Least-privilege digest e-mail
Once a week, Myra AI Workspace can e-mail each agent owner a short digest of access their production agents hold but have not used. It uses the same computation as the per-agent least-privilege recommendations, so the mail and the agent view always agree.
The digest is advice only. It never revokes, narrows or changes anything. The owner decides.
What the mail contains
- For each of the owner's production agents that has proposals: the agent name and its unused connector rights (connector and tool), over the default 30-day window.
- At most 50 agents per mail and 10 proposals per agent; the remainder is summarised as "and N more". Agents that are paused for handover are left out, and an owner with no proposals gets no mail.
- A link to the workspace and a link to the user's settings. The mail is sent in the recipient's language (English or German).
When it is sent
- At most one mail per user per week (Europe/Berlin ISO week, Monday start).
- Only Monday to Friday, 08:00-17:59 Europe/Berlin (DST-correct); a sweep outside the window sends nothing and the next one inside it catches up.
- Active-active safe: the weekly claim is a database primary key on user and week, so any
number of nodes can run the sweep and exactly one mail goes out. A relay failure is final for
that week (no retry storm); the marker records
sent,failed,emptyorskipped. - A per-sweep attempt cap (20 claimed users per sweep, whatever the outcome: sent, failed or empty) keeps the shared background worker responsive; excess candidates are picked up by the next sweep within the window.
- Weekly markers are kept for 90 days and then removed.
Switches and opt-outs
| Control | Who | Default | Effect |
|---|---|---|---|
Platform switch least_privilege_digest_enabled |
Platform admin, API only (there is no switch for it in the web app): PUT /admin/v1/settings/least_privilege_digest_enabled |
Off (ships dark) | Off: no digest is sent anywhere |
| Personal opt-out (digest) | The user, API only (the web app has no digest switch): PUT /admin/v1/me/least-privilege-digest |
Opted in | The user receives no digest |
General lifecycle-mail opt-out (reactivation_opted_out_at) |
The user, via the opt-out link in a lifecycle e-mail | Not set | The user receives no digest either |
A mail is sent only when the platform switch is on and neither opt-out is set. Either opt-out alone is enough to suppress it, and the check is repeated atomically when the weekly claim is made, so an opt-out made mid-sweep is honoured.
There is no per-tenant switch. The tenant setting reactivation_emails_enabled governs the
reactivation cadence only and does not affect this digest.
What is deliberately not done
- Nothing is revoked or modified; the digest only proposes.
- Disabled and deleted users, users without an e-mail address, users under a GDPR Art. 18 processing restriction, and users of a deleted tenant receive no digest.
- Internal test workspaces are excluded, and users with a test address are skipped for the week. Neither receives a mail.
- One agent whose data cannot be read is left out of the mail (logged); the digest only fails for the week when every agent of the owner fails.
- At most 200 agents per owner are evaluated; agents beyond the cap are counted in "and N more agents".
- Only production agents are considered.