Executive Email Assistant
An email assistant for the CEO of my employer. It reads her inbox and the shared inquiries inbox on a schedule, answers routine mail and books accepted online meetings on its own, and puts everything else in one evening to-do she answers a line at a time. The model classifies and drafts; code decides every send, booking and acknowledgment.
For a businessThe executive deals with email once a day instead of all day: routine questions get answered and accepted meetings booked inside her rules, and nothing that needs her judgment goes out without it.
- Status
- In production at my employer
- Result
- Answers routine mail and books accepted meetings on its own; everything else waits for one evening to-do
- How it was measured
- 97 tests run the workflows’ own code, and each change was tested against the live code before it was published
- Biggest limit
- Its importance and confidence scores aren’t calibrated yet
01 · Context The problem
An executive’s inbox mixes three kinds of mail: routine questions anyone could answer, machine mail nobody needs to read, and the few messages only she can decide. Sorting them by hand eats the day.
An assistant that simply answers everything is how an organization ends up booking a meeting on a holiday, or replying to a phishing email with a link. The hard part is deciding exactly what it may do alone.
02 · Pipeline How it works
- Sort before the model
Code decides what reaches the model at all. Machine mail from 52 known senders (exact addresses, never whole domains) is filed or tagged without it, unless the subject mentions money, accounts or security.
- Classify and draft
For each remaining conversation Claude returns a tier, an importance and a confidence between 0 and 1, a category and a draft reply. Email text is wrapped as data, stripped of quoted history and capped in length.
- Code decides what happens
A deterministic gate lets it act alone only when autonomy is on, sending isn’t paused, importance is under 0.8, confidence is at least 0.8, and the sender isn’t a VIP or an escalation. Everything else goes to the to-do.
- Check every automatic reply
A reply is held if it contains a link or address that isn’t the organization’s or already approved, or the title of a calendar entry. It must go to exactly the original sender, so a forged Reply-To can’t redirect it.
- Book only by the rules
Online meetings the other person has accepted are booked only inside her hours for that weekday, never on a federal holiday, over an all-day entry or on top of another meeting.
- One evening to-do
At 8pm on weekdays she gets one email: what needs her, each with a suggested reply; drafts to approve; tomorrow’s meetings with notes on each person; reading picks; who we’re waiting on; and what was handled.
- One-line replies become actions
She answers “T12 send it” or “T15 offer Tue or Thu afternoon”. An hourly workflow turns each line into actions, checks each one in code (every recipient must be named by her or be on the item) and confirms in the same thread.
- Weekends and follow-ups
Replies written over a weekend wait for Monday and are dropped if someone answered first. A question nobody answers comes back after three business days as a ready follow-up for her to approve.
03 · Worked example One email, two paths
A made-up email, followed through the code the assistant actually runs.
- A vendor writes
On a Tuesday morning a vendor contact replies: “Thursday 2:00–2:30 works; please send a Teams invite.”
- Sorted, then read
Not a machine sender, so it reaches the model, which returns: routine scheduling, importance 0.35, confidence 0.9, book an online meeting, plus a short confirmation.
- Code checks the booking
Autonomy on, sending not paused, not a VIP, calendar readable, within 16 days, inside Thursday’s hours, not a holiday, no all-day entry, no clash.
- Booked and confirmed
The reply passes the scan and goes only to the vendor, the meeting is booked, and that evening it shows under “Handled for you”.
- If the day were a holiday
Code refuses, books nothing and holds the reply, and the to-do says why. She answers “T41 book anyway”: the next hourly run books it (the override never extends to a clash) and confirms in the thread.
04 · Choices Design decisions
The model proposes, code decides
Claude classifies and writes. Whether anything is sent, booked or acknowledged is decided by code the model can’t talk its way past.
Two bars, both cautious
It acts alone only under an importance bar and over a confidence bar, and a missing importance counts as the most important. Both bars are settings, and autonomy ships switched off.
One rulebook, three copies, one test
The booking rules run in both inbox agents and in the decisions step. A test fails if the three copies ever differ.
One email a day
She deals with the assistant once, in the evening, replying a line per item, instead of approving things all day.
Exact senders, not domains
The skip list matches whole addresses because the mail history showed a real person writing from a newsletter’s domain.
Honest bookkeeping
A reply is recorded as sent only after the send succeeds, and the to-do says truthfully what each sender was told.
05 · Evidence How I tested it
A test harness loads each workflow’s Code-node JavaScript straight from the n8n export and runs it against a frozen New York clock. 97 tests cover the autonomy bars, the checks on every automatic reply, the booking rules (holidays, all-day entries, clashes, drive time), weekends, follow-ups, alerts, and that every workflow imports cleanly.
Every production change was written as a draft with tests that fail on the live code first (in one batch, 25 of 33 did), compared against n8n’s own diff, and published one workflow at a time with a rollback version recorded.
An outside AI review was checked claim by claim against the live workflows. It found real gaps (bookings checked only for clashes, free all-day entries ignored, a weekend queue that never sent), and each was fixed in code with tests.
Cost was estimated from recorded token counts, about $0.04 per model call, times volume replayed from eight weeks of real mail through the routing rules: about $91 a month, about $64 once machine senders skip the model. An estimate, not a bill.
06 · Outcomes What it has done so far
- In production at my current employer, reading the CEO’s inbox and the shared inquiries inbox.
- In one recorded morning run, 13 of 24 conversations were filed without the model and the rest took 20 model calls instead of 33; 6 routine replies went out on their own and 6 items went to her to-do.
07 · Security Untrusted input and what the model can touch
- Email text is data: it is wrapped in tags, tags inside it are removed, and instructions in it are escalated, never followed.
- An automatic reply can go only to the original sender and is scanned for unknown links and addresses before it leaves.
- The decisions step acts only on mail from the executive’s own address, with the assistant’s subject tag. Error alerts use a different tag, so a reply to an alert can never become an instruction.
- One emergency stop pauses every reply, acknowledgment, booking and decision; her pending replies wait instead of being lost.
08 · Honest notes Known limits
- Its importance and confidence scores aren’t calibrated yet; the draft-versus-sent comparison that will measure them has only just started collecting.
- Prompt-injection handling inside the model is prompt-level; the structural guards are the recipient and content checks around it. No live red team yet.
- Each run reads the newest 100 messages from the last few days, so a backlog beyond that window would be missed.
- Her replies are acted on at most once: an action that fails is reported to her, not retried.
- The cost log inside the system reads about a third low; the estimate above uses recorded tokens instead.
Want to see this one run?
I'll screen-share the workflow, the test set and the results, including what didn't work.