> ## Documentation Index
> Fetch the complete documentation index at: https://www.cloudtag.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Email an agent directly

> Email an agent privately: who can use DMs, separate settings and memory, replies, connectors, limits, and admin controls.

Send an email to an agent's linked mailbox, with no other To or Cc recipients. You do not need to mention its @name or join a Google Group first. The agent replies to you in the same email thread. It ignores Reply-To addresses and never adds other recipients.

Who can email it depends on its mailbox:

| Agent mailbox | Allowed senders |
| --- | --- |
| Personal Gmail (`gmail.com` or `googlemail.com`) | Owners and Admins of the organization that linked it |
| Google Workspace (for example `cloud@example.com`) | Anyone with the exact same email domain (`@example.com`), even without a Cloud Tag account |

Subdomains and other domains do not qualify. Gmail normally authenticates the sender with DMARC. For Workspace agents, a passing DKIM signature for the sender's exact domain also qualifies when Gmail omits DMARC or reports `dmarc=none`, as it can on internal mail. This is Gmail's own authentication result, not merely the presence of a signature or an address in the From header. These checks still apply when a deployment relaxes verification for group mail. Automated mail, bounces, spam and mailing-list messages do not start DMs.

If Workspace mail has neither passing DMARC nor a qualifying DKIM result, the agent emails a confirmation link to the claimed sender on its own domain. Review the message and choose **Confirm my message** only if you sent it. Choose **Don't process** otherwise. Opening the link alone does nothing. A confirmation is valid for 24 hours and authorizes exactly that message, including its commands and attachments; later unverified messages need their own confirmation. Explicit DMARC failures are never bypassed with DKIM or offered a confirmation. Mail without qualifying proof that fails DKIM or SPF is also rejected rather than offered a confirmation.

Before confirmation, the raw message is held encrypted outside agent history, files and memory. Its encrypted copy is cleared when you confirm or decline, and the cron clears expired copies. Deduplication metadata is retained for a week. Unverified messages larger than 10 MB, including their encoded attachments, are ignored. To limit unwanted confirmation mail, each agent sends at most five confirmations per sender per hour, and 100 across all senders per hour. This fallback is for Workspace agents only; personal Gmail agents always require sender authentication.

## Your settings and memory

Each person gets a private DM configuration with each agent. New subjects start separate sessions, while your instructions, files, searchable history and memory persist across your threads with that agent. Different people and different agents have separate DM configurations and memory.

Send `!configure` to get a settings link, or sign in with the Google account matching your sender address and open **Your direct messages** on the Groups page. You can change instructions, model and effort, manage memory and files, connect tools, and decide tool approvals there. Gmail dots and plus aliases use the same DM.

Only the sender can open that DM in Cloud Tag. Organization admins and group members do not gain access to someone else's DM through their roles. The organization still owns its Anthropic account and linked mailbox, and administrators with access to those services may inspect data there.

DMs inherit organization and agent instructions, model and effort. They have their own connectors, skills, repositories, secrets and approval rules. They do not inherit group history, bundles, organization connectors or credentials, or the agent's shared notes. DM notes are never mounted in group sessions or another person's DM.

The agent mailbox's built-in Google Drive access is unavailable in DMs. Connect your own Drive account as an MCP or personal connector to use Drive. Attachments and files you upload remain available in your DM.

## Replies and limits

Reply to the agent's email to continue a thread; start a new email for a new conversation. Commands including `!help`, `!configure`, `!mute`, `!unmute`, `!restart`, `!status` and `!fast` work here. `!fork` can start another thread within your DM; it cannot move DM history to a group. Cross-group command targets are unavailable from DMs.

An agent accepts up to 30 messages per person per hour, across all that person's threads. The usual per-thread reply cap and monthly budgets also apply. DMs bill to the organization's Anthropic account; there is no separate personal Claude subscription billing. The organization's default per-channel budget applies to each person's DM configuration. You can lower your DM budget, but cannot raise it above the organization's cap.

An organization Owner or Admin can turn off **Allow direct messages by email** in an agent's settings. Removing an admin's organization membership also revokes their DM access to a personal Gmail agent. Pending work and replies recheck access before continuing or sending. Work already underway in an external service may finish.

Deleting your DM removes its Cloud Tag history, settings, files and memory using the same cleanup process as a group. A later authorized email starts a fresh DM. Deleting the organization removes its DMs too; see [Data lifecycle](/docs/concepts/data-lifecycle) for external retention limits.