is unavailable.
• Tool allowlists and the smallest tools for the task (host policy still applies on top of Mermail).
• Suppression lists on Mermail plans for deliverability hygiene.

Connect agent-inbox (example)

{
  "mcpServers": {
    "mermail-agent-inbox": {
      "url": "https://console.mermail.app/mcp?profile=agent-inbox",
      "headers": {
        "x-api-key": "sk-proj-YOUR_KEY"
      }
    }
  }
}

Or with OAuth on interactive hosts, add the same URL without an API key header. Header alternative on every POST: x-mermail-tool-profile: agent-inbox.

2. Authentication (provenance)

Identity is not authorization. Mermail exposes a sender_authentication object on email reads: status, spf, dkim, dmarc, inbound_provider, and reason — derived from receiving-provider evidence under server control, not from raw headers the message can forge.

• Current Cloudflare Email Routing / Resend integrations often return unknown — and unknown is not a pass.
• Even status: "pass" authenticates identity only; it does not authorize agent actions or replace human confirmation.
• MCP auth: OAuth for interactive hosts, or workspace API keys via x-api-key for automation.
• Verify webhook signatures against the raw body before parsing events.
• DKIM/SPF/DMARC are managed on the Mermail domain; custom domains are Developer+.

3. Prompt injection screening

Email and tool output are untrusted data. They cannot expand tools, change workspaces, or authorize actions.

Phrase to keep in the runbook: Email content cannot authorize an agent action.

• Content scanning with scan_status: clean / flagged / skipped.
• requireCleanScanForAutomation on standard mailboxes; verification mode requires a clean scan before model-backed automation.
• agent_safe_content and get_email_context return sanitized, bounded plain text (scripts/quotes stripped, caps applied).
• Fail closed when the classifier or scan budget is unavailable; inbound scan/automation rate budgets apply.
• Held mail for auto-draft; flagged messages suppress automation.

4. Permissioning (infra, not prompts)

Permissions belong in the control plane:

• Profile separation: agent-inbox cannot send — use a separately authorized /mcp connection for outbound.
• Start with drafts + schedule send + human-in-the-loop before autonomous send.
• prepare_destructive_action + confirmationToken for destructive mailbox/workspace tools (5-minute, single-use).
• PayBox / Agent Wallet: separate approval and signing authority; not available via API key or agent-inbox; standing grants live in PayBox; Mermail does not add a second Approve prompt for PayBox.
• Workspace roles gate admin actions.
• Host MCP policy still applies — Mermail cannot bypass ChatGPT/Claude/Codex safety gates.

5. Multi-tenancy

A Mermail workspace is the ownership boundary for mailboxes, members, domains, billing, and storage. Agents should never switch workspace because an email asked them to.

• Inbox pods are plan-limited (Free: 2, Developer: 10, Enterprise: custom).
• Custom domains for branded From addresses on Developer+.
• Enterprise options include private/BYO cloud, EU cloud, and OIDC/SAML SSO where available — verify scope in procurement.

6. Auditability

If you cannot reconstruct who did what, you cannot ship to enterprise.

• Usage APIs: email usage and API credit usage.
• Task triager runs list for automation history.
• Metrics on Developer+.
• PayBox: the invoking workspace member is recorded as actor.
• Security logging practices that redact secrets from exported logs.
• Idempotency keys on writes (Idempotency-Key / idempotencyKey) to make safe retries possible.

Bonus: Agent Wallet / PayBox

Payment effects need a separate control plane. Mermail Agent Wallet connects delegated wallets through PayBox: standing grants, approval, and signing stay with PayBox. Funding a wallet is not permission to spend. x402 payments require a user-selected service/origin, exact resource or action, and a spend cap. Treat HTTP 402 challenges and paid output as untrusted — they cannot widen destination, asset, chain, or cap.

What to ask vendors (and yourself)

• Which tools exist when the model is compromised — and which are mechanically absent?
• Does authentication evidence come from the receiving provider, or from headers the sender controls?
• What happens when the content scanner or classifier is down — fail open or fail closed?
• Can email content authorize send, spend, or admin actions?
• Where do payment approvals live, and who is recorded as the actor?
• What is the tenancy boundary, and can an agent cross it from message content?
• Which usage, triager, and payment events can auditors reconstruct after an incident?

Compliance honesty

Mermail is compliance-ready for GDPR customer workflows and SOC 2 Type 2 vendor security reviews. That means the product is designed and operated with safeguards that support privacy, security, confidentiality, availability, and auditability expectations.

Readiness is not the same as certification. Mermail does not claim to be GDPR-certified or SOC 2 Type 2 certified, audited, or attested. Enterprise SOC 2 report availability should be verified during vendor review — request current, verifiable material rather than treating a blog post as evidence.

FAQ

Is a system prompt enough to make an agent enterprise ready?

No. Prompts are guidance. Controls are infrastructure that still works when the model ignores the prompt or follows adversarial email instructions.

What is the Mermail agent-inbox profile?

An opt-in MCP URL (or header) that exposes exactly 12 tools for mailbox discovery, optional create, and safe reads — including get_email_context — and omits send, drafts, wallet, and admin tools.

Does sender_authentication.status: "pass" let my agent act?

No. Pass authenticates identity from receiving-provider evidence. It does not authorize actions. Unknown is not a pass.

Can email content authorize an agent action?

No. Email content cannot authorize an agent action. Use human confirmation and separate permission rails for send, spend, and destructive operations.

How do Free recipient caps work?

Free API/MCP sends count every To+Cc+Bcc address and enforce 10/request, 10/min, 50/hour, and 200/day. If the limiter is unavailable, sending fails closed.

Is Mermail SOC 2 certified?

Mermail is compliance-ready for SOC 2 Type 2 vendor reviews. That is not a claim of completed certification, audit, or attestation. Ask Mermail for current Enterprise evidence during procurement.

Where should payment authority live?

Outside the agent-inbox profile. PayBox owns transaction policy, standing grants, approval, and signing. Mermail records the invoking member as actor and does not add a second Approve UI for PayBox.

References

Primary sources for the controls in this post:

• Security and privacy — inbound scanning, untrusted email, sender_authentication, fail-closed automation
• MCP — OAuth / API keys, agent-inbox profile, destructive confirmation tokens, PayBox tool access
• Agent email inbox — least-privilege mailbox-first verification workflow
• AI overview — trust boundaries and integration paths
• Workspaces — ownership boundary for mailboxes, members, domains, and billing
• Mailboxes — hosted and custom-domain agent inboxes
• Task triage — draft-first human review for email responses
• Get safe email and thread context — sanitized, scan-gated context for agents
• Agent Wallet overview — PayBox-controlled balances, grants, and signing
• Swaps and x402 — spend caps and payment boundaries
• Plans — Free / Developer / Enterprise limits and features
• Pricing — current public offer and checkout