We let an AI agent send without approval — here is exactly what stops it

Everywhere else in our platform, an AI agent drafts and a human approves before anything sends, executes, or closes. In the sales module we made an exception: once an operator turns it on, the autonomous SDR researches a lead, drafts outreach, and sends it, with no per-message approval.

That deserves an explanation rather than a feature bullet, because "we made an exception to our safety rule" is exactly the sentence a buyer should push on.

Why outreach and not, say, scripts

The properties that make an action safe to automate are boring and specific: is it reversible, is the blast radius bounded, and can the bound be enforced mechanically rather than by judgement?

A remote script fails all three. It changes endpoint state, its blast radius is the machine, and whether a given script is safe is a judgement call about its contents. An outbound email fails none of them cleanly — it is embarrassing rather than destructive, it reaches exactly the addresses on a list you control, and the bound is a countable number of messages per day.

Supervised autonomy should start where the worst outcome is an apology, not an outage.

What actually stops it

Four controls, and the important thing about all of them is where they are checked. Not in the browser, not in the interface, not in the agent's own reasoning — at the server, on every send, before anything leaves.

• An owner kill switch. Off means no send happens, regardless of what any client, script, or compromised session asks for.
• Contact opt-out, honored at both enrollment and send time — so someone who opts out mid-sequence stops receiving mail rather than finishing the run they were already in.
• A suppression list checked independently of sequence logic, so an address that must never be contacted is not relying on any individual campaign getting it right.
• A per-tenant daily rate limit, which is the control that turns a runaway loop from a catastrophe into a bad afternoon.

Plus the part that matters after the fact: every autonomous send is written to an immutable audit trail. When somebody asks what the AI sent to their prospect, there is a record — not a reconstruction from logs, and not a shrug.

Why the interface does not count

A toggle in a settings page stops a well-behaved client. It does nothing against a compromised session, a scripted API call, or a bug that skips the screen the toggle lives on. If the only thing between an autonomous agent and your customers' inboxes is a rendered control, the guardrail is a picture of a guardrail.

So the useful question to ask any vendor selling autonomous outreach is not whether there are limits. It is where the limit is checked, and what happens to it when the request does not come from their interface.