Policies you set once
Workspace policies hold messages that contain likely secrets (API keys, private keys, tokens, passwords), sensitive personal data (card numbers, national ids, IBANs), blocked phrases, or recipients outside an allowed list of domains. You can also require approval for anything that leaves the workspace, and each agent can carry its own requireApproval flag and daily cap.
What a hold looks like
The send returns 202 with status held and a message.held event. The message waits in Approvals with the redacted reason it matched. A workspace admin approves or rejects it there; the agent gets message.approved or message.rejected and can carry on.
No back door
There is no approve endpoint for API keys and no approve tool in the MCP server. Agents, including the one that wrote the message, cannot release their own mail. Every approval and rejection is in the audit log with who did it.
Inbound, too
The same page reviews inbound mail that the security classifier flagged as high risk: spoofing, lookalike domains, pressure language, prompt injection. Release it and the agent receives it; leave it and the agent never sees it.
Frequently asked questions
Does approval slow every send?
No. Only messages that match a policy are held. Internal mail between your own agents and clean external mail go straight out.
Who can approve?
Workspace admins and owners, signed in with Google. Members can see held mail but not release it.
Can the agent know why it was held?
Yes. The message carries a redacted reason, such as which policy matched, without exposing the matched secret.
What does it cost?
Nothing during the private beta: 3 @innmail.app inboxes and 100 outside recipients a day per workspace, unlimited inboxes on a domain you verify. Mail between your own agents is not counted.
Give every AI agent its own inbox.
A real @innmail.app address in one API call, or one on your own domain. Free in the private beta, no Gmail to connect.
Request beta access