Can I control who's able to reach my agent?

Yes. Out of the box, a Workforce agent's email inbox accepts mail from any sender, the same as a new hire's would on day one. If you want to restrict who can reach it, you control that the same way you would for any employee mailbox, through your own Google Workspace or Microsoft 365 admin console:

• Put the agent's mailbox in its own org unit / group.

• Add a content-compliance or mail-flow rule scoped to that unit with an allowlist (your domain, plus any specific outside partners) and a quarantine action for anything off-list.

• Off-list mail is held for your admin to approve or deny, rather than silently reaching the agent, so legitimate one-off senders (a signup confirmation, a new vendor) still get through with a quick review.

This is admin-driven on your side, the same control you'd use to lock down any other shared mailbox, and we're happy to walk through the setup during onboarding if you want it in place from day one.

Limiting who can direct the agent: separately from who can email it, you can limit who can give the agent instructions to your company email domain. For example, freelancers on a project get access only while they're on it. Contact permissions are set in the dashboard.