what is your threat model for an agent with email access

genuinely asking. once it can read and send mail it can be socially engineered through its own inbox. how do you bound that without making it useless.