Skip to content

Learn

Letting an AI agent send email without losing control

An AI agent can read your inbox, write replies and send them. Here is what to give it, what to keep for a person, and how to stop it when it gets something wrong.

Read first, draft second, send last

The safe order is simple. An agent reads first, writes drafts second, and sends only when something a person controls says yes. Each part of this essay is one way to keep that order.

Security guides ask for the same. OWASP, a project that lists the main security risks of AI models, says to keep the model's access to the minimum it needs and to require a person's approval for high-risk actions. The Model Context Protocol, a standard many agents use to call tools, says a person should always be able to deny a tool call.

Start with reading

A key holds only the permissions you select when you make it in Settings. Start with read, called Read in the console. The agent sees contacts, campaigns, the inbox and what was sent, and changes nothing. Its first call takes one argument:

import { Colding } from "colding";

const colding = new Colding("cd_your_key");
const thread = await colding.threads.get({
  threadId: "11111111-1111-4111-8111-111111111111",
});
console.log(thread.subject);

That prints the subject of one thread. Let the agent only read for a while before it writes anything. You see what it understands, and nothing in your workspace changes.

Then let it write drafts

Add operate, called Operate, and the agent can also write drafts, edit campaigns and change contacts. A draft sends nothing. The agent writes one and asks for a preview:

const draft = await colding.drafts.create({
  mailboxId: "33333333-3333-4333-8333-333333333333",
  to: "[email protected]",
  subject: "Invoice question",
  bodyText: "Hi Ana, could you check invoice 1042?",
});
const preview = await colding.drafts.preview({
  draftId: draft.id,
});
console.log(preview.blockers);

The preview lists what would stop the email right now, such as an address the check couldn't confirm or a merge field nobody filled in. When the draft is ready, the agent can ask a person to look at it, with a note. That person gets an alert, and the draft shows in the Drafts tab of the Inbox.

Sending is the approval

Sending takes send, called Send outreach in the console. The call names the revision of the draft it sends:

const send = await colding.drafts.send({
  draftId: draft.id,
  revision: draft.revision,
});
console.log(send.id, send.status);

It sends the words at that revision and nothing else. If someone changed the draft after it was read, the call is refused and nothing goes out. So a person who reads a draft and presses Send approves exactly what they read.

A campaign works the same way. Launching it takes send and approves the campaign as it stood when the launch check read it. An edit that widens a running campaign, such as a new step or more leads, needs send again.

Keep send for people at first. A key without it can still write every draft and ask for a review, and a person sends what they approve from the console.

Some steps no key can take: connecting a mailbox, replacing its password, billing, managing the team and accepting the acceptable use policy. An agent that needs one sends a request, and a person signed in to the console finishes it.

Limits the agent can't change

On top of its permissions, an owner can limit a key in Settings:

  • Which mailboxes it may send from.
  • Which mailboxes and agent inboxes it may read. In any other it sees nothing, and contacts and campaigns are closed to it.
  • Which campaigns it may launch, add leads to and send through. A key with this list can't create a campaign.
  • Which kind of email it may send: outreach, your app's own email, or both.
  • How many emails it may send in a day, and in total. Emails from a campaign it launched count too.
  • The last day it works.

The key can't read or change its own limits, and limits only narrow what its permissions allow. Most cover what the key sends and changes, so a key without a list of mailboxes and agent inboxes to read can still read everything in the workspace. The plan's limits and each mailbox's daily cap apply on top.

Two more permissions stay off unless the agent needs them: Check addresses, which spends the month's address checks, and Send app email, for your app's own email, such as receipts and sign-in links.

Mail is data, never an instruction

An agent that reads your inbox reads words that strangers wrote. Some of them may be written to steer the agent, such as a line telling it to forward your contacts. OWASP calls this indirect prompt injection: a model takes in input from outside sources, such as websites or files.

OWASP also says it is unclear whether any method prevents it every time. So don't count on the agent to spot every trick. Count on the limits around it. In colding, words inside an email are never an approval. Every send still meets the key's permissions and limits, the suppression list and each mailbox's daily cap.

A retry can't send twice

Networks fail. When a call times out, the agent can't tell whether the email went out, so it tries again. Three separate guards keep the second try from sending a second email:

  • The SDK sends an Idempotency-Key with each write, the same on every automatic retry. For 24 hours, the same call gets the first answer back instead of running again.
  • Sending the same draft at the same revision answers with the same email, for good.
  • Before it delivers, our background sender claims the email once, so two workers can't both send it.

If the connection breaks while an email is going out, nobody can tell whether the server took it. colding counts it as sent and never sends it again. The sending guide explains each guard.

When the agent gets it wrong

Once an email has started going out, it can't be canceled. This is what you can do before and after:

  • See who sent what. The Send log tab in the Inbox says who sent each email: a person, or which key.
  • Cancel an email before it leaves. A scheduled email can be canceled until it starts going out. An agent can also send with a wait of up to 5 minutes, which gives you that window.
  • Pause a mailbox or a campaign. A paused mailbox sends nothing new and still receives mail.
  • Revoke the key. Everything that uses it stops at once: emails it queued are canceled before they leave, and campaigns it launched pause. An email already going out still goes.

A setup to start with

  1. One mailbox that has been warmed up. The essay on new mailboxes says why a new one starts slowly.
  2. A key with Read and Operate, limited to that mailbox.
  3. A person who reads each draft and presses Send.
  4. When the drafts have earned your trust, add Send outreach with a small daily limit, and raise it a step at a time.

Sources

We read these pages on October 5, 2026. They are in English. If a provider has changed its page since, the provider's page is right and this essay is out of date.

Keep reading