I kept running into the same question in OpenClaw discussions: is it secure enough to touch company email?

Reasonable question. Wrong framing.

If your agent can read a sales inbox, send as a rep, and treat inbound email like instructions, the biggest risk is usually not whether OpenClaw is running in Docker.

It’s permissions.

It’s blast radius.

It’s whether the workflow is draft-only or allowed to send.

That sounds boring compared to container isolation and sandboxing. It is also the part that decides whether a prompt injection turns into an awkward draft or a 500-recipient incident in Microsoft 365.

I was looking through a couple of Reddit threads about OpenClaw email setups, and the pattern was obvious:

people asked about Docker, VMs, and host isolation

people worried about whether OpenClaw itself was hardened enough

the best comments were actually about service accounts, restricted scopes, and draft-only flows

That’s the real story.

The security question developers actually need to…