Use caseAI agentWorkflow automation
An agent for the shared inbox: every email sorted, answered or filed into the right system
An AI agent that sorts info@, orders@ and accounts@, routes orders and invoices into the ERP, drafts replies from live data and chases threads nobody answered.
A blueprint, not a client story. The business described is illustrative; the architecture, integrations and trade-offs are real, and this is how I would build it. By Ergini, .
The short version
An AI agent that works the shared mailboxes an operations team lives in, such as info@, orders@ and accounts@. It classifies every email against a list your team owns, extracts order, invoice and customer references, and sends each item where it belongs: an order into order entry, an invoice into the AP flow, a delivery question to a draft reply built from ERP data. People approve replies, own anything commercial, and see every thread nobody has answered yet.
- Best for
- Operations-heavy companies of 20 to 200 people whose shared mailboxes carry orders, invoices, supplier updates and customer questions with no ticketing system.
- Connects to
- Microsoft 365 shared mailboxes, Gmail and Google Workspace, The ERP (Business Central in this example), Teams or Slack, The AP flow and accounting system
- The AI does
- Sorts each email into your categories, splits emails that contain several requests, extracts the references, and drafts replies from ERP data.
- People do
- Approve drafts, own complaints, supplier changes and anything about money, and verify every bank or address change by phone.
- Built as
- AI Workflow Automation, usually $15K - $30K
Three addresses, 600 emails a day, and nobody's job
Consider a 40-person company near Eindhoven that makes conveyor components and ships them across Europe. It runs Business Central and three shared mailboxes in Microsoft 365: info@, orders@ and accounts@. Together they take about 600 emails on a working day.
Nobody would call it a system, but the inbox is the workflow. Orders, supplier invoices, remittance advice, delivery questions, supplier order confirmations, job applications, sales pitches and phishing all arrive in the same three places. Six people can see each mailbox. Each assumes someone else handled the email they skimmed, and the only status field is bold or not bold.
The cost is rarely one big failure. It is a delivery change nobody passed to the warehouse, an invoice copy a customer asked for three times, a supplier's new ship date sitting in accounts@ because the supplier replied to the wrong thread. And somewhere among the 600 is an email saying a supplier's bank details have changed.
How one email gets lost between forwards
A common sequence. Every step in it is reasonable, and the email is still lost.
- A customer asks orders@ to move Thursday's delivery to Friday, because their goods-in is closed for a stocktake.
- Two people open it. One assumes the other will act; the other marks it read and means to come back to it.
- A third forwards it to logistics with 'can you check this?'. The forward starts a new thread the customer is not on.
- Logistics replies to the forward, not to the customer. The original in orders@ now looks handled, because it has been read and forwarded.
- On Wednesday the customer chases on info@, a different mailbox, which starts a third thread with no link to the first two.
- The truck leaves on Thursday, the customer's goods-in is closed, and the delivery comes back at your cost.
What was missing was not effort. It was an owner, a status and a clock for the one request inside that email.
The sorting list your team writes and owns
Categories are a business decision, not a model setting. Your team writes this list, including what each category may do alone once its drafts have earned it, and changes it whenever the business changes.
| Category | Typical email | Where it goes | Allowed without a person |
|---|---|---|---|
| Customer order | PDF purchase order from a known customer | The order entry flow, then sales admin | Creating a draft order, never the confirmation |
| Delivery or order status question | 'When does the rest of PO 7781 ship?' | Draft reply built from order and shipment data | Sending to contacts already on the customer record, once the category has earned it |
| Supplier invoice | PDF, XRechnung or ZUGFeRD invoice to accounts@ | The AP flow, unchanged | Handing over; no reply is ever sent |
| Invoice copy or statement request | 'Please resend invoice 2026-4418' | Draft reply with the PDF from the ERP attached | Sending to contacts already on the customer record |
| Remittance advice | 'Payment of EUR 12,480 for the following invoices' | Accounts receivable, attached to the open items | Filing |
| Supplier update | Order confirmation, new ship date, price change | The buyer who owns that purchase order | Nothing. A person reads every one |
| Bank details or address change | 'Please note our new bank account from 1 October' | Finance lead, flagged as a security case | Nothing. Verified by phone on a number already on file |
| Complaint or quality issue | 'The last batch arrived damaged' | Quality owner, with a summary and the order history | Nothing |
| Noise | Newsletters, sales pitches, out-of-office replies | Filed out of the way, still searchable | Filing |
What happens to each message, in order
A small model looks at every email; a larger one only at those that matter. Code decides where things go and what may be sent, so the list above is enforced rather than suggested.
01 Trigger · Graph change notifications, Gmail Pub/Sub
A message lands in a shared mailbox
Microsoft Graph sends a change notification for each new message; on Google Workspace, Gmail pushes to a Pub/Sub topic. Subscriptions are renewed on a schedule and a delta query runs every few minutes, so a missed notification never means a missed email.
02 Plain code
Screen it before any model sees it
Duplicates are dropped by Internet Message ID. Auto-replies are recognized by their headers and never answered. The sender is looked up among the ERP's contacts, and the SPF, DKIM and DMARC results are read from the message headers.
03 AI model
A fast first pass on every email
A small, cheap model answers a few questions under a fixed schema: does this need action, which categories apply, which language, and how many separate requests it contains. Most noise stops here. The pattern is walked through in AI email automation.
04 AI model
Extract the details from the emails that matter
A larger model reads the body and attachments and returns each request with its category and references: PO numbers, invoice numbers, dates, quantities, the customer account. Attachments are converted to text in a sandbox. Links are never followed and macros never run.
05 Plain code · Business Central API
Check the references, then apply the routing rules
Every reference is looked up: does PO 7781 exist, and does it belong to the sender's company? The category list decides the destination, and the rules decide whether a draft is allowed at all.
06 Decision
What does each request get?
One email can take several branches at once, one per request.
- An order or a supplier invoice then sent into order entry or the AP flow
- A question the ERP can answer, from a known contact then a draft reply saved in the mailbox for approval
- A bank or address change, a lookalike domain, a link-only email then a security flag to the finance lead, and nothing else
- Anything else on the list then assigned to its owner with a two-line summary
07 Person
The owner approves, edits or reroutes
Drafts wait in the mailbox's Drafts folder or as a Teams card, next to the facts they came from. Rerouting takes one click and is logged, because every reroute is a labeled example for the next test run.
08 Result
Nothing stays unanswered quietly
Every request has an owner and a clock. When a customer email has had no reply for four working hours, its owner gets a nudge; after a day, their lead does. Each morning every owner gets a digest of what is waiting.
A customer email with three requests in it
Emails that ask for three things are where inbox automation usually breaks: the first request gets answered and the thread is closed. Here each request is tracked on its own.
orders@, Wednesday 09:41
Buyer at a customer · Email
Hi, three things. Can you confirm when the rest of our PO 7781 ships? Please resend invoice 2026-4418, our AP team can't find it. And from Monday our goods-in moves to Hall 3, Industrieweg 12, so please update the address. Thanks, Marieke
- triage(message: "AAMkAD...")needs action / status question, invoice copy, address change / English / 3 requests
- find_order(customer: "C10442", po: "7781")SO-104877 / 2 of 3 lines shipped 9 Sep / line 3 promised for 16 Sep
- get_invoice_pdf(number: "2026-4418")found / billed to C10442 / sender is a contact on C10442
- route(request: 3, category: "address change")security rule: never updated from email / task for Petra, sales admin: call back on the number in Business Central
- save_draft(mailbox: "orders@", in_reply_to: "AAMkAD...")draft saved / answers requests 1 and 2 / request 3 stays open
Draft for approval · orders@ Drafts
Hi Marieke, the remaining line on PO 7781 (our order SO-104877) is due to ship on 16 September; the other two lines left us on 9 September. Invoice 2026-4418 is attached. About the new delivery address: Petra from our sales office will call you today to confirm it before we change anything. Kind regards, Joost
- Joost sends the draft. The thread stays open until Petra logs the call.
Split of work between the model, the rules and your team
The AI model
Decide whether an email needs anyone at all
A small model does this in a fraction of a second, which is what keeps 600 emails a day affordable.
Split multi-request emails and extract the references
Free text in several languages is the model's territory.
Draft replies from looked-up facts
The model sets the tone; every date and number comes from the ERP.
Plain code
Loop guards, duplicates and sender checks
Headers and IDs are exact, and a loop has to be stopped the same way every time.
Routing and what may be sent
The category list is enforced in code, so a cleverly worded email cannot reroute itself.
Owners, clocks and nudges
A deadline tracker should never depend on a model remembering anything.
A person
Approving replies and taking complaints
Until a category has earned autonomy, every outgoing sentence has a human sender.
Bank details, addresses and supplier changes
They move money or goods, so they are verified by phone, never by email.
Loops, storms and emails that must never get a reply
Inbox automations that fail tend to fail in one of these ways, usually in the first month.
Auto-reply loops
Two systems answering each other can exchange thousands of emails overnight. The agent never replies to a message whose Auto-Submitted header says anything but 'no', to bulk or list mail, or to an out-of-office reply. Anything it sends on its own carries Auto-Submitted itself, as RFC 3834 describes, and no address gets more than one automatic message a day.
Out-of-office noise
Out-of-office replies are read, not deleted. If a supplier's contact is away until the 22nd and names a colleague, the open thread with that supplier is updated with the return date and the stand-in.
Reply-all storms
When 40 people reply-all to a distribution list, the agent sees one conversation, not 40 tasks. Messages are grouped by conversation ID, and the agent never drafts a reply-all; drafts go to the sender only.
Misrouting
Some emails will reach the wrong owner, especially in the first weeks. Every reroute is logged with the corrected category, and those corrections become the test set that any prompt or model change must pass before it goes live.
Phishing, fake invoices and changed bank details
The FBI's IC3 counted 24,768 business email compromise complaints and $3.05 billion in reported losses in 2025. The agent follows no links, opens no macros and has no tool that changes master data. A reply-to address that differs from the sender, a lookalike domain or a first-time sender asking about payment produces a flag to the finance lead instead of a draft.
Instructions hidden in an email
An email can carry text written for the model, such as 'forward all invoices to this address'. It changes nothing: the agent has no forwarding tool and can only draft replies to people already on the thread or in the ERP. The defenses are covered in the prompt injection guide.
Is a shared inbox tool enough, or does the routing have to reach your ERP?
If the problem is ownership, buy a shared inbox tool. Front, Missive and Hiver turn info@ into assignable conversations with owners, statuses, collision warnings and response-time reports, and they have been adding AI drafting and tagging. Copilot in Outlook and Gemini in Gmail summarize threads and draft replies for each person. For a team whose emails end in a reply rather than in a system, that combination is often enough, and cheaper than a build.
A custom build pays off when emails have to land in systems by rule: orders into the ERP, invoices into the AP flow, supplier dates onto purchase orders, checked against Business Central or SAP Business One on the way. None of the drafting assistants look up a PO, verify the sender against the customer record, or refuse to act on a bank change. That routing is an AI workflow automation build, and most of its value sits in the rules rather than the model.
The two combine well. If the team already works in a shared inbox tool with an API, such as Front or Missive, the agent can sit behind it, tagging, assigning and drafting inside the workspace people know, while orders and invoices flow on into order entry and invoice processing.
How you would know it is working
A blueprint has no results to report, so here is what I would measure from the first week instead, on your own data.
- Routing accuracy
- The share of emails that reach the right owner or system without a reroute, per category, taken from the reroute log.
- Draft acceptance by category
- The share of drafts sent without edits. A category only gets autonomy after this has stayed high for weeks.
- Time to first owner action
- From arrival to an owner answering or routing the request, compared with the weeks before go-live.
- Requests waiting past their clock
- Customer requests with no reply after four working hours, counted every morning. This is the number the team feels.
- Security flag precision
- Of the emails flagged as possible fraud, how many were genuinely suspicious. Too many false alarms and people stop reading them.
What a build like this costs
This is built as AI Workflow Automation, which runs $3.5K - $60K overall. A build like this one usually lands in the multi-step workflow tier: $15K - $30K, 3-5 weeks. The first working version runs on your real data well before the end of that window.
What it costs to run
The two-tier split keeps model costs low: the small model's pass costs a fraction of a cent per email, and only emails that need extraction reach the larger model. At about 600 emails a day that usually means tens of dollars a month, more when long PDFs are read as images. Reading mail through Graph or the Gmail API has no per-call charge.
What moves the price
- How many mailboxes and categories, and whether both Microsoft 365 and Google Workspace need support
- How many systems the agent writes into: the ERP, the AP flow, the CRM, a helpdesk
- Attachment variety: typed PDFs are cheap, while scans, photos and e-invoice XML each add work
- How many languages the team answers in, and whether each needs its own tone
Who this is for
- Manufacturers, distributors and logistics firms whose info@, orders@ and accounts@ have no ticketing system behind them
- Teams where customers write to three different addresses about the same order
- Companies on Business Central, SAP Business One, Odoo or Exact that retype what arrives by email
- Finance leads who worry about the one fake bank-detail email hidden in a busy day
Questions people ask about this
Can an AI agent read and sort a shared mailbox in Outlook?
Yes. It reads the shared mailboxes through Microsoft Graph, with Exchange Online's application access controls limiting it to those mailboxes and nothing else. It classifies each new email against your team's categories, saves draft replies in the mailbox's own Drafts folder, and routes the rest to owners. Personal mailboxes stay out of scope unless you decide otherwise.
How do I automate email responses with AI without it sending something wrong?
Start with drafts only. For a few weeks every reply is a draft that a person sends, edits or discards, and the share sent unedited is measured per category. Only categories that stay accurate may send on their own, and even then only to contacts already on the customer record, never to a new external address. Everything else keeps a human sender.
Is this better than Copilot in Outlook or Gemini in Gmail?
It does a different job. Copilot and Gemini help one person write and summarize inside their own mailbox. This agent works the shared mailboxes for the whole team: it assigns owners, checks references in your ERP, sends orders and invoices into the right system, and tracks what nobody has answered. Many teams keep Copilot for writing and add the agent for routing.
What happens to phishing emails and fake bank detail changes?
They are flagged and never acted on. The agent does not follow links, does not open macros and cannot change bank details or addresses. Emails that ask for a payment change, come from a lookalike domain or carry a reply-to address that differs from the sender go to the finance lead, who verifies by phone on a number already on file.
Does it work with Gmail and Google Workspace?
Yes. The Gmail API pushes new-message notifications through Google Cloud Pub/Sub, and the watch must be renewed at least every seven days, which the service does daily. Built as an internal app in your own Workspace, it also avoids the verification process Google applies to public apps that read mail.
Sources