Processing Rules

AWS Trust & Safety sends support ticket acknowledgements and status updates. Informational — the actual ticket lives in the AWS console. Route to transactional, mark read.

Google Calendar sends an "Updated invitation:" email every time an event changes, including trivial changes like attachment updates. You got 3 in a row for the same TBG touchbase yesterday. Mark read; category left alone so sender context is preserved (colleague vs client depending on organizer).

Google Drive share notifications — Docs, Sheets, Slides shared with you. Usually from a collaborator and usually requires you to look at the doc. Route to colleague, flag requires_action, keep unread.

Active job search is paused. Silence automated job-board alerts from Ohio SoS, Robert Half, Kroger Careers, and LinkedIn job alerts. Auto-archive and mark read at the Sieve level so they never hit the inbox. Personal job referrals from humans fall through to the LLM default path and get classified as real correspondence.

LinkedIn general notifications — profile views, connection prompts, engagement nudges. Route to social, mark read. Does NOT cover LinkedIn job alerts (different sender: jobalerts-noreply@linkedin.com).

Microsoft sends subscription renewal confirmations from microsoft-noreply@microsoft.com (distinct from replyto@email.microsoft.com, which is marketing). Catches Microsoft 365, Azure, GitHub, and similar auto-renewal receipts by matching sender + "renewed" in subject. Routes to financial.subscription so renewals land in the Financial tab for billing reconciliation; marks read since no action is required on an auto-charge. Narrow subject match avoids sweeping security alerts or account notices from the same sender.

Microsoft sends product marketing (Copilot promos, tech session invites, etc.) from replyto@email.microsoft.com. Distinct from microsoft-noreply@microsoft.com which sends legitimate transactional receipts (Office 365 renewals, etc.) — this rule will NOT touch those. Route to marketing, mark read.

Microsoft sends account/OneDrive/Teams verification codes from no-reply@notify.microsoft.com with "verification code" in the subject (e.g., "48216937 is your Microsoft OneDrive verification code"). Route to alerts.code so the code_extractor pulls the OTP into the alert panel with a 5-minute copy affordance, then destroys the email per the alerts.code lifecycle (delete_immediate, data_retention 1 day). Intentionally narrowed to "verification code" subjects — avoids broader "code" match that could sweep legitimate non-OTP security notifications from the same sender into immediate deletion. If Microsoft account login OTPs arrive with "security code" phrasing, add a sibling rule rather than widening this one.

Bill assigns tasks and mentions you on monday.com boards. Machine-generated but always actionable — route to alert, flag requires_action, keep unread.

Pinterest daily/recommendation emails. Pure promotional feed — route to marketing, mark read, lowest priority. Can tighten to auto_archive in a later pass if you confirm you never read these.

Slack sends digest emails for mentions and DMs in workspaces. You're already in Slack so these are usually redundant — categorize as alert and mark read. No archive yet; see how noisy this feels first.

Upwork sends interview invitations when a client has reached out specifically to you about a job. These are real opportunities — route to client, flag requires_action, keep unread.