See how each task progresses from observation to recommendations and safe automation, backed by measurable decision evidence.
Explore Gmail workflows with controlled access and task-specific permissions. Google Calendar and Drive integrations are planned.
Review AI-suggested email actions with clear reasoning and past decision evidence. You stay in control of every decision.
Watch Probation earn task-specific permissions through consistent decisions, verified evidence, and safety checks.
Track every action with a transparent history, execution status, and options to undo or cancel eligible changes.
Your central workspace for reviewing AI suggestions, tracking pending decisions, and monitoring earned permissions.

Inspiration

Everyone says "just let the AI handle your mail", but the two options we actually get are both bad. Either it asks permission for every small thing and we start clicking yes without reading, or we trust it blindly and one wrong action ruins it. Anthropic reported that users approve roughly 93% of Claude Code permission prompts. That basically means the prompt has stopped protecting anyone.

We thought about how a new person gets trusted at a job. Nobody gives them the bank login on day one. They watch, they handle small things, and they get more responsibility once they have proved themselves. Our inboxes are the same: recruiter mails, college portal notices, newsletters, hackathon and internship offers, and the occasional fake one asking for a "registration fee". Some of these can be handled without us, some definitely cannot, and the assistant should know the difference from evidence, not from a confident-sounding model.

What it does

Probation looks at the footprints you already leave (what you replied to, archived or trashed) and predicts what you would do with each new mail. It writes that prediction into a tamper-evident log before it knows the answer, then checks what you actually did.

Permission is earned separately for each kind of task and action. Archiving newsletters from automated senders is one permission, replying to a professor is a completely different one. Each has four levels: Watching, Suggests, Acts with undo, Acts automatically. To move up it needs enough clean agreements (58 out of 58 gives a 95% safe estimate, 148 out of 148 gives 98%), and it has to pass a trick-question exam where we edit real mails (add a money request, make the sender unknown, hide an instruction) and check that it does not become more willing to act. If your habits change, the permission drops on its own.

In the Gmail prototype it can archive, trash and forward-to-self, with Gmail's own receipts as proof, and undo works for archive and trash. A reply is offered only when a validated draft exists. A brand new account has no history, so it simply asks you, which is the correct behaviour. Tavily checks public information about unfamiliar senders and can only make Probation more careful, never less. All data in the public demo is synthetic.

How we built it

The backend is Python, FastAPI and SQLite, and the dashboard is React with TypeScript. Nemotron runs through Nebius Token Factory and does only two jobs. Nemotron 3 Super reads a redacted mail into a strict JSON form (intent, deadline, is money involved, does it ask for personal info) and writes reply drafts in the user's style. Nemotron 3 Nano handles the lighter extraction work. The model never gets tools or credentials, every output is validated against a schema, and any failure turns into "ask the user".

The learning part is deliberately not an LLM. It is a small logistic regression trained on the user's own history, with a strict no-peeking rule so a decision at time t can only see what was known at time t. Text is redacted before it leaves the machine, and a budget guard stops spending. Only the Executor process has Gmail write access, and read and write OAuth grants are stored separately. Tavily queries are built by code from public domains and brand names only. The exam verdicts are computed by code, never by a model grading itself.

Challenges we ran into

Getting a model to behave like a form-filler was harder than expected. Sometimes the model filled only its reasoning channel, so we run with thinking off and treat that as a failure. Polite requests like "Could you send the file?" kept being labelled as questions until we rewrote the prompt with proper definitions. On our six-case mail-intent check Nano got 2 right and Super got 6, so the choice of model really matters here.

Undo is harder than do. We only claim an undo when Gmail's history proves the original labels came back, and we refuse when the state is unclear.

Halfway through we audited our own repo and found parts that looked finished but were not wired end to end. We rebuilt those parts instead of hiding it. Also, Gmail OAuth in test mode means judges cannot connect their own mailbox, which is why the public demo runs on a synthetic person.

Accomplishments that we're proud of

Real Gmail actions executed through a separate Executor with provider receipts, and confirmed undo for archive and trash. When we last ran the full check, 1,509 backend tests and 39 browser tests passed. The live model checks have cost about half a cent in total. And the README lists what does not work yet, which we think is a feature.

What we learned

Approval clicks are weak evidence, so permission should be earned from what the person actually did, not from what they clicked yes on. A bigger model is not always needed, but the cheap one is not always enough either. And "fail closed" is mostly about carefully designing what happens in the else branch.

What's next for Probation

Calendar and Drive support, and bringing back the files and follow-up chain packs that already have code. Turning earned permissions into an NVIDIA OpenShell network policy so even a bug in our gate cannot do more than the evidence allows. A small skill so other agents can ask Probation before sending mail. And using it on our own mailboxes for a few weeks to see how it behaves with real habits.