AI Email Assistants at the Dealership: What They Can Read, Send and Leak

An AI email assistant at a dealership reads whatever mailbox it’s plugged into, can send as whoever plugged it in, and may pass customer data to an outside model. Management should decide all three, not the salesperson.

I use Claude all day long, and I’ve got it hooked into Excel, Word, PowerPoint, my mailbox, and my calendar. When I told a DealersEdge webinar audience this month that “it is literally the greatest thing since sliced bread,” I wasn’t being cute. It changed how I work.

Then I gave them the catch, the part I always end up saying even though nobody wants to hear it: “However, what folks don’t think about is when I hook the AI in, it’s hooked into my mailbox. Depending on what permission you have, you could hook the AI into the corporate system, right?” My mailbox has my stuff in it. An admin who does the same thing can reach everybody’s stuff, and that’s a real problem.

We support dealerships that employ about 35,000 people, and a lot of the AI requests we hear now are some version of “can I hook this up to my email?” Usually, yes. But who decides, and what it’s allowed to touch once it’s in there, is a management call, and it shouldn’t default to whoever found the tool first. Picking, connecting, and watching those tools is what managed AI for dealerships means to us, done by the same team that already runs your security.

The assistant only gets the keys you hand it.

What an AI Email Assistant Can Read

An AI email assistant is software that plugs into a dealership’s Microsoft 365 or Google mailboxes to read, sort, summarize, draft, or answer email. For dealership management, the question isn’t which one writes the nicest reply. It’s which mailboxes it can open, and that depends entirely on the permission somebody granted when they connected it.

My own assistant runs on what’s called delegated permission, which is a fancy way of saying it borrows my sign-in and sees my mail, my calendar, and the folders people have shared with me, and nothing I couldn’t open myself. That’s the safer kind. The other kind is application permission, where the software runs with nobody signed in at all, and Microsoft’s description of the Mail.ReadWrite application role is about as blunt as Microsoft gets: it “allows the app to create, read, update, and delete email in all mailboxes without a signed-in user.” Every mailbox. Payroll’s too.

Who approves it? In a default Microsoft 365 setup, the employee does. Microsoft’s own documentation says “by default, a user can consent to allow an app to access their mailbox,” which means a salesperson can click Allow on a browser extension between ups and IT finds out months later, if ever. I’d bet most dealer principals don’t know that setting exists.

And think about what a salesperson’s inbox holds: credit app follow-ups, the driver’s license a customer emailed when the portal wouldn’t load, payoff letters on trades. Now add admin rights, which we still find on everyday accounts at a lot of stores because somebody set them up that way years ago. I said it on the webinar: “it might be elevated admin, but AI gets, has reach into whatever data that at the level that it’s given access, and it’s going to use it, believe me.” Not my most grammatical moment. Still true. An admin who connects an assistant because it’s handy can hand it the whole company without meaning to.

The permission is what you’re really buying.

What It Can Send, and Who It Speaks For

The 11 p.m. internet lead is where email AI earns its keep. Picture a shopper asking about a used F-150 at 10:52 at night. The assistant answers in under a minute, warm and polite, with three appointment times. Dealers love that. They should. The Cox Automotive AI Readiness in Auto Retail Study (October 2025, 516 dealership leaders) found the top marketing use for AI was engaging customers 24/7 with automated text, chat, or email, at 52%, with personalized emails and texts right behind at 48%.

The same study found 74% of dealers worry about AI accuracy and errors. They’re right to.

An assistant that can send is speaking for your store. If it answers the F-150 lead with a payment figure the desk never approved, or “confirms” a trade value, or tells a customer the truck is still on the lot when it sold Saturday, that email went out under your dealership’s name. The customer doesn’t care that a model wrote it. Nobody will. Our breakdown of AI legal risks for dealerships covers the liability side of that in more detail.

There’s a security version of the same problem. Microsoft’s description of the Mail.Send application role is that it “allows the app to send mail as any user without a signed-in user.” Any user. If the app or the vendor behind it is ever compromised, somebody else can send email as your F&I manager asking a customer to “re-verify” bank details. Email fraud already works without AI. An app that can send as anyone makes it easier.

So the rule I’d set is simple. Drafts are fine. Auto-send to customers is a decision with a named owner, a narrow scope, and someone reading a sample of what went out every week. The same thinking applies to voice, and it’s why we wrote a separate security and consent checklist for AI phone agents.

If it can send as you, it’s you.

Where Customer Data Leaks

The simplest leak doesn’t involve any connected app at all. Somebody copies an email into a chatbot. On the webinar I put it this way: “Even if it’s as simple as they’re writing email to a customer and having a customer wanting AI to check it, well, now they’ve got PII that they’re uploading into AI.” That’s a salesperson trying to sound more professional. Good instinct. Bad place. They pasted a customer’s name, address, and loan details into a personal account the store doesn’t own, can’t audit, and can’t switch off.

We’ve already seen this exact problem more than once. Personal AI accounts on dealership workstations, no audit trail, customer data going in. A personal chatbot account belongs to the employee, so when that salesperson leaves for the store across the street, the conversation history goes with them. Who owns that? Not you.

The connected assistants leak differently. A mailbox app typically sends the email it reads to the vendor’s servers, and often to a model provider behind the vendor. Whether that data trains a model, how long it’s kept, and who at the vendor can see it all come down to the plan and the contract. The FTC has said it will hold AI companies to those promises. Its January 2024 guidance, “AI Companies: Uphold Your Privacy and Confidentiality Commitments,” ends with a line every dealer should keep handy: “There is no AI exemption from the laws on the books.”

It cuts both ways, though. A dealership that arranges financing is a financial institution under the FTC Safeguards Rule, and the rule expects you to control who and what can reach customer information and to oversee the service providers that touch it, under 16 CFR 314.4. An email assistant vendor reading your sales inboxes is a service provider. It belongs on your vendor list with the DMS and the CRM, with the same questions asked. For the longer version of how public AI and customer data collide, see public AI and customer PII.

Everybody says their AI is secure. What does that actually mean? It means a written answer to four questions: what it stores, where, for how long, and whether it trains on it. No written answer, no mailbox.

The leak is usually a convenience somebody didn’t think through.

What Dealers Say When We Bring This Up

To be clear, I’m not telling you to keep AI out of the inbox. I use it there myself, every day. The question isn’t whether to use it. It’s whether anybody decided what it’s allowed to touch.

“Our people are already using AI tools.” That’s almost always true, and it’s almost always ungoverned: personal accounts, no audit trail, customer data moving outside your security controls. The fix is a governed workspace your store owns, run by the same team that runs everything else.

“It’s just email.” It isn’t. Email is where customers send the things they shouldn’t. Driver’s licenses, pay stubs, insurance cards. It’s the least organized customer file in the building.

“The vendor says it’s secure.” Great. Then ask them to put what they store, where, and for how long in the contract. If they won’t put it in writing, you have your answer.

The objection is usually the policy you haven’t written yet.

The Settings We’d Check First

None of this needs a new product. It needs somebody to look. Here’s the order we’d work it at a dealership that already has AI touching email, which, these days, is almost every dealership.

• Find out what’s already connected. In Microsoft 365, the enterprise applications list shows every app someone approved, and what it can do. Changing the consent setting later doesn’t undo old approvals, so this list is where the surprises are.
• Stop letting users approve any app on their own. Microsoft recommends allowing user consent only for apps from verified publishers. We’d go one step further for mailboxes and route new requests through an admin approval workflow, so a request lands with a person.
• Scope the big ones. If a lead-response or archiving vendor truly needs app-level mail access, Exchange Online’s RBAC for Applications can limit it to the mailboxes it needs, say the internet sales inbox, instead of every mailbox in the group.
• Take admin rights off everyday accounts. That one fix shrinks what any assistant can reach, AI or not.
• Corporate accounts only.
• For anything that sends to customers: drafts by default, auto-send only on a short list of message types, and one manager who reads a sample every week. Someone has to own the output.
• Put the vendor on the vendor list. Get the data-handling answers in writing, the same way you would for any company holding customer information.

The policy side is already written. Our dealership AI use policy template covers personal accounts, customer data, and approvals, and you can adapt it this week. The Microsoft side is part of Microsoft 365 management and security for dealerships, and if Copilot is next on your list, read what to lock down before you turn Copilot on first.

Look first. Connect second.

Questions Managers Ask About AI in the Inbox

Hand It the Keys on Purpose

I’ll go back to my own setup, because it’s the fair test. My assistant can read my mail because I decided it should, on a corporate account, with my permissions and nobody else’s. That’s the whole difference between a tool and a leak. Somebody chose.

A lot of dealerships haven’t made that choice yet. The tools got there first. That’s fixable. If you want to know what’s already connected to your mailboxes, who can approve the next one, and which accounts are carrying admin rights they don’t need, start with our complimentary IT and cybersecurity assessment. If AI is the bigger question, the AI readiness assessment for dealerships looks at the tools your people already use and the customer data they can reach. You can also watch the webinar clip where I walk through the mailbox example, or the full session in our guide to AI governance for dealerships.

Decide what the assistant can touch before it decides for you.