Handling Email AI-Processing Preferences

IntroductionA sender may choose to communicate without choosing to have an AI agent analyze, remember, profile, or train on that correspondence. This profile turns a preference signal into a defined admission policy for participating receiving systems.The profile separates accepting an email from admitting its content to optional AI processing. It leaves ordinary delivery, human reading, and conventional storage available. It does not claim to impose duties on all Internet recipients, prevent a malicious recipient from copying content, or settle legal authority.This document is separate from the signaling specification because receiver controls are an additional commitment. It does not claim that these controls fall within the current AIPREF working group charter.Syntax, category meanings, and message scope are defined by . This profile uses those definitions without adding new field directives.

Conventions and ConformanceThe key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.Requirements apply only to implementations claiming conformance to this receiver handling profile.A conforming receiver MUST implement the companion signal parser and all requirements of this profile across every optional AI path to covered content. Conformance cannot be limited to a visible assistant while an ungoverned background connector accesses the same content.The five categories are assist, memory, profile, train, and external. They are cumulative: summarization by an external provider followed by persistent embedding storage requires separate checks for assist, external, and memory. Authorizing one category MUST NOT authorize another by implication.The requirement-level conventions are collected in .

Processing Boundary and Protective Default The following requirements apply only to receivers claiming conformance to this handling profile. They do not impose requirements on all Internet mail recipients or guarantee enforcement against a non-participating recipient. A handling-profile receiver MUST evaluate preferences before exposing covered content to an AI model, AI agent, embedding service, or governed external processor. Header parsing and permission lookup MUST occur outside that governed processing path. The system may accept and store the message in an ordinary mail environment while making it unavailable to the optional AI path. For each requested operation, the receiver MUST identify every applicable category and evaluate each source preference. An explicit no blocks that operation under this profile. ask requires separate, purpose-specific confirmation from the relevant declaring party through an appropriately verified channel. yes satisfies only the expressed-preference check; legal authority, purpose, minimization, and confidentiality checks remain separate. A sender's yes MUST NOT be treated as consent on behalf of another person mentioned in the content. A missing field or omitted key means no preference was expressed. Under this profile, the optional operation MUST remain on hold unless a separate, documented instruction or agreement from the relevant declaring party covers that category and content scope. The recipient's decision to enable an agent, the recipient's acceptance of provider terms, and mere receipt of correspondence MUST NOT be treated as the sender's authorization. An indeterminate statement, including malformed syntax, unsupported versions, duplicate fields or keys, or unknown directives, MUST place optional AI processing on hold until the ambiguity is resolved with an adequately verified instruction covering the proposed operation. Receivers MUST NOT silently select the first or last duplicate. Ordinary delivery remains available. These conservative extension rules require evaluation during the experiment. A receiver MUST NOT reject a message solely because the sender declines optional AI processing. Where communication can be provided independently of that optional processing, it MUST provide a usable route outside the optional AI path. A service whose essential requested function is AI processing can explain that limitation without treating refusal as agreement. Confirmation MUST identify the requested purposes and any external processors with sufficient specificity to make the choice understandable. Confirmation MUST occur before processing, not after uploading the content to obtain an AI-generated consent request. This draft specifies no automatic challenge-response protocol.

Accept the message into the ordinary mail environment.
Parse the signal and identify source associations outside the optional AI path.
Identify every category implicated by the proposed operation.
Evaluate preferences, any separately recorded authorization, and independent applicable obligations.
Admit the operation only if every required check passes; otherwise retain the ordinary communication route.

A confirmation process MUST NOT invite an AI system to inspect content already held pending confirmation. Receivers SHOULD use static notices and limit notice data to what is necessary. Permission records SHOULD identify the content scope, categories, confirmation method, and applicable version without storing the correspondence itself unnecessarily. A separate confirmation MUST be category-specific and content-scoped; it MUST NOT create a blanket authorization for other purposes or future correspondence. This profile does not define a technical consent-receipt format or assert that its confirmation method satisfies any jurisdiction's legal requirements.

Mixed-Source Content and Conflicting PreferencesThe receiver MUST inspect top-level statements in encapsulated message/rfc822 messages before admitting that content to an optional operation. It MUST retain separately identifiable source statements and evaluate every applicable source for an operation that combines messages or attachments.Any applicable no blocks the operation. Any applicable ask keeps the operation on hold until the necessary confirmation exists. Any missing category requires a separate applicable instruction or agreement under the protective default. All applicable yes values satisfy only the preference check. This rule deliberately avoids treating an unspecified source as yes; it does not determine ownership or legal priority.If trustworthy source separation is unavailable, the receiver MUST apply known restrictions to the entire combined operation. Plain-text quotations may have unrecoverable origin. The receiver MUST NOT invent permission from quoted authors or represent an outer sender's choice as theirs. Questions of independent authority over information about other people require separate assessment.

Derived Records and Subsequent UseA receiver creating permitted derived records MUST preserve applicable source restrictions in its internal records and enforce them on later governed operations. A vendor must not receive unrestricted data solely because it is a summary or embedding. When a permitted output incorporates several sources, later operations require assessment of all associated source restrictions. Keeping an immediate summary solely as an ordinary human-readable communication record does not automatically authorize subsequent AI use. Creating or retaining it for future agent retrieval implicates memory. Any later training, profiling, or external processing requires its own category check against the preserved source preferences.This profile defines no on-wire withdrawal or update mechanism. A new message MUST NOT automatically broaden earlier preferences. A separately verified subsequent instruction can change the recorded handling choice for a specified source, category, and content scope, but the receiver MUST retain enough evidence to distinguish that instruction from the original signal. Deletion and withdrawal obligations under law or agreements remain independent.

Necessary Mail-Service ProtectionA narrow exception permits processing necessary to deliver and protect the mail service, including spam, malware, phishing, and abuse detection. The exception applies to proportionate protection tasks and their necessary security records; it does not cover general assistant functions, commercial profiling, or reuse to train general-purpose models. The necessity, retention, and permissible security-specific model development remain subject to applicable law and require further review during this experiment. The receiver MUST keep security processing separate from optional assistance, memory, commercial profiling, and general-purpose training. It MUST NOT classify an optional feature as necessary solely because the vendor bundled it into a mail product. This experiment does not provide a blanket permission to develop security models using correspondence; applicable authority and scope must be assessed separately.

Security Considerations An attacker can add, alter, remove, or duplicate an unsigned field. An absent field therefore cannot safely be interpreted as permission. Authentication of a message does not establish valid consent, sender authority over all content, or recipient compliance. A participating sending domain SHOULD include this field in DKIM signature coverage and protect against insertion of additional occurrences as described by . Receivers MUST distinguish verified coverage from mere presence of a signature. DKIM identifies a signing domain; it does not prove an individual's identity or ownership of the information. Forwarders and mailing lists may alter headers or invalidate signatures. A receiver MUST NOT turn failed authentication into a favorable preference. Preservation of restrictions can be conservative without asserting that an unverified statement grants rights. Preference handling MUST use a deterministic parser rather than model interpretation. Prompt instructions in message content MUST NOT override a field or a held-processing decision. Parsers SHOULD impose resource limits consistent with mail-service protection and MUST NOT truncate a field into an apparently permissive value. The field does not instruct systems to bypass spam, malware, or abuse defenses. Attackers may use no or ask values to create operational load. Systems SHOULD use the ordinary communication route without sending automated notices for every held message. Any automated replies must follow safeguards against loops and unsolicited responses. The mechanism neither prevents exfiltration by a malicious recipient nor supplies end-to-end access control. Claims of compliance require separate evidence; this draft defines no remote attestation or audit protocol. The profile MUST NOT grant optional AI access merely to resolve an ambiguous preference or generate a confirmation request. External services used to verify identity or send notices also require data minimization and appropriate independent authority; confirmation must not disclose the held correspondence unnecessarily.

Privacy Considerations The field itself reveals preferences that might be sensitive. Implementations MUST NOT use a person's refusal as input to profiling, marketing segmentation, or adverse ranking. Necessary preference handling is distinct from learning characteristics about the sender. A preference is not a consent receipt. A yes value does not discharge privacy, copyright, confidentiality, employment, professional, or other obligations. The sender cannot consent for every person mentioned in a message. Applicable law may require further notice or express agreement even where a favorable preference is present. Admission controls must also cover background indexing, connected mailbox APIs, backups exposed to agents, connector caches, and derived records. A visible assistant that honors the field cannot establish compliance if another pipeline processes the same content first. Implementations SHOULD minimize preference logs and restrict access to them. Ordinary retention and deletion duties are unaffected. This experiment makes no claim that embeddings are anonymous or that deleting an email deletes its derived records. Refusal of optional AI processing MUST NOT itself justify poorer service or adverse treatment unrelated to the declined operation. Where the requested service can proceed without that processing, the receiver MUST NOT make agreement to it a condition of ordinary communication.

IANA ConsiderationsThis document requests no IANA action. The proposed header field registration belongs to the companion signaling specification. This profile adds no field names, values, or registry entries.

Experiment and Open IssuesAn experiment should use synthetic messages and independently instrument the boundary before model, embedding, or external-provider access. Cases include explicit refusal, ask without confirmation, absent fields, partial preferences, conflicting incorporated content, duplicate fields, unknown directives, failed authentication, and later use of derived records.Tests should demonstrate that declined or unresolved operations make no content-bearing request to the optional AI service while ordinary delivery and usable communication continue. Tests should also verify that permission for assistance does not permit memory, profiling, training, or external processing.Useful measurements include mistaken admission rates, category interpretation agreement, preservation of restrictions in derived records, and usability of the ordinary communication route. The handling profile needs technical and operational review; successful file rendering does not demonstrate implementation conformance.Open issues include confirmation evidence, scope changes and withdrawal, mixed-source provenance, retention of security records, necessary security-specific model development, accessibility boundaries, and evaluation of the protective default. Legal requirements remain jurisdiction-specific and outside the protocol's authority.