We believe people are often comfortable trusting an AI agent with a calendar or a few files. But the inbox is where most of us draw the line. There is a good reason for that. An inbox is more than a tool for communication. It is a master key. Password resets, bank alerts, health reports, and identity verification all run through it. All of it arrives in the same place.
We built Clam to decide exactly what each agent is allowed to see and do with your inbox.
- Rules are written in plain English. You might tell it to read flight emails and draft replies, but never to send them.
- Each agent operates within its own Shell. It sees a specific slice of the inbox and nothing more.
- A deterministic Cedar policy check runs on every request.
- Rules go beyond simple pattern-matching. Clam applies semantic policies on top of controls over labels, content type, and thread context.
- No email content is stored. Every read, draft, and blocked attempt is logged alongside the rule that governed it.
We are often asked a fair question: Why should Clam be trusted with a mailbox more than a general-purpose agent?
The answer is found in how that access is managed. Agents like ChatGPT or Claude are designed to be useful above all else. Openness is what makes them so capable and tight limits would restrict their everyday uses.
OAuth scopes are not enough. When you grant an agent a scope like gmail.send or gmail.modify, you are giving the agent complete, unconditional access to act on behalf of your mailbox.
We want agents to do more of the work. Clam exists so you can use agents more, even on the inbox that previously felt too sensitive to connect. Until AI systems prove they can handle access control on their own, we believe a dedicated security layer belongs right next to them.
Early access for Gmail is available at useclam.ai. Try it and let your agents act on your inbox, within rules you set.
Giannis, Sokratis, Stratos
