Question
Can an email agent remove triage effort while keeping destructive actions and external task creation understandable and user-controlled?
LAB 005 / PROTOTYPE
Human-in-the-loop Email Agent
Testing an agent flow that separates inbox interpretation from confirmed side effects.
01 / LAB NOTES
Hypothesis
An agent can safely handle classification, summarization, and planning when tool execution is delayed until after it presents a concrete action plan and receives confirmation.
Prototype
Gemini runs inside a Google ADK agent with narrow tools for fetching, archiving, and trashing Gmail messages; reading and writing sender preferences; and creating Notion tasks through MCP. The instruction requires rules to be loaded before classification and requires a recommended plan rather than an open-ended “what next?” response.
Safety Boundary
Interpretation and execution are separate stages. The model groups messages and proposes actions, but Gmail and Notion changes occur through explicit tools after the review loop. OAuth tokens and service credentials remain outside source control.
Result
The prototype completes the full path from natural-language request to categorized inbox, reviewed plan, email action, preference memory, and structured Notion task creation. It also makes the path to production clear: authenticated per-user sessions, durable scoped memory, action previews, and audit history.
What I learned
Human approval is most useful when it is designed into the agent flow, not added as a generic confirmation dialog. A good review step needs a readable summary, an explicit proposed action, and tools whose effects are narrow enough for the user to reason about.
TOOLS & TECHNOLOGIES
01Python02Google ADK03Gemini04Gmail API05MCP06Notion API