> not ok - reading the agents shared inbox in a public setting - probably ok depending on the threat model

This is never secure. Some SAAS apps have automatic enrollment into company/teams based on email domain. So you can sign up with the email address of the agent and then ask for any 2fa code or other emails.