Chapter 07b Mail Transport & Defense Admin: #pSpam

AI in Sieve rules: "Is this mail an invoice?" as a filter condition

Inbox rules and the system Sieve can ask a language model and then move, flag or forward depending on the answer. Two forms: a free yes/no question, or a choice between categories. It uses the same provider as the AI spam classifier (tier 1): a local Ollama is recommended; OpenAI-compatible servers, Anthropic or Gemini are optional. In the webmail the condition is called "If the AI detects …", with a test button, templates and a note on which data goes to which provider. ManageSieve and JMAP understand the extension too. Admin: SpamGuard > Extensions > AI in rules. Business feature.

Operational Tip & Architecture Note

Delivery never waits longer than the configured limit (default 8 seconds for all AI questions of one message together). On timeout, error, a reached limit or with the feature switched off the condition is simply false and the script continues: the mail ends up where it would have gone without the AI rule.

1. Sieve syntax: :question and :category

The extension must be requested with require. :confidence (0 to 100) sets the model's minimum certainty in percent; without it the admin default (60) applies. A question has at most 500 characters, a category list 2 to 20 entries; the expected category must be in the list. An unknown vnd.nextxch.* require makes the script fail at upload, as RFC 5228 demands.

Reference / Configuration

require ["vnd.nextxch.ai", "fileinto", "copy", "imap4flags"];

# Free yes/no question
if ai :question "Is this mail an invoice or a payment request?" :confidence 70 {
    fileinto "Accounting";
    stop;
}

# Choice between categories: true when the model picks "Application"
if ai :category ["Invoice", "Application", "Support", "Newsletter"] "Application" {
    redirect :copy "hr@company.com";
}

# Combined with ordinary tests (cheap tests first: the model is only asked when reached)
if allof (address :domain :is "from" "customer.com",
          ai :question "Is this an urgent request or complaint?" :confidence 75) {
    addflag "\\Flagged";
}

2. Webmail: templates and test button

Settings > Inbox rules: choose the condition "If the AI detects …", then "Free question" or "Pick a category". The "Test" button sends the condition with a selected message to the model and shows the answer, confidence and the excerpt that was sent.

Reference / Configuration

Template                              Condition                                              Action
Invoices to the Accounting folder     Question "Is this mail an invoice ...?" (70 %)         Move to "Accounting"
Forward job applications to HR        Category "Application" of 5 categories (70 %)         Copy to hr@<your domain>
Flag urgent customer mails            Question "Urgent request or complaint?" (75 %)         Flag as important

3. What the model sees (example with masking)

The excerpt sits between markers and is handed to the model explicitly as untrusted data: instructions inside the mail are ignored. The answer must be a JSON object; answers that cannot be parsed count as "no answer".

Reference / Configuration

Question: Is this mail an invoice?

<<<EMAIL
From: Supplier Billing <[email@supplier.com]>
Subject: Invoice 2026-1042
Attachments: Invoice-2026-1042.pdf
Body:
Dear Sir or Madam, please find attached our invoice for EUR 1,200.
Please transfer to [number] by 17 Nov 2026.
EMAIL>>>

Model answer: {"answer":"yes","confidence":0.94}
Rule log:     ai :question "Is this mail an invoice?" -> true (ja, 94 %, openai/llama3.2:3b)

4. Set up Ollama locally

A small model is enough for yes/no and category questions. Then enter the endpoint as tier 1 in the admin under SpamGuard > Extensions and switch on "AI in rules"; the live test checks the connection with a sample mail.

Reference / Configuration

# Linux
curl -fsSL https://ollama.com/install.sh | sh
ollama pull llama3.2:3b
curl http://127.0.0.1:11434/v1/models

# Windows (PowerShell)
winget install Ollama.Ollama
ollama pull llama3.2:3b

# Admin > SpamGuard > Extensions > AI classifier, tier 1:
#   Provider: OpenAI-compatible · Endpoint: http://127.0.0.1:11434/v1 · Model: llama3.2:3b
# Admin > SpamGuard > Extensions > AI in rules: enable, save, live test

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`Welche Daten gesendet werden`	Per question only: subject, sender, the first N characters of the text (default 2,000) and the attachment names. Never attachment content, never other headers, never recipient lists.	`Maskierung an · Anhangsnamen an`	Keep masking on: e-mail addresses become [email@domain], IBANs and phone numbers [number], links are cut down to their domain, and the sender shows only name and domain. This is the same data protection logic as in the AI spam classifier.
`Lokal oder Cloud`	Rules use the tier 1 provider of the AI classifier. Local endpoints (localhost, private networks) need no permission. Cloud providers only with two ticks: the GDPR consent of the classifier and "Allow cloud providers for rules".	`Ollama http://127.0.0.1:11434/v1 · llama3.2:3b`	Run locally with Ollama so no mail content leaves your network. For cloud you need a legal basis, a data processing agreement and a note in your privacy policy; the webmail editor shows users whether their rule is evaluated locally or in the cloud.
`Zeitlimit und Ausfall`	All AI questions of one message share one time budget. When it is used up or the model does not answer, the test is false and the next rule runs.	`8.000 ms je Nachricht · max. 10 Fragen`	Put cheap tests (sender, subject) before the AI question: the model is only asked when evaluation reaches it.
`Cache: jede Nachricht nur einmal`	Answers are cached per message and question. The pre-check in the SMTP dialogue, the delivery and further recipients with the same question reuse the same answer.	`60 Minuten`	A circular to 200 colleagues with the same rule costs a single model request.
`Freigaben, Limits und Kosten`	The admin decides for which domains and tenants the feature applies, whether the system Sieve may use it and how many questions per tenant and day are allowed (single tenants may differ, 0 = blocked). The daily limits of the classifier (requests, tokens, cost) apply on top for the whole installation.	`500 Fragen je Mandant und Tag`	The admin table shows questions and cost per tenant for today: the basis for charging cloud costs back. Counters survive restarts and are summed across the cluster.
`Nachvollziehbarkeit`	Every AI decision is written to the rule log (event SieveAi) with question, answer, confidence, provider, cache hit or the reason for no answer, e.g. ai :question "Invoice?" -> true (yes, 92 %, openai/llama3.2:3b).	`immer an`	The test button in the webmail and the live test in the admin additionally show the exact excerpt that went to the model.
`Lizenz und Upload`	Business feature (also in Enterprise and the trial). Without permission the webmail, ManageSieve (PUTSCRIPT/CHECKSCRIPT) and JMAP (SieveScript/set, /validate) reject scripts with the ai test; ManageSieve lists vnd.nextxch.ai in SIEVE only when the feature is on.	`aus`	Scripts saved earlier keep running when the feature is switched off later: the ai test is then simply false.