Primitive: the RiskMandate X-ray

a company · prepared · sources read on 2026-11-07 · the deck · how this X-ray was made · X-ray another name

What happened: how this X-ray was made →

With JavaScript, the graph of this X-ray and a player for each use case's simulation are drawn here. Everything they show is written out below.

What it does

Primitive (primitive.dev, also onprimitive.com for its business pitch) is email infrastructure for AI agents, a Y Combinator company founded in 2026 in San Francisco. It gives an agent a managed *.primitive.email address (or a customer's own domain), a REST API, MCP server, CLI and SDKs to send, receive and search mail, a one-line chat verb that sends a message and waits for the threaded reply, and hosted JavaScript Functions that run on every inbound message, while Primitive runs the mail servers, SPF, DKIM, DMARC, bounces and sending reputation. On top of that infrastructure it also says it deploys and operates agents for customers, starting as a general interface to the business by email. s3 s4 s5 s6 s1 s19 s20

Its AI agents

Customer agents

Agents Primitive says it deploys and operates for customers: they begin as a general interface to the business, learn from incoming traffic and create specialised agents for recurring workflows. The business site pitches agents that receive mail sent to the customer's addresses and reply in the same thread from the customer's own domain. s20 s1

What it can do:

Receive customer and partner email sent to the business's addresses
Reply and send in-thread from the customer's domain or a Primitive one
Learn from incoming traffic and spin up specialised agents for recurring workflows

Inbound Functions

Hosted JavaScript handlers that Primitive runs on every email received at an address; the code is the customer's (or their agent's), the runtime is Primitive's. Primitive injects an organisation API key and the webhook secret into each handler, plus any per-Function secrets the customer sets (the docs' example is STRIPE_KEY). s14 s6 s3

What it can do:

Run on every inbound message routed to it
Reply or forward from inside the handler
Call external HTTP APIs
Use the injected org-scoped PRIMITIVE_API_KEY and custom secrets
Read and write Primitive Memories (durable JSON state)

MCP email connector

A hosted MCP server that lets an assistant in Claude, ChatGPT, Cursor, VS Code or Goose act as the authorised Primitive organisation. /mcp lists read and send tools; /mcp/full adds managing domains, webhooks and filters. ChatGPT and Claude render an inbox widget inline. s15 s6 s16 s3

What it can do:

listEmails, searchEmails, getEmail, getInboxStatus, getAccount (read-only)
sendEmail, replyToEmail (marked destructive; hosts are asked to confirm)
On /mcp/full: claim and verify domains, manage webhook endpoints and filters, inspect delivery history

Coding-agent skills

primitive-chat and primitive-inbox skills installed into Claude Code, Codex, Cursor and other coding agents with one command, plus a Codex plugin bundling the MCP server. s8 s17 s6

What it can do:

primitive chat: send to any address and wait (120 seconds by default) for the threaded reply
primitive-inbox: provision a managed *.primitive.email address that receives mail
Self-signup for an account through the agent signup flow

Docs help agent

An agent Primitive runs at its own help address that answers product questions by email, grounded in the public docs; agents landing on the site are told to email it and wait for the reply. s4 s5 s8

What it can do:

Receive questions by email from any address
Reply in-thread with answers grounded in the public docs corpus

Use cases: reach, mandate and gap

For each use case: what the agent can technically reach (from the sources), what a deployer would plausibly authorise (the mandate: illustrative, our judgement), the gap between the two (authority nobody accepted), and the controls that publicly stand in the way.

A Function on a customer inbox, holding the org's key

The agent: Inbound Functions · who uses it: A business that routes its customer address (orders and questions) to a hosted Function, as onprimitive.com pitches (illustrative deployment from documented capabilities)

Reach	Kind	Sources
Every inbound message to the routed address, written by anyone who can send email; Primitive applies spam and policy filtering, but the content is untrusted text	outside	s3 s1
The whole organisation's stored mail, domains, Functions and Memories through the injected PRIMITIVE_API_KEY: Primitive credentials are organisation-scoped and do not advertise granular scopes	data	s14 s10 s7
Replying, forwarding and sending as the business, from its own domain, to recipients the account's send rules allow (broader external sending is enabled per organisation)	outside	s14 s13 s1
Any external HTTP API the handler is written to call	system	s14
Per-Function secrets injected into the running handler, such as a payment provider key (the docs' own example is STRIPE_KEY)	money	s14
Customers and partners whose correspondence is stored until the business deletes it: Primitive does not auto-delete mail on a schedule	people	s7 s3

Mandate (illustrative)
Illustrative: answer order and product questions sent to this one address, in the same thread
Illustrative: read only the thread being answered; leave the rest of the organisation's mail alone
Illustrative: never move money and never write to anyone who did not write first

Gap: reach beyond the mandate	From the reach
The handler's key reaches the whole organisation, not the one address it serves; there is no narrower scope to give it	The whole organisation's stored mail, domains, Functions and Memories through the injected PRIMITIVE_API_KEY: Primitive credentials are organisation-scoped and do not advertise granular scopes; Customers and partners whose correspondence is stored until the business deletes it: Primitive does not auto-delete mail on a schedule
Secrets and outbound HTTP make the handler able to act on payment and other systems on the strength of text that anyone can email in	Every inbound message to the routed address, written by anyone who can send email; Primitive applies spam and policy filtering, but the content is untrusted text; Any external HTTP API the handler is written to call; Per-Function secrets injected into the running handler, such as a payment provider key (the docs' own example is STRIPE_KEY)
Sending beyond the thread depends on the organisation's send rules, which are settings, not the mandate	Replying, forwarding and sending as the business, from its own domain, to recipients the account's send rules allow (broader external sending is enabled per organisation)

Controls that publicly stand in the way	Sources
Webhook deliveries are signed with HMAC-SHA256; the Function scaffold verifies the signature before acting	s7 s14
Tokens are scoped to one organisation and tenants are isolated from each other	s7 s2
Recipient rules: new accounts can send only to addresses that previously sent authenticated mail; wider sending is enabled per organisation	s13 s10
Send rate limits of 1000 per hour and 10000 per day per organisation, and idempotency keys that stop a retried send going out twice	s6 s7
A Function activity log lists the email.sent and email.replied effects each handler produced, and invocations are logged	s14
Agents are told a threaded reply is not proof of who wrote it: trust it only when sender_verified is true	s8

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

A customer emails the business's order address asking where an order is (person, reaches Every inbound message to the routed address, written by anyone who can send email; Primitive applies spam and policy filtering, but the content is untrusted text): inside the mandate
The Function verifies the webhook signature and reads the order thread (agent, reaches Every inbound message to the routed address, written by anyone who can send email; Primitive applies spam and policy filtering, but the content is untrusted text): inside the mandate
(illustrative) The message carries hidden text asking for 'all recent invoices'; the handler's model searches the organisation's stored mail with the injected key (agent, reaches The whole organisation's stored mail, domains, Functions and Memories through the injected PRIMITIVE_API_KEY: Primitive credentials are organisation-scoped and do not advertise granular scopes): outside the mandate: in the gap. What RiskMandate's record shows: The record shows an org-wide key held by a handler whose mandate is one address: read access to every mailbox in the organisation as grant, one thread as mandate, the difference as gap.
Replies in-thread with the order status (agent, reaches Replying, forwarding and sending as the business, from its own domain, to recipients the account's send rules allow (broader external sending is enabled per organisation)): inside the mandate
(illustrative) Forwards the invoices it found to an outside address named in the hidden text (agent, reaches Replying, forwarding and sending as the business, from its own domain, to recipients the account's send rules allow (broader external sending is enabled per organisation)): outside the mandate: in the gap. What RiskMandate's record shows: The record shows sending beyond the thread as reach the account's send rules decide, with the organisation's setting named as the only thing between the grant and the mandate.
(illustrative) Calls the payment provider with the STRIPE_KEY secret to issue a 'goodwill' refund the email asked for (agent, reaches Per-Function secrets injected into the running handler, such as a payment provider key (the docs' own example is STRIPE_KEY)): outside the mandate: in the gap. What RiskMandate's record shows: The record shows a payment secret inside an email handler as money reach that no mandate line covers, priced as exposure.
An operator reads the Function's activity log and sees the forward among the sends (person, reaches Customers and partners whose correspondence is stored until the business deletes it: Primitive does not auto-delete mail on a schedule): inside the mandate

An assistant connected to the org's mail over MCP

The agent: MCP email connector · who uses it: A person who adds Primitive as a connector in Claude or ChatGPT to triage the team's agent inboxes

Reach	Kind	Sources
Every message in the authorised organisation: the connector acts on the whole organisation, reading and writing its email	data	s15 s10
Sending new mail and replies through the organisation's verified domains	outside	s15 s6
On /mcp/full: domains, webhook endpoints and filters, which decide where inbound mail is delivered	system	s15
Correspondents in the inbox, rendered inside the assistant host by the in-agent inbox widget	people	s16 s6

Mandate (illustrative)
Illustrative: summarise and triage new mail for the person
Illustrative: draft replies; send only after the person approves each one
Illustrative: never change where mail is routed

Gap: reach beyond the mandate	From the reach
Send confirmation is a hint to the host (destructiveHint): a well-behaved assistant asks first; nothing in Primitive's grant distinguishes draft from send	Sending new mail and replies through the organisation's verified domains
Connecting /mcp/full puts routing (webhooks, filters) in reach of the same conversation that reads untrusted mail	On /mcp/full: domains, webhook endpoints and filters, which decide where inbound mail is delivered; Every message in the authorised organisation: the connector acts on the whole organisation, reading and writing its email

Controls that publicly stand in the way	Sources
Send tools are marked destructive and documented as confirmation-gated: the assistant asks before it sends	s15 s6
Manage tools exist only on /mcp/full; an assistant on /mcp gets unknown_tool for them	s15
OAuth 2.0 authorisation code with PKCE; the assistant never holds the password and access can be revoked by reconnecting	s15
The inbox widget ships a Content-Security-Policy scoping connect-src, frame-ancestors and form-action	s6

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

Asks the assistant for a summary of today's mail (person, reaches Every message in the authorised organisation: the connector acts on the whole organisation, reading and writing its email): inside the mandate
Lists and reads new messages across the organisation's inboxes (agent, reaches Every message in the authorised organisation: the connector acts on the whole organisation, reading and writing its email): inside the mandate
(illustrative) Reads a message telling it to add a webhook so 'the vendor can sync' (agent, reaches Correspondents in the inbox, rendered inside the assistant host by the in-agent inbox widget): inside the mandate
(illustrative) Adds a webhook endpoint and filter that copy inbound mail to an outside URL, using /mcp/full (agent, reaches On /mcp/full: domains, webhook endpoints and filters, which decide where inbound mail is delivered): outside the mandate: in the gap. What RiskMandate's record shows: The record shows routing changes in the grant of a triage assistant, out of mandate, with the choice of /mcp over /mcp/full named as the control that applies.
Drafts a reply and asks the person before sending (agent, reaches Sending new mail and replies through the organisation's verified domains): inside the mandate
(illustrative) Sends a second reply without asking, because the host did not honour the hint (agent, reaches Sending new mail and replies through the organisation's verified domains): outside the mandate: in the gap. What RiskMandate's record shows: The record shows send as grant and approval-only send as mandate, with the confirmation recorded as an expectation on the host, not a boundary in the grant.

An agent that signs itself up for an email identity

The agent: Coding-agent skills · who uses it: An autonomous or coding agent that uses Primitive's zero-touch signup to get an address, as agents.md invites it to

Reach	Kind	Sources
Creating a new Primitive organisation and managed inbox with one unauthenticated POST, no email and no human in the loop	system	s10 s7
Replying to anyone who has already written to the new address (reply-only, 10 sends an hour, 50 a day)	outside	s10 s21
Durable Memories that keep state across turns and emails	data	s6 s21
Asking a human to confirm an email, or handing them a claim link, to upgrade the account (send cap lifts, Functions unlock)	people	s10

Mandate (illustrative)
Illustrative: use the email identity the operator issued; do not create accounts
Illustrative: ask the operator before any external correspondence

Gap: reach beyond the mandate	From the reach
The agent can mint its own identity and inbox that the operator never issued and may not know exists until a claim is asked for	Creating a new Primitive organisation and managed inbox with one unauthenticated POST, no email and no human in the loop; Durable Memories that keep state across turns and emails
Correspondence from that identity is outside any record the operator keeps	Replying to anyone who has already written to the new address (reply-only, 10 sends an hour, 50 a day); Asking a human to confirm an email, or handing them a claim link, to upgrade the account (send cap lifts, Functions unlock)

Controls that publicly stand in the way	Sources
Zero-touch signup is rate-limited and can only create a brand-new tenant; it cannot read or alter an existing one	s7 s10
New agent accounts start reply-only with tight send limits; upgrading does not unlock arbitrary recipients	s10 s8
Domains can publish an _agents DNS record saying which agents may email them; no record means no permission, and Primitive says the same engine gates real sends	s9

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

Asks a coding agent a question about an API vendor (person, reaches Durable Memories that keep state across turns and emails): inside the mandate
(illustrative) Following agents.md, creates a Primitive account with the zero-touch signup (agent, reaches Creating a new Primitive organisation and managed inbox with one unauthenticated POST, no email and no human in the loop): outside the mandate: in the gap. What RiskMandate's record shows: The record shows an identity created by the agent and not issued by the operator: a new address in reach, no line in the mandate.
(illustrative) Tries to email the vendor and is refused with recipient_not_allowed (agent, reaches Replying to anyone who has already written to the new address (reply-only, 10 sends an hour, 50 a day)): outside the mandate: in the gap. What RiskMandate's record shows: The record shows the attempt and the account's reply-only rule as the control that applied; the attempt itself sits outside the mandate.
(illustrative) Asks the person to confirm an email so the account can be upgraded (agent, reaches Asking a human to confirm an email, or handing them a claim link, to upgrade the account (send cap lifts, Functions unlock)): inside the mandate
Learns the agent has its own address and decides whether to claim it (person, reaches Asking a human to confirm an email, or handing them a claim link, to upgrade the account (send cap lifts, Functions unlock)): inside the mandate

The run

The search agents that looked for leads on 2026-11-07T19:08:45.885Z, for a total cost of $0.1193. What a model says is a lead, not a fact.

Agent	Model	Time	Citations	Leads
Perplexity search	`perplexity/sonar`	6.2 s	15	15
OpenAI search	`openai/gpt-5.4-nano:online`	16.6 s	6	13
Gemini search	`google/gemini-3.1-flash-lite:online`	5.3 s	3	7
OpenRouter web search	`anthropic/claude-haiku-5.5`	16.9 s	5	21

Leads: what the models claimed, and what we found

Model	Claim	Status	Source
perplexity	Primitive is email infrastructure for AI agents with programmatic send and receive over HTTP, managed agent addresses and hosted inbound handlers.	confirmed	s3
perplexity	It offers an in-agent MCP app and persistent agent state (Primitive Memories).	confirmed	s16
perplexity	A managed *.primitive.email address runs a JavaScript handler on every inbound message, uses Primitive MX and needs no user-managed DNS.	confirmed	s12
perplexity	An agent-to-agent chat verb sends a message and waits for the threaded reply, with no SMTP credentials.	confirmed	s4
perplexity	A hosted MCP app UI renders the inbox inside agent hosts such as ChatGPT and Claude.	confirmed	s16
perplexity	One API sends outbound mail, receives inbound mail as signed JSON and runs hosted Functions on incoming messages.	confirmed	s11
perplexity	Use case: agent inbox automation reaching inboxes, inbound routing, hosted Functions and delivery history.	confirmed	s12
perplexity	Use case: an inbox inside ChatGPT or Claude with send, receive and management.	confirmed	s15
perplexity	Primitive describes itself as email infrastructure for AI agents.	confirmed	s4
perplexity	It supports sending and receiving email via a REST API.	confirmed	s6
perplexity	It can host an agent at a managed *.primitive.email subdomain.	confirmed	s6
perplexity	It stores durable agent state with Primitive Memories.	confirmed	s6
perplexity	It handles SPF, DKIM, DMARC, TLS-RPT, bounce processing and IP reputation.	confirmed	s4
perplexity	It positions itself as built for two-way agent conversations rather than only outbound transactional email.	not-found
perplexity	It offers open machine-readable integrations for major agent platforms.	confirmed	s17
openai	Agents get managed identities at *.primitive.email or custom domains, send and receive through authenticated APIs, run hosted Functions and use an agent-to-agent chat flow.	confirmed	s3
openai	Sends are asynchronous and return an identifier for status tracking.	confirmed	s3
openai	Inbound mail goes to developer webhooks or hosted JavaScript Functions per message.	confirmed	s3
openai	Authentication uses organisation-scoped bearer tokens: API keys or OAuth access tokens.	confirmed	s7
openai	Organisations can control which agents may email their domain with a DNS TXT record (_agents), accept or reject with allow lists.	confirmed	s9
openai	Prompt injection in email content can make a tool-using agent act on attacker instructions.	confirmed	s23
openai	Prompt injection against real-world LLM email agents (cited to an accelresearching.com URL).	unverified
openai	Bearer tokens prim_ and prim_oat_ are required for customer data and scoped to one organisation; tenants are isolated.	confirmed	s7
openai	Outbound mail uses managed DKIM, SPF, DMARC and TLS-RPT, with records generated and verified through the API.	confirmed	s7
openai	Webhook deliveries are signed with HMAC-SHA256.	confirmed	s7
openai	Stored inbound mail is not auto-deleted on a schedule.	confirmed	s7
openai	The trust page says authentication, data isolation and message integrity are core to the product.	confirmed	s7
openai	Agents can reach customer-controlled endpoints via signed webhooks and hosted Functions that parse, store, route and reply.	confirmed	s3
gemini	Primitive offers a REST API for agent email, handles SPF, DKIM and DMARC, and provides managed subdomains and hosted JavaScript Functions.	confirmed	s3
gemini	A Primitive agent acts as an autonomous interface for businesses, processing incoming email and executing workflows.	confirmed	s20
gemini	Its agents maintain durable state with Primitive Memories.	confirmed	s6
gemini	Use case: automated business communication for customer support and operations.	confirmed	s1
gemini	AI email agents face indirect prompt injection and data exfiltration risks.	confirmed	s24
gemini	Primitive is Y Combinator-backed with usage-based pricing.	confirmed	s6
gemini	The primitive chat verb sends an email and returns the threaded reply in one call.	confirmed	s18
openrouter	Primitive offers one-call HTTP sending and receiving, managed *.primitive.email addresses, hosted handlers, and manages the protocol layer so agents need no SMTP credentials.	confirmed	s3
openrouter	A primitive-chat skill lets a coding agent email an agent or person and wait for the threaded reply; installs into Claude Code, Codex and Cursor.	confirmed	s8
openrouter	A primitive-inbox skill gives an agent a managed inbox that receives mail.	confirmed	s8
openrouter	A hosted MCP server sends, reads and searches mail and manages domains, endpoints and filters over OAuth and Streamable HTTP.	confirmed	s3
openrouter	Use case: an agent with its own email identity rather than a person's mailbox.	confirmed	s3
openrouter	Use case: custom logic on every inbound message, with signed webhooks.	confirmed	s3
openrouter	Use case: transactional sending from a verified custom domain.	confirmed	s3
openrouter	Functions, Wake schedules, x402 payments and custom domains are gated on the free agent plan.	confirmed	s21
openrouter	Signup through the Pilot listing is rate-limited per IP, with 429 after several new accounts a day.	confirmed	s21
openrouter	The send-mail endpoint takes exactly one recipient and has no CC, BCC, custom header, tags or metadata.	confirmed	s22
openrouter	Primitive is Y Combinator-backed with a small team in San Francisco.	confirmed	s4
openrouter	The inbound MX implementation and the Node, Python and Go SDKs are public on GitHub.	confirmed	s4
openrouter	The REST API is versioned under /v1 and breaking changes come under a new version.	confirmed	s3
openrouter	Primitive manages inbound MX, SPF, DKIM, DMARC, TLS-RPT, bounces and sending-IP reputation.	confirmed	s3
openrouter	Inbound content is kept until the user deletes it.	confirmed	s3
openrouter	Webhook deliveries are signed.	confirmed	s3
openrouter	Primitive publishes an OpenAPI spec, llms.txt and MCP discovery document.	confirmed	s3
openrouter	The MCP server is in public registries and works with Claude, Cursor, VS Code agent mode and Goose.	confirmed	s3
openrouter	The free plan covers sending, replying, inbound list and search, threads, filters, webhooks and Memories.	confirmed	s21
openrouter	Sending requires a verified outbound domain, and API keys are prefixed prim_.	confirmed	s22
openrouter	Idempotency keys make a retried send replay the original result.	confirmed	s22

The questions we would ask

We have not asked them yet.

Can a Function's injected key be narrowed to the one address or route it serves, instead of the whole organisation?
When a Function or MCP assistant sends, what does the record show about which inbound message prompted it, and can a customer export that link?
Which organisations have send_to_any_domain enabled, and what review does Primitive apply before it turns that on?
How do the agents you deploy and operate for customers decide when to create a new specialised agent, and who approves it?
Would you publish the _agents authorisation result alongside each send, so a recipient can see which agent sent and under which rule?
Your security page says it describes current practice, not an audited control set: is a SOC 2 or ISO 27001 audit planned, and what would it cover first?

Sources

s1 Primitive, Primitive (own-site, read 2026-11-07)
https://www.onprimitive.com/
s2 Trust & security | Primitive, Primitive (own-site, read 2026-11-07)
https://www.onprimitive.com/security
s3 primitive.dev: email for AI agents, Primitive (own-site, read 2026-11-07)
https://www.primitive.dev/
s4 About | primitive.dev, Primitive (own-site, read 2026-11-07)
https://www.primitive.dev/about
s5 About Primitive (markdown twin, last updated 16 September 2026), Primitive (own-site, read 2026-11-07)
https://www.primitive.dev/about.md
s6 primitive: full docs bundle, Primitive Docs (docs, read 2026-11-07)
https://docs.primitive.dev/llms-full.txt
s7 Primitive Trust (last updated 25 September 2026), Primitive (own-site, read 2026-11-07)
https://www.primitive.dev/trust.md
s8 Primitive: Instructions for AI Agents, Primitive (docs, read 2026-11-07)
https://www.primitive.dev/agents.md
s9 Agent Authorization (_agents) explorer | primitive.dev, Primitive (own-site, read 2026-11-07)
https://www.primitive.dev/agents
s10 auth.md: Primitive Agent Auth, Primitive (docs, read 2026-11-07)
https://www.primitive.dev/auth.md
s11 Primitive Docs: primitive.dev Email API for AI Agents, Primitive Docs (docs, read 2026-11-07)
https://docs.primitive.dev/docs
s12 Managed Domain: Primitive Email API Docs, Primitive Docs (docs, read 2026-11-07)
https://docs.primitive.dev/docs/managed-inbox
s13 FAQ: Primitive Email API Docs, Primitive Docs (docs, read 2026-11-07)
https://docs.primitive.dev/docs/faq
s14 Functions, Primitive Docs (docs, read 2026-11-07)
https://www.primitive.dev/docs/functions.md
s15 MCP Server & Connectors (Claude & ChatGPT), Primitive Docs (docs, read 2026-11-07)
https://www.primitive.dev/docs/connectors.md
s16 MCP discovery document (primitive.dev), Primitive Docs (docs, read 2026-11-07)
https://docs.primitive.dev/.well-known/mcp
s17 Primitive AI platform integrations | primitive.dev, Primitive (own-site, read 2026-11-07)
https://www.primitive.dev/integrations
s18 primitive.dev vs. AgentMail | primitive.dev, Primitive (own-site, read 2026-11-07)
https://www.primitive.dev/compare/agentmail
s19 primitive: communication for agents | Y Combinator, Y Combinator (other, read 2026-11-07)
https://www.ycombinator.com/companies/primitive
s20 Email Infrastructure Engineer at primitive | Y Combinator, Y Combinator (other, read 2026-11-07)
https://www.ycombinator.com/companies/primitive/jobs/JqLoJbb-email-infrastructure-engineer
s21 Primitive: Agent App Methods & Install | Pilot Protocol (published 14 July 2026), Pilot Protocol (other, read 2026-11-07)
https://pilotprotocol.network/apps/io.pilot.primitive
s22 Primitive: Email SDK adapter, Email SDK (other, read 2026-11-07)
https://email-sdk.dev/docs/adapters/primitive
s23 SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection (4 November 2026), arXiv (other, read 2026-11-07)
https://arxiv.org/abs/2611.07222
s24 AI Email Agents: The Most Dangerous Integration, and How to Contain It, Pinchy (other, read 2026-11-07)
https://heypinchy.com/ai-email-agents/
s25 Primitive makes enterprise email AI-ready. | Web Summit, Web Summit (other, read 2026-11-07)
https://websummit.com/appearances/lis26/bd878c73-f795-4ed0-b16a-2e029d608813/primitive-makes-enterprise-email-ai-ready.

X-rayed by RiskMandate, which measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record (riskmandate.ai/llms.txt). The mandates are illustrative. Built by xray@web-summit.dinis from data/xray/primitive/xray.json.