💡 Privacy-safe AI path for gmail-ai-classifier (Vertex AI provider, PII redaction, free-tier guard)

[github-actions[bot]]

Summary

Give gmail-ai-classifier and drive-ai-ingester a privacy-safe way to call the AI model. Add a Vertex AI advanced-service provider next to the current AI Studio API-key path. Redact PII from email snippets before they are sent. Warn at startup when an unpaid AI Studio key is processing canonical domains such as 02_Finance_Legal or 04_Family_Health.

Market Signal

The Gemini API terms for unpaid services say that Google uses submitted content and responses to improve its products, that human reviewers may read API input and output, and tell users: 'Do not submit sensitive, confidential, or personal information to the Unpaid Services.' Paid and Vertex traffic is not used for product improvement. The Apps Script Vertex AI advanced service became generally available on 2026-01-12. Gmail's own AI Inbox (announced 2026-01-08) is limited to the US and to paid Google AI Pro/Ultra plans. A free, open-source, privacy-correct classifier is a real gap in the market, but only if the data handling is defensible.

User Signal

PR #649 shipped a household classifier that routes medical, school, tax and banking mail. Its README tells users to paste a 'Google AI Studio API key' and does not mention billing tier. docs/proposals/proposal-001 §2 lists 'Sensitive patterns (SSN-like strings, credit card numbers) should be redacted from the body snippet before it is sent' and marks it '(Not yet implemented.)'. code.gs sends up to 1,200 characters of the plain-text body (line ~2088).

Technical Opportunity

getAiClassifierConfig() in config.gs already builds the endpoint from GEMINI_MODEL / GEMINI_ENDPOINT. A new AI_PROVIDER=aistudio|vertex property plus a small callModel_(payload) seam can dispatch either to UrlFetchApp (current path) or to VertexAI.Endpoints.generateContent(payload, 'projects/{p}/locations/{r}/publishers/google/models/{m}'). Redaction is a pure function (redactSnippet_) that can be unit-tested in Jest, following the repo's extract-and-inject pattern. Since the 2026-09-14 Apps Script data-regions GA, the provider and the script can be pinned to the same region.

Assessment

Dimension	Score	Rationale
Feasibility	high	Grounded in existing seams described above
Impact	high	See Market and User Signal
Urgency	high	See Market Signal (dated platform changes)

Adversarial Review

Strongest objection: Vertex needs a GCP project with billing enabled, which adds friction for the 'no-code' audience, and redaction may lower classification accuracy.

Rebuttal: Vertex stays opt-in, and AI Studio remains the default with an explicit consent warning, so nobody is forced onto billing. Redaction only masks high-entropy identifiers (card numbers, SSNs, account numbers, one-time codes). The classifier routes on sender, subject and topic, not on those digits. The golden-set eval proposal can measure any accuracy change. Doing nothing leaves the flagship AI script steering users into a tier whose terms say not to send personal data.

Suggested Next Step

Add redactSnippet_() with Jest tests covering card, SSN, IBAN/account and OTP patterns, and call it before prompt assembly. Then add an AI_PROVIDER switch behind a callModel_() seam, and add a README 'Data handling' section that compares the AI Studio free, AI Studio paid and Vertex tiers.

---

Generated by the weekly feature-ideation agent (Mary, BMAD Analyst). Sources: Gemini API terms · Gemini deprecations · Apps Script release notes · Vertex AI advanced service · Gmail Gemini era · SaneBox review · Workspace Studio