Illustration: a notification holds an ID, a mail_message subject, the reason mail_received, a position and its read state, with no message content. The agent then reads the message through Mail, which checks its permissions.
Pointers, not content
Each notification carries an identifier and a fixed reason, never message content. Your agent reads the Mail or conversation itself, under its current permissions.