Guarded named-mailbox operation
How one operator request becomes a mailbox-specific, exact, reviewable, reversible action while identity ambiguity, untrusted message content, stale authority, protected mail, and state drift fail closed.
Workflow steps
- 1
Resolve the alias to exactly one enabled immutable account record and capability profile
Decision
- 2
Operator names one registered mailbox alias and one bounded job
Action
- 3
Load credentials by opaque Keychain reference and attest the live provider profile before reading
Process
- 4
Discover and classify bounded candidates while treating all mail content and links as untrusted data
Process
- 5
Freeze exact provider IDs, prior state, policy version, protection checks, expiry, and rollback plan as the review artifact
Action
- 6
Human operator reviews mailbox, action, count, exclusions, exact plan, and authority unless narrow standing additive-label authority applies
Decision
- 7
Root operator re-attests identity and revalidates every frozen target immediately before mutation
Process
- 8
Stop on ambiguity, stale authority, protected content, or drift; otherwise persist intent and execute only the allowed reversible action
Decision
- 9
Read provider state back, record applied, skipped, failed, and unattempted outcomes, and never estimate success
Process
- 10
Retain a minimal redacted receipt and exact rollback manifest linked to the immutable mailbox and plan
Action