Human-in-the-loop email: approving what an AI agent sends

Human-in-the-loop email means a person approves an AI agent’s email before it goes out. Approving every email soon turns into clicking “approve” without reading, so the version that holds up asks for a person where a mistake costs the most: the first email to someone new. Replies to people the agent already writes with go out on their own, within a daily limit, and the person approving sees exactly the email that will be sent.

Why have a person approve an agent’s email?

Because email can’t be taken back. Three things make a person’s review worth the wait:

• Mistakes. Models misread threads, get details wrong and answer the wrong person. A reply with the wrong price is out the moment it’s sent.
• Manipulation. Anyone can email an agent, so anyone can try to give it instructions, and sending is how a tricked agent leaks what it knows (prompt injection by email). Meta’s “Agents Rule of Two” uses exactly this case: an email assistant that reads mail from strangers and can see your data should send only to trusted recipients, or after a person has checked the draft.
• Reputation. Spam complaints count against the domain the mail came from, usually the one your whole team sends from (should an agent send from your own domain?).

OWASP’s Top 10 for LLM applications calls the general problem “excessive agency” and lists requiring a person’s approval for high-impact actions among the fixes. Its worked example is an email assistant, and its fixes include having a person review and send each email the assistant drafts, and limiting how fast it can send.

What are the ways to keep a person in the loop?

A sensible path: have every email wait at first, then only the first email to each new recipient once you trust the agent’s replies. Drop approvals only for an agent that writes to a short, fixed list of people.

Which emails should need approval?

Decide by who an email goes to, not by what it says. “Ask me before anything important” leaves the model to judge what’s important, which is the judgment you don’t trust yet. A rule about recipients can be checked by code, every time:

• The first email to anyone new. This is where a wrong address, an unwanted cold email or a leak does the most damage. Once a person has approved an email to someone, the agent can write to them again.
• Replies to senders who didn’t prove who they are. Anyone can put any name and address in the From line, and a reply goes wherever the email says to reply, so answering a forged sender without review is how an agent ends up writing to an attacker.
• Anyone outside the people you allow. Your own domain, a client’s domain or a few addresses can be allowed outright.
• Anything over a daily limit. A cap turns a runaway loop into a few dozen emails waiting for a person, not thousands sent.

What should the person approving see?

Exactly what will be sent, because the decision is only as good as what’s on the screen:

• The email as it will arrive: the HTML rendered safely, plus the plain-text part, which some mail apps show instead and which an agent could fill with something else.
• Every recipient, and why the email is waiting: “new recipient maya@northwind.com” tells the person what to check. Bcc recipients should be counted even if they aren’t named.
• Anything added on the way out, such as the line saying an AI sent it (do AI-written emails need to say so?).

Approving should send that email as written, not a version the agent rewrites afterwards. Rejecting should come with a note the agent can read, so it can try again or tell whoever asked for the email.

How do you keep approvals from becoming a rubber stamp?

• Approve people, not every message. After one approved email to someone, replies to them go through.
• Group the alerts. One reminder that several emails are waiting beats one interruption per email.
• Let stale requests expire. An email approved a week late can do more harm than one never sent.
• Make the reason specific. “New recipient” or “daily limit reached” is something a person can check in seconds.

How do you stop the agent going around it?

An approval step the agent can skip is a suggestion. Three things make it a rule:

1. Apply the rules where the mail is sent, not in the prompt. Instructions to an AI are advice it can be talked out of. A mail server that holds the email can’t be talked out of anything.
2. Give the agent a key that can ask but not decide. Its own key shouldn’t be able to approve an email or loosen the rules for its inbox. Those belong to the people responsible for it.
3. Leave no back door. A mail-app password (SMTP) lets anything holding it send whatever it likes, so an agent shouldn’t have one.

AgentMail’s own guide makes the same point about its drafts: “A draft is only an approval step if the agent cannot send on its own.”

How does approval work on SuperMailOS?

Every agent inbox has a send mode, set per inbox by the people responsible for it:

• New people ask first (the default). Replies to senders who passed sender checks, and email to people it has written to before, go now. Email to anyone new waits.
• Everything asks first. Every email waits for a person.
• Open. Up to 20 new people a day, then the rest wait.

On top of the mode, each agent has a daily limit (100 emails by default) and can have a list of addresses it may always write to. An email that has to wait isn’t refused: the API answers that it’s pending approval, the person who answers for the agent gets an email, and the approval shows the email exactly as it would go out, ending with the AI line (“Sent by Billing assistant, an AI agent working for Ana Ruiz at Acme.”). Approvals expire after 7 days. The agent’s own key can’t approve, and agent inboxes have no mail-app password. Details are in the agent inboxes guide.

Sources

• Meta AI, Agents Rule of Two: a practical approach to AI agent security (31 October 2025).
• OWASP GenAI Security Project, LLM06:2025 Excessive Agency and LLM01:2025 Prompt Injection.
• AgentMail, Human-in-the-loop (its own docs).

Questions