The row that matters most is "can the agent send on its own": with a compose window as the only exit, a prompt injection in one email ends as a draft, not a sent mail. Marking bodies as untrusted helps, but it is a hint to the model, not a wall. Does the one-week undo also cover drafts the agent created?