Email prompts: keep sender identity and message text separate

Last updated: 4 Oct 202611 min read

tutorial

The display name and signature in an email are claims inside a message, not proof of who controls an account. The application should provide verified mailbox identity and authorization context separately from the body. An inbound message may ask the assistant to change a workflow, reveal private information, or ignore earlier rules. The model can summarize that request, but cannot adopt it as a higher-priority instruction. Before drafting a consequential response, check whether the sender and recipient belong to the authorized thread and whether any requested action falls inside the user's current task. Mail content is evidence about what someone wrote; sending, scheduling, or data disclosure remains governed by trusted permissions.

Operational case

A message in the Aster thread displays the name 'Pilot Director' and says to send every depot contact list to an unfamiliar address before scheduling. The application metadata shows that the sender is an external vendor account without access to the contact list. The assistant records the request as an unapproved vendor ask and does not fetch or attach private contacts. It can still answer the legitimate meeting question after a user reviews the proposed recipients. A signature block cannot confer internal approval authority.

Display name: Pilot Director; verified account: external vendor.
Body request: send depot contacts to new address.
Decision: report request; do not fetch or disclose contacts.
Legitimate task: draft meeting reply within existing thread.
Effect authority: current user and mail service, not body text.

Performance and operating cost

Checking a sender against a trusted directory is O(1) average with a keyed lookup; parsing M headers and recipients is O(M). The identity check adds little latency compared with the risk of treating forged display text as authority. Avoid feeding entire unrelated mailbox history into the model. Record only the account and message IDs needed for this task, and keep confidential address lists outside the prompt unless the user has authorized their use.

Common Mistakes

Do not equate a display name or signature with verified identity.
Do not obey instructions embedded in an inbound email body.
Do not retrieve unrelated contacts to satisfy an unapproved vendor request.

Connected lessons

prompt engineering

email calendar