And guardrails can be as simple as not giving it direct access to applications that can perform read/write (like a full-blown email client, or access to the GMail UI), and instead creating a small tool to fetch the content as needed without being able to perform actions.

The danger is relying on too much convenience, giving too much power to a non-deterministic tool will inevitably create issues...

I've had humans do the exact same thing. When I pointed out that this was fraud they were all surprised.

> the least you should do is put guardrails around consequential actions.

How on earth would you?