AI agent that answers “is my invoice paid?” emails safely
Customers email to ask whether an invoice is paid. An agent can check the ledger and draft the reply in seconds, as long as it can't be talked into forwarding your invoices somewhere else.
Gmail
HubSpot
NetSuiteThe workflow
A customer email arrives in Gmail. The agent finds the customer in HubSpot, looks up the invoice in NetSuite, and drafts a reply and a CRM note for approval.
The attack hidden in it
A zero-size line in the email tells “the AI assistant” to forward all customer invoices to an outside address and keep quiet about it.
How the guardrails handle it
- Screening withholds the hidden line before the agent reads the email; the customer's question stays.
- The reply and the CRM note wait for a person, with the exact request shown.
- Even if the agent tried, mail can't leave through hosts outside each app's allowlist.
Same workflow, every company size
The agent and the guardrails stay the same; only the systems behind them change.
Sage Intacct
Microsoft Dynamics 365 Business Central
Exact Online
Xero
Moneybird
QuickBooksQuestions
Can an AI agent read our accounting system to answer invoice questions?
Yes. It reads invoices through the accounting system's own API (NetSuite, QuickBooks, Xero and 50+ others) with credentials it never sees.
What stops a malicious email from instructing the agent?
Every email is screened before the agent reads it. Lines written for an AI are withheld, and anything the agent wants to send waits for approval.
Does the agent send replies by itself?
No. Writes, including email drafts, stop until a person approves the exact request.