AI agent for email: how to control sending

Consider a hypothetical example: an agent prepares forty sales emails overnight across three mailboxes. The next morning, you check its work and find that one contact received the same message twice.

The first send request had received no response. The agent treated the silence as a failure and tried again. But the email provider had already accepted the message.

Another mailbox contains drafts without a signature, with the entire message in a single paragraph. To find out what was sent, you have to open the Sent folder in every account. Meanwhile, the agent keeps working.

Even accurate copy causes problems if it goes out twice or from the wrong address. Before letting an agent send on its own, you need to be able to trace each attempt and stop further requests.

When you write an email, you usually check the recipient and signature before pressing Send. An agent can move through those steps without pausing. If its email connection allows retries, it may retry when it should wait.

Email providers have their own limits and controls. You still need to check whether the agent’s connection also enforces your company’s rules.

We ran into this with formatting. Our agents produced drafts with paragraphs and signatures through the official connectors. With the first version of our gateway, the text arrived as one solid block.

Our integration was missing the formatting work normally handled by an email application. We added text rendering, stored signatures and the original message beneath replies. Before increasing volume, check the email as the recipient actually sees it.

Create the draft, then decide who sends it

A draft separates writing a message from sending it. You can check the recipient, what the message promises and which address it will come from.

Our gateway lets an agent send only a draft already registered with it. The send action accepts no new recipient, subject or body: the agent must identify the draft to send. The draft delivery reference describes this boundary.

A draft does not mean a person has approved it. With sending enabled, an agent can create a draft and send it. Sending is enabled by default in version 0.1.0. To start with a person reviewing each message, IT must disable sending in the gateway. The agent prepares drafts; the reviewer sends them from the email application.

That is where I would start. The sales manager can see how the agent handles incomplete requests or proposes terms the company has not agreed to.

Set a limit for each mailbox and sender

Decide how many emails the agent may send each day. The software that executes the send must enforce that limit. An instruction in a prompt is not enough on its own.

Yempik Mail Gateway checks both the mailbox total and the limit for each sending address, including aliases. In the default configuration, a sender without an explicit limit starts at ten sends per day.

This is the project’s conservative starting point, not an official provider threshold. Ten emails a day does not guarantee inbox placement. For a new domain, IT should check the configuration and monitor what happens to messages before increasing volume.

Check an uncertain result before trying again

A request that times out leaves a question unanswered: was the message sent? Immediately repeating the request can deliver it twice.

The gateway blocks another attempt while the outcome is uncertain. A separate check looks for evidence in Sent and Drafts. If that evidence is insufficient, the state remains unresolved, as explained in the send reconciliation reference.

This control covers that particular send attempt. You still need a sales rule for when someone may contact the same person with a new message. Make that decision before leaving the agent to work unattended.

Keep a record and put someone in charge of stopping it

You need to know which mailbox was used and what happened to the request. The gateway records these details in an audit log. Its dashboard shows recent events and mailbox status.

A global kill switch blocks agent requests. It cannot recall messages already accepted by the email provider. The security model also describes how to disable sending while keeping reading and drafting available.

Assign this responsibility to a person and make sure they know where to intervene. If the wrong message goes out, they should not have to search a chat for instructions.

Send a test to a mailbox you can open on your phone. Check paragraphs, links and the signature. For a reply, check that it appears in the right conversation.

An agent using the gateway can write in Markdown. The software renders the email, adds the signature configured for that sender and quotes the original message in replies. The formatting reference also explains signature handling.

A signature must be saved before it can be used. The software cannot supply a missing job title, phone number or company details on its own.

At the time of release, we use the gateway across ten mailboxes on Gmail, Microsoft 365 and Zoho Mail. Working with our own email is what led us to build these controls.

Yempik Mail Gateway is an open-source server using MCP (the protocol that connects AI agents to other tools and data). It connects Claude, ChatGPT and other compatible clients to company mailboxes through the providers’ official APIs.

Simone Bova and I maintain the project. Version 0.1.0 was released on 6 November 2026, under the MIT licence. The code is on GitHub, where you can read it line by line.

It needs to be deployed and maintained. Someone technical must connect the mailboxes and keep the installation up to date. It sends through company mailboxes and does not provide a bulk email service. It can read received messages, but cannot forward, move or delete them.

There are limits to consider before adopting it. The roadmap still includes reading attachment content and sending attachments, scheduled delivery, automatic follow-ups and push notifications for replies. There is no built-in suppression list yet, so people who must not be contacted again need to be managed separately.

The gateway does not judge whether an agent’s sales claims are accurate. Someone still needs to be responsible for reviewing the content.

The ten mailboxes across three providers and the formatting incident are Yempik’s own experience, reported by Raffaele Zarrelli as of 6 November 2026. The forty-email scenario is hypothetical. Product capabilities refer to version 0.1.0.