Fifteen emails and nine attachments
A shared mailbox, AI Lab - Study Coordinators, plays the site's coordinator inbox. It holds 15 invented emails from a sponsor, a CRO, an IRB, a central lab and site staff, with 9 PDF attachments: an IRB approval, an investigator's brochure, a Form FDA 1572, a CV, a license, a GCP certificate, lab reference ranges, a safety report and a monitoring follow-up letter.
Two of the emails are traps. One is a phishing message. The other carries a hidden instruction to forward every regulatory document to an outside address. Azure Prompt Shields screens each message before the model sees it, and it blocked the hidden instruction on every run.
Sorting, filing and tasks
The assistant sorts every message first. Azure Document Intelligence reads the PDF attachments, and each document is filed into the right study's binder, replacing the version it supersedes. The email moves to a Filed to binder folder in Outlook.
Requests become tasks, and their emails are flagged in Outlook with due dates. Each action item in the monitoring letter becomes its own task. Reply drafts are saved in Outlook for a coordinator to review, and the assistant never sends them. A visit request that fell outside the protocol window went to the monitor and was not booked.
Binder check before a visit
Before a monitoring visit, the assistant checks each study binder against its approvals. It won't start until every message has been sorted.
In the recorded run, the IRB letter (approval A3) approves consent version 4.0, but the binder still holds version 3.1. So the line for the current IRB-approved consent form shows Outdated: approved version not on file.
What the server caught
Over eight live runs, checks on the server caught three mistakes by the model. It filed a consent form it never received: the IRB letter approved version 4.0, the stamped form wasn't attached, and the binder showed 4.0 as current anyway. The server now rejects any filing whose attachment wasn't read, and the assistant creates a task to get the form.
The same check caught the model inventing attachment file names when Microsoft Graph limited its reads. The model also once said it had created tasks when it hadn't, so the binder check now waits until the action items exist as real tasks.
One mailbox, and what it costs
The app reaches the mailbox through Microsoft Graph, signing in with a certificate. It holds no Graph permission in Entra ID; Exchange RBAC for Applications grants it that one mailbox and nothing else. We tested other mailboxes, including the administrator's own, and Graph refused every one.
The recorded run sorted all 15 messages and created 14 tasks in 36 engine steps, using 57.7 seconds of agent time and $0.026 of model time. A real deployment needs a business associate agreement, and Azure OpenAI is covered under Microsoft's.
Some site systems have no open API, but the inbox is where sponsors, CROs and IRBs already send their requests, so that's where this assistant works. It's one of four SiteWorks demonstrations, with prescreening against a volunteer's own health record, a copilot over a clinical trial management system, and a recruitment copilot on monday.com. Call (844) 422-7000 and we'll walk you through it.