On this page
Much of a law firm's work arrives by email from people outside it, opposing counsel's filings among it. Someone reads each one, finds the matter it belongs to and answers it, hours a day, which makes the shared inbox an obvious place to start with AI agents.
Business email compromise, the fraud that talks a company into paying the wrong account, cost $3,046,598,558 in losses reported to the FBI in 2025 across 24,768 complaints: about $123,000 a complaint. That is the price when a person is fooled into paying, and an agent with payment rights is the same target.
The arithmetic, on assumptions to swap for your own count: a shared inbox gets 150 emails a day at four minutes each, 10 hours a day of reading, looking up and drafting. If 15 end in an outward action checked in 30 seconds, a person spends under 8 minutes a day on those.
Paralegals and legal assistants earned a mean $69,700 in May 2025, the Bureau of Labor Statistics reports, about $99,600 a year with benefits at 30% of private employer costs; two of them on the inbox spend about 63% of their week on it.
Shared Inbox Handling ROI Calculator
What Reading Each Email, Finding The Matter And Drafting The Reply Costs You, And What An Agent Saves
Saved Per Year
$105,746
2,359 hours handed back, after $7,200 a year to run it
- Hours Handed Back
- 2,359 hours a year
- Agent Running Cost (Estimate)
- $600 a month
- Payback Per $10,000 Of Build
- 1.1 months
On these numbers, the agent saves $105,746 a year after its own running cost, and every $10,000 of the build is earned back in 1.1 months.
On those numbers the inbox costs $125,496 a year, and $19,750 with AI agents taking about 90% of it, our assumption, with the exceptions they hand back left to staff ($12,550 of staff time left and $7,200 a year to run them): $105,746 and 2,359 hours handed back, and every $10,000 of the build earned back in 1.1 months.
What the Agents May Touch and What Stays With a Person
An attack on an inbox agent needs three things at once: mail whose words someone outside controls, data worth taking, and the power to send, pay or change something.
Some jobs need all three, like telling a client what was filed in their matter. Split those in two. The first step reads the email, attachments included, and fills in a fixed form: who sent it, the kind of request from a short list, the reference number, the dates and amounts.
The second step works from the form alone and never sees the email, so a line telling it to send the client list somewhere has no box to land in.
The form protects you only if every box is a choice from a list, a reference that must exist in your records and belong to that sender, or a number checked against them. One free-text box passed along would carry the email's words straight through.
A box can still hold a wrong amount, though, so anything that sends, pays or changes a payee keeps a person.
The power to act is a setting, not a sentence in the agents' instructions. They get their own mailbox, send permission limited to that mailbox, and a mail rule that stops them writing to any outside address beyond a fixed acknowledgement on the same thread. Payment changes stay out of their tools entirely.
So the person sits only on the short list in the table below: a send to a new address, a forward, a file leaving, a change to a payee. Each shows the person the email behind the action, so they judge the request and not the agents' summary of it. A change of bank details gets a call to a number you already had on file.
| What it does | What it adds | Who finishes it |
|---|---|---|
| Read, summarize and sort incoming mail | Outside mail | The agents |
| Look up the matter | Your data | The agents, read-only |
| Draft a reply for a person to send | Nothing leaves | The agents draft |
| Send a fixed acknowledgement on the same thread | A send with no data | The agents, by a fixed rule |
| Update a status or date in your matter system | A change | The agents, from checked details |
| Send to a new address, forward, attach a file | The power to act | A person |
| Change who gets paid or where | The power to act | A person, by phone |
| Delete mail or change forwarding rules | Hides what happened | Never the agents |
How Qvery Sets Up the Agents Around Your Inbox
Our work on a shared inbox starts with how the mail gets handled today: which messages arrive, which records they touch, and which replies carry money or client data. The agents we build read each message as it lands, sort it, find the matter it belongs to and draft the answer.
They handle that work unattended while the inbox's owner keeps the decisions, and the step that reads passes on details only. You choose which actions complete on their own and which wait for one of your people, and their mailbox gets send rights to match.
A first working result reaches your real mail inside two weeks once access is in place. We connect the agents to your matter system and train the people who finish what they prepare; every week you see the hours they took off the team and the errors they caught.
Each action is logged next to the email that triggered it, and one owner can pause the agents and cut their access.
Bring Us a Week of Your Firm's Mail
Bring a week of the shared inbox's mail. Real mail runs through the agents within two weeks once access is in place, and a person releases anything that leaves the firm beyond a fixed acknowledgement.
What the agents may read and do is set in a written agreement, your data is processed where that agreement says, and every action the agents take is logged.
Frequently asked questions
What permissions should an AI email agent never have?
Never all three of these at once: reading mail from outside, seeing your firm's data, and sending, paying or changing something. The agents we build also never change who gets paid, delete mail or edit forwarding rules on their own, because those actions either move money or hide what happened.
Should an inbox agent be allowed to send emails or make payments?
In the agents we set up, a fixed acknowledgement on the same thread completes on its own. A send to a new address, a forward or an attached file waits for a person who sees the original email, and payments and bank-detail changes never run on an email's word: a person confirms them through a phone number already on file.
Is a read-only AI assistant safe from prompt injection?
Safer, not safe. A read-only assistant can't send or pay, but a line a stranger writes into an email that the assistant follows as an order can still give it a misleading summary, and it reaches everything the connected account can see.
Who should own an AI agent's security?
One named business owner of the process the agent runs, with IT setting the permissions. That person can pause the agent, cut its access and approve any change to what it reaches, including a new AI model or a new connection to another system. They also read its log each week, starting with sends to addresses the company has never written to.
What is prompt injection in an email agent?
A line a stranger writes into an email that the agent follows as an order, such as telling it to send out a client file or redirect a payment. No filter catches all of them, so what the agent is allowed to do decides what the line can cost.
What does business email compromise cost companies?
$3,046,598,558 in losses reported to the FBI in 2025 across 24,768 complaints, about $123,000 a complaint. That is the price when a person gets talked into paying the wrong account.
Can inbox agents update a law firm's matter records?
Status and date updates can run from checked details in the matter system. Looking up the matter is read-only work for the agents. These jobs let the inbox owner keep decisions while the agents handle incoming mail unattended.
How do you split an email agent's job to block injection?
In two steps. The first reads the email and fills in a fixed form: who sent it, the kind of request from a short list, the reference number, the dates and amounts. The second works from the form alone and never sees the email.
Why must every box in the form be a fixed choice?
Because one free-text box passed along would carry the email's words into the step that acts. Each box must be a choice from a list, a reference that exists in your records and belongs to that sender, or a number checked against them.
Should an AI agent's limits live in its instructions?
No. The power to act is a setting, not a sentence. The agents get their own mailbox, send permission limited to it, and a mail rule that stops them writing to any outside address beyond a fixed acknowledgement on the same thread.
Where will inbox agents process a law firm's data?
Your data is processed where the written agreement says. That agreement also sets what the agents may read and do. The written scope covers both access to the firm's information and the actions the agents take.
What training and reporting come with Qvery's inbox agents?
Qvery trains the people who finish what the inbox agents prepare and connects the agents to your matter system. Every week, you see the hours they took off the team and the errors they caught.
How much time does a law firm's shared inbox take?
On this post's assumptions, 150 emails a day at four minutes each is 10 hours a day of reading, looking up and drafting. If 15 end in an outward action checked in 30 seconds, a person spends under 8 minutes a day on those.
How much can AI agents save on a law firm's inbox?
Two paralegals on the inbox cost $125,496 a year in the example. With agents taking about 90% of it, the cost falls to $19,750, with $12,550 of staff time left for exceptions and $7,200 a year to run them.
What pay assumptions underpin the law firm inbox example?
The example uses mean paralegal and legal assistant earnings of $69,700 in May 2025, reported by the Bureau of Labor Statistics. With benefits at 30% of private employer costs, it uses about $99,600 yearly. Two people spend about 63% of their week on the inbox.
How do you start with secure inbox agents?
Bring a week of the shared inbox's mail. Real mail runs through the agents within two weeks once access is in place, and a person releases anything that leaves the firm beyond a fixed acknowledgement.
