Complete procedures with a way back.

Build a single-mailbox production reference that incrementally reads Gmail, classifies untrusted messages, treats attachments as quarantined metadata, prepares bounded reply proposals, and creates—but never sends—a Gmail draft only after an identified reviewer approves the exact proposal.

Inventory every sender, publish a bounded SPF policy, deploy rotating DKIM selectors, begin DMARC reporting, analyze alignment, and progress enforcement safely.