API keys, AI agents and approvals

Keys are passwords for software

On API keys, Create API key gives an app or AI agent access to chosen mailboxes without a password or two-factor. So: name it clearly, pick as few mailboxes as possible, and give only the permissions needed: Read messages and folders, Send mail, Move, flag and delete messages. The key is shown once.

Agent rules

Switch on This key is for an AI agent to add rules enforced by PGB Business:

• What it may read: limit by folder and sender.
• What it may send: Recipients (anyone, known contacts, workspace only, or listed domains), Most recipients per message, Messages per day and Quiet hours.
• What happens outside the rules: Refuse, Hold for approval, or Hold every message for approval.

Do it: an invoice agent

1. Create API key, name Invoice agent.
2. Mailboxes: only invoices@.
3. Permissions: Read and Send mail.
4. Switch on This key is for an AI agent.
5. Recipients Only these domains, and Hold every message for approval.
6. Create key, copy it, and Save rules.

Approvals

Held messages appear in Approvals, tabs Waiting, Approved, Rejected, Expired. Open one, read Why it needs approval and the full text, add a Note, then Approve and send or Reject. Only the mailbox's owner or an administrator can decide. After 72 hours it expires unsent.

Pause or revoke

Pause stops a key until you resume it. Revoke ends it permanently. Revoke any key you do not use.

See API keys and AI agent rules and Approve or reject agent email.

Recap

• Least privilege: few mailboxes, few permissions.
• Start agents on "hold every message".
• Approve like you were sending it yourself.