What should an email agent never be allowed to do?

I built Busymail because I wanted my own agent to work my inbox without it being able to send. The interesting part is not the product, it is the list: what should an email agent never be allowed to do?

Mine so far: send without a human, change account settings or add an account, and read inside an attachment unless the scope says it can. Everything else I can see a case for, with the right scope.

Curious what people would add, especially anyone running email over MCP.