Skip to content

Instantly share code, notes, and snippets.

@burkeholland
Created June 18, 2026 22:21
Show Gist options
  • Select an option

  • Save burkeholland/60c865353a4fa7fd9491f63cc51a3e69 to your computer and use it in GitHub Desktop.

Select an option

Save burkeholland/60c865353a4fa7fd9491f63cc51a3e69 to your computer and use it in GitHub Desktop.
Max — AI Email Agent Design Document

Max — AI Email Agent Design Document

Overview

Max is an AI email agent that operates on behalf of its user (Burke), handling email triage, responses, and lifecycle management. Max signs all messages as "Max (AI) on behalf of Burke" — recipients always know they're interacting with an agent.

The system is built on a principle of earned autonomy: Max starts conservative, proves competence through repetition, and gains independence incrementally with explicit user approval at each step.


Core Principles

  1. Transparency is permanent — every agent-sent message is signed as AI, always.
  2. Trust is asymmetric — many successes to earn autonomy, one failure to lose it.
  3. Allowlist is inviolable — auto-send is structurally impossible outside approved recipients.
  4. Context grows organically — the wiki is built as a byproduct of working, not upfront configuration.
  5. Guardrails are hard rules — expressed in natural language, stored in the wiki, but enforced as absolute constraints the AI cannot override.

Architecture

Components

Component Role Implementation
Processing Engine Batch-processes email every 15-30 min Copilot scheduled workflow
Command Center Review drafts, manage rules, view digest Copilot canvas extension
Context Broker Queries relevant sources at decision time Live queries (WorkIQ for work, email history for personal)
Wiki Persistent structured knowledge base Structured files in Automations project
Gmail Interface Read and send email Gmail skill
M365 Context Calendar, Teams, docs for work decisions WorkIQ

Data Flow

Email arrives
     Workflow runs (every 15-30 min, batch)
     Context Broker queries relevant sources
     Wiki consulted for rules, preferences, entity knowledge
     Classification: category × sender  tier assignment
     Action taken based on tier
     Wiki updated with new learnings
     Results written to shared state
     Canvas displays results on next open

Autonomy Tiers

Tier 1: Auto-handle

  • Agent acts without user involvement
  • Appears in daily digest
  • Constraint: only possible for allowlisted recipients in 1:1 threads

Tier 2: Draft-for-review

  • Agent prepares a response
  • User approves/edits/rejects with one click in the canvas
  • Accumulates in a queue (no notification pressure)

Tier 3: Escalate-immediately

  • Agent does nothing except surface it with context
  • Real-time notification to user
  • Includes confidence score and reasoning trail (expandable)

Default Behavior

  • Everything starts at Escalate (Tier 3)
  • Promoted only through demonstrated track record + user confirmation

Classification Model

Hybrid: Category × Sender

The agent considers both what kind of email it is and who sent it to determine the action tier.

  • Category determines the type of action (accept meeting, reply with info, archive, escalate)
  • Sender modifies the autonomy level (known teammate vs. VP vs. unknown external)

Hard Rules (Guardrails)

Expressed as natural language, stored as "rule" entities in the wiki:

  • "Never auto-reply to anyone above Director level"
  • "Always escalate emails that mention legal, HR, or PIP"
  • "Never auto-handle emails about compensation or performance"

These are absolute constraints the AI cannot override regardless of confidence.

AI Classification (Middle Ground)

For everything not covered by hard rules, the AI uses:

  • Wiki knowledge (who is this person, what project is this about)
  • Pattern history (what has Burke done with similar emails)
  • Context broker data (calendar, recent threads, docs)
  • Confidence scoring

Safety Architecture

Allowlist (Inviolable Constraint)

  • Only explicitly approved email addresses can receive auto-sent messages
  • Any thread with non-allowlisted recipients → capped at Draft-for-review, minimum
  • Multi-person threads always require human review, even if all recipients are allowlisted
  • Agent can suggest additions in the daily digest, but cannot add on its own

Demotion Mechanics

  • Immediate demotion on any rejection or reported error
  • Cooldown period before re-promotion is even suggested (e.g., 10 successful drafts)
  • On demotion, agent explains what went wrong

Novel Situation Rule

  • If the agent encounters a category/sender/topic combination it has never successfully handled before, it MUST draft regardless of tier

Promotion Mechanics

How Patterns Earn Autonomy

  1. Agent handles emails at current tier (e.g., drafting)
  2. After sufficient track record, agent suggests promotion: "I've drafted 8 vendor replies without edits — want me to auto-handle these?"
  3. User confirms with one click
  4. Pattern is promoted to next tier

Promotion is never automatic — agent proposes, user approves.


Wiki (Persistent Knowledge Base)

Storage Format

Markdown files organized as directory-per-type, file-per-entity in max/wiki/:

max/wiki/
  people/
    jane-smith.md
    john-doe.md
  rules/
    no-auto-reply-directors.md
    escalate-legal-mentions.md
  patterns/
    meeting-invite-teammate.md
    vendor-notification.md
  preferences.md        single file (small, stable)
  meta.md               wiki stats, last audit date

Entity File Schema

Every entity file follows a standardized structure:

# Jane Smith
- **ID**: jane-smith
- **Email**: jane@company.com
- **Created**: 2026-06-18
- **Last Updated**: 2026-06-18
- **Confidence**: High
- **Derived From**: org-chart-lookup, email-thread-4521
- **Source**: Inferred from M365 org chart + 12 email interactions

## Attributes
- Role: PM, Copilot Team
- Org Level: IC
- Relationship: Direct teammate
- Allowlisted: Yes

## Observations
- Prefers short replies
- Usually asks about scheduling
- Tone: casual, uses emoji

Key fields:

  • Derived From — links to source entities/events, enabling cascading corrections
  • Last Updated — surfaces staleness; entries not updated in months can be flagged for review
  • Confidence — High / Medium / Low, reflecting how certain the agent is about this entry

Entity Types

  • People: name, email, role, team, org level, relationship to Burke, communication preferences
  • Projects: name, status, stakeholders, deadlines, relevant context
  • Preferences: scheduling rules, communication style per context, boundaries (single file)
  • Rules: natural language guardrails (indexed as enforceable constraints)
  • Patterns: learned email handling patterns with track record counts

Growth Model

  • Agent writes wiki entries freely as a byproduct of processing email
  • New/updated entries appear in the daily digest ("What I learned today")
  • User can correct or delete with one click

Error Correction (Cascading)

When the user flags a wiki error:

  1. Agent deletes the bad entry
  2. Agent traces the Derived From graph to find all downstream entries that relied on the bad data
  3. Agent expunges or corrects all affected entries
  4. Agent logs the correction pattern to avoid repeating the inference

Design rationale: file-per-entity avoids token bloat (agent reads only what it needs), isolates corruption blast radius, enables atomic concurrent writes, and makes staleness visible via Last Updated.


Communication Style

Tone Document

  • User provides a short style/tone document upfront (casual with team, professional with external, etc.)
  • This accelerates cold start

Learned Corrections

  • Every time the user edits a draft, the delta between AI version and user version is a training signal
  • Over time, the agent converges on Burke's voice
  • Style may vary by recipient context (the wiki can store per-person or per-category tone notes)

Notification & Digest Model

Daily Digest (Fixed Time)

Contents:

  • What was auto-handled today (summary)
  • Wiki updates ("What I learned today")
  • Promotion suggestions
  • Any anomalies or low-confidence decisions

Real-Time Escalations

  • Tier 3 items only
  • Kept to a minimum to avoid alert fatigue

Draft Queue

  • Tier 2 items accumulate
  • Visible as a badge count in the canvas
  • No push notification — review at your own pace

Scope & Rollout

Phase 1: Triage + Reply (Work Email)

  • Gmail work account
  • Batch processing every 15-30 min
  • Conservative defaults (everything escalates)
  • Allowlist: small trusted group only
  • Wiki begins building
  • Canvas for review + digest

Phase 2: Lifecycle Behaviors (Shadow Mode)

  • Follow-up reminders
  • Thread tracking
  • Commitment detection
  • Runs in shadow mode: shows what it would do without acting
  • Promoted to live individually after trust is established

Phase 3: Personal Email

  • Same agent, different context configuration
  • Context broker queries email history instead of M365
  • Separate autonomy tiers (starts from scratch)
  • Shared wiki for cross-domain knowledge (e.g., people who appear in both)

Phase 4: Full Lifecycle (Live)

  • Shadow-mode behaviors promoted to live as trust is earned
  • Agent proactively follows up, reminds, tracks threads
  • Same promotion/demotion mechanics as Phase 1

Technical Implementation (Copilot App)

Scheduled Workflow

  • Runs every 15-30 min
  • Uses Gmail skill to read new messages
  • Uses WorkIQ for M365 context
  • Reads wiki from Automations project storage
  • Writes: drafts, classifications, wiki updates, escalations to shared state
  • Sends auto-replies for Tier 1 items within allowlist constraints

Canvas Extension

  • Built with create-canvas skill
  • Displays: draft queue, digest, escalations, wiki browser, allowlist manager, rule editor
  • User interactions (approve/reject/edit/correct) write back to shared state
  • Next workflow run picks up user feedback

Wiki Storage

Markdown files in max/wiki/ directory (Automations project: D:\Copilot\Automations):

  • Directory-per-type, file-per-entity (see Wiki section for full schema)
  • Human-readable and browsable
  • Derived From fields enable cascading corrections
  • Agent reads only relevant files per batch via grep/glob lookup

Workflow State

JSON files in max/state/ directory (machine-read/write, not human-facing):

max/state/
  queue.json        pending drafts and escalations
  cursor.json       last-processed email timestamp/ID
  counters.json     promotion tracking per pattern (approval streaks)
  history.json      recent actions for digest generation

Confidence Model

3-level scale mapped directly to tier ceilings:

  • High → eligible for the pattern's current tier (up to Auto-handle)
  • Medium → capped at Draft-for-review regardless of pattern tier
  • Low → always Escalate

The agent uses whatever internal scoring it needs, but the user-facing output is always one of three levels.

Canvas Extension

Built with create-canvas skill. Queue-first layout with tabbed navigation:

Tab Purpose Default
Drafts Queue of emails needing approval (badge count) ✓ Landing tab
Escalations Tier 3 items requiring direct attention
Digest Today's summary — auto-handled, wiki updates, promotion suggestions
Wiki Browse/search/edit entities, rules, preferences
Settings Allowlist management, rule creation, processing cadence

Draft interaction pattern: inline expand. Each draft shows as a compact row (sender, subject, confidence, suggested action). Click to expand in-place → see the full draft, the original email, the reasoning trail, and action buttons (Approve / Edit / Reject).

Digest Format

Grouped summary with counts + notable callouts:

## Today's Summary
- 14 emails processed | 3 auto-handled | 8 drafted | 3 escalated

## Auto-Handled (3)
 Accepted standup with Jane (High confidence)
 Replied to vendor re: license renewal (High confidence)
 Archived newsletter from DevTools Weekly

## What I Learned
+ Added "Mike Chen"  PM on Platform team (derived from org chart)
+ Updated Jane's entry — she's now on the Design team
+ New pattern: "status update from CI bot"  archive

## Suggestions
 Promote "meeting invites from Copilot team" to Auto-handle? (8/8 approved unedited)

## Flagged
 Low-confidence draft for email from unknown sender (sarah@external.com)  review recommended

Onboarding Flow

Guided wizard (3-5 steps in the canvas) + immediately active:

  1. "Who's on your team?" → seeds People wiki + initial allowlist candidates
  2. "What's your communication style?" → seeds tone document
  3. "Any hard rules?" → seeds initial guardrails (agent suggests common ones)
  4. "Who should I be allowed to auto-reply to?" → finalizes initial allowlist
  5. Go live — agent uses best judgment from day one at Draft-for-review tier

The agent does NOT observe silently — it classifies and drafts from the first run, using general knowledge + wizard inputs as its baseline. Early corrections calibrate the system fast.


All Design Questions Resolved

No open questions remain. Ready for build phase.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment