Give it read access to “accounts@..” then have it only deal with attachments that are invoices and receipts .. then potentially also push an entry into akaunting or xero or whatever you use for the bean counters

that's the spirit. you can set up something like a shared drive between you and your agent, yes