Enable access and choose levels

Agent permissions are set in Heron, under Settings → AI agents on desktop and mobile. You can also adjust them on the authorization screen shown when you connect an agent.

Turn on AI agent access

The AI agent access switch is the master setting, off by default. While it’s off, no agent can access your email, whatever levels you chose. Allowing an agent from the sign-in screen also turns it on.

Good to know: if you see Available with Heron Pro instead of the settings, agent access isn’t open for your account yet. You can still see and disconnect agents that are already connected.

The four access levels

Under Access per mailbox, each mailbox has its own level:

Level	The agent can…
No access (default)	nothing: the mailbox is invisible to it
Read	list, search and read emails, conversations, attachment text and contacts
Read + drafts and organizing	also: create and edit drafts, archive, move, mark read or unread, flag, pin, set aside, snooze, undo an action
Everything, including sending	also: send and schedule emails

A mailbox added later always starts with No access.

Presets

Presets apply one level to all your mailboxes at once: No access anywhere, Read everywhere, Read + organizing everywhere or Allow everything. If you then change a single mailbox, the preset shows Custom.

Other settings

• Confirm before sending (on by default): every send requested by an agent waits for your approval. See Approve an agent’s sends.
• Show in sidebar: adds an AI agents entry below your folders, with sends awaiting approval.

Good to know

• Drafts created by an agent are saved in the mailbox’s real Drafts folder: you’ll find them in Heron and in any mail app.
• An agent’s organizing actions can be undone for 10 minutes.
• If an agent says an action was denied, the mailbox’s level doesn’t allow it: raise it if you want to.

Start small: Read is enough for a morning brief or a summary. See also Security best practices.