Make uncertainty visible
A builder who routed a support inbox found that labels alone made every message look equally certain. The fix was a confidence level and an "Other" bucket that holds a best guess. The same applies to an accounts mailbox: an Unsorted label with a guess tells a person where to look.
Count the misroutes that matter
Not every wrong label costs money. The ones that do are invoices, statements, legal letters and tax-authority mail landing in the wrong place. Count those separately in 100 labelled emails held back from the builder, and treat any in the sample as a failure of the whole test.
- The share of each label found and the share right.
- The share going to Unsorted.
- A separate count of misroutes that matter.
Label first, route later
Run the labelling for a week without routing anything, and read a sample of its labels. Only then switch routing on. The connection should be able to read and label mail, and not to send, reply, forward or delete.
Treat every email as hostile text
An email can carry instructions aimed at the automated reader. OWASP cites a published CVE for an LLM-powered email assistant. Plant ten hostile emails in your test, run each several times, and check that none changes a label or triggers an action.
Sources and limits
- n8n community: a support inbox router and what it lacked Checked 2026-10-12.
- On 28 Apr 2026 a builder reported that classification alone hid uncertainty, there was no urgency ranking and non-English mail did worse, and fixed it with a confidence level and an "Other" fallback with a best guess.
- n8n community: freelancer wanted for email classification Checked 2026-10-12.
- A business asked on 21 Apr 2026 for classification of incoming emails into 5 categories, including invoices and urgent mail.
- OWASP: LLM01 prompt injection Checked 2026-10-12.
- Indirect prompt injection happens when a model takes input from external sources such as websites or files; listed mitigations include constraining behaviour, checking output formats with deterministic code, least-privilege access, human approval for high-risk actions, marking untrusted content and adversarial testing; the page cites CVE-2024-5184 in an LLM-powered email assistant.