Retention Policies: How Long Should an Agent Keep Mail?

Picture a typical story: an engineer spins up an OTP-extraction mailbox for the CI pipeline in the spring. It works, everyone forgets about it, and months later a security review finds the thing — an unattended inbox quietly accumulating verification emails, password-reset links, and signup confirmations for every test account the company has ever created. Nobody decided to build a credentials archive. It just happened, one retained message at a time. That's the retention problem for agent mail...