Phishing reply attack. A spoofed email from “your bank” or “your CEO” that the classifier scores as routine and that the drafter helpfully replies to with sensitive context — this is the highest-stakes failure mode in M5. Configure hard never-draft topics (wire transfers, password resets, login credentials, “urgent” CEO requests) before Day 7. Test with three synthetic phishing inbounds.
Voice drift to generic AI. Your voice on Day 1 is yours; your voice on Day 30 starts looking like every other AI draft if nobody is checking. Solo+ tier includes a quarterly voice-drift review for this exact reason; on Pilot, schedule it yourself.
OAuth scope creep. Grant the minimum: read, create draft, label, archive. Never grant delete or send-on-behalf at the OAuth layer — those should require Stage 2+ explicit promotion. If a tool asks for full mailbox access on install, refuse.
Body storage. Audit metadata, never email bodies. The Airtable logging schema is metadata-only by design. If you ever build a custom integration, the rule holds: classification decisions and edit events get logged; the actual content of an email does not leave your inbox.