Can an AI Agent Send Email Without Asking?

An AI agent can send email without asking when its mailbox connection gives it send tools and the place it’s working doesn’t hold them for approval. In Insulin, the Inbox App asks before every reply goes out, unless you write an auto-send rule yourself. An agent working your Gmail or Outlook doesn’t: Gmail’s send tools “deliver immediately, with no recall window,” and on most surfaces no card stops them. The switch is the integration’s access level, Read-only.

---

“If we connect Gmail, can an agent send email without asking?” The IT or security owner asks it before approving a mailbox connection, and so does anyone about to connect their own Gmail or Outlook to an AI workspace. Insulin’s documentation gives two answers, and both are true, because they describe two different things.

The first is the Inbox App’s: “Insulin never sends email on its own.” Every reply it drafts waits for you, and Send asks you to confirm, unless you’ve written an auto-send rule yourself. The second is on the Gmail and Outlook integration pages, which name the tools an agent gets when you connect a mailbox. Gmail’s send-draft and send-message “deliver immediately, with no recall window,” and Outlook’s send-mail is described as “Send a new email immediately.” The Inbox App’s promise covers the Inbox App. An agent holding your mailbox is held by the access level you set on it, and on most surfaces by nothing else.

This post maps both: which tools send, where an email can go out without you, why Edit doesn’t stop a send, and the settings that do.

Can an AI agent send email without asking in Insulin?

Yes: an agent whose Gmail or Outlook integration is at Edit or Full can send without an approval card on every surface but one, a Slack channel where you @mentioned Insulin. Insulin’s Tool Approvals rule names what pauses: “posting a message to Slack, since other people can read it the moment it is sent, and — when you mention Insulin in a Slack channel — anything it can’t recognize as a read.” An email is neither, unless the request came from a Slack channel.

A send tool is a tool that delivers mail from the connected mailbox the moment the agent calls it. There’s no step after the call: the Gmail integration page puts it in one line, “Sending is not reversible and the agent knows it,” and its advice is the one this post builds on: “Prefer having the agent create a draft and reviewing it yourself before a send.”

AWS treats this as a permissions question, not a prompting one. GENSEC05-BP01 in the Generative AI Lens describes “excessive agency,” where an agent “determines the best solution to a problem is to take broader actions beyond its scope,” and recommends two controls against it: least-privilege permissions boundaries for agentic workflows, and to “implement user confirmation for the agent, requiring users to confirm agent actions.” For email in Insulin, the confirmation exists in the Inbox App. For an agent, the boundary is the control you have.

Which tools can send email from Gmail or Outlook?

Fours’ pages name six: send-message and send-draft on Gmail, and send-mail, reply-to-message, reply-all-to-message and send-draft-message on Outlook. In the agent, Gmail’s carry a google_email__ prefix and Outlook’s a microsoft_email__ prefix, and each mailbox also has tools that draft without sending.

Mailbox	Tool	What Fours’ documentation says it does	Sends mail?	Lowest level that keeps it
Gmail	send-message	Composes and sends in one step, attachments included, and can reply inside an existing conversation. “Irreversible”	Yes, “immediately, with no recall window”	Edit
Gmail	send-draft	Sends a draft that is already saved. “Irreversible — the recipient has it immediately”	Yes, “immediately, with no recall window”	Edit
Gmail	create-draft, update-draft	Writes or rewrites a draft: “The draft is saved, never sent”	No	Edit
Gmail	delete-draft	Deletes a draft without sending it	No	Full
Outlook	send-mail	”Send a new email immediately,” optionally with attachments	Yes	Edit
Outlook	reply-to-message	Replies to a message’s sender	Yes	Edit
Outlook	reply-all-to-message	Replies to all recipients of a message	Yes	Edit
Outlook	send-draft-message	Sends a saved draft	Yes	Edit
Outlook	create-draft-message, update-message	Saves a new draft, or updates one	No	Edit

The last column follows the rule on Fours’ agent access levels: “a Mutating action needs Edit, or Full when it removes something.” Each connection’s Actions tab, under Settings → Integrations, shows its exact tool list and marks each action Read-only or Mutating, so check your own.

Two scope rules decide which agents get these tools at all:

• Outlook is user-level only. The Outlook page is plain: “Outlook is connected per user only.” Organization agents “can only use org-level integrations,” so only your personal agents and the built-in Insulin assistant can send from an Outlook mailbox.
• An organization agent composes Gmail through Sign in with Google. On an org-level Gmail connection made with the Service account method, “the agent gets none of create-draft, update-draft, send-draft, delete-draft or send-message — only the standard Gmail actions remain.” That isn’t a connection that can’t send. The method grants the send-only scope, and Fours calls it the right choice for “automated sending from workflows out of a durable corporate address.” For an organization agent that drafts and sends, the documentation’s answer is an org connection made with Sign in with Google.

Where can an email go out without you?

Everywhere but two places: a Slack channel where you @mentioned Insulin, and the Inbox App. The approval card belongs to the surface, not the tool, and most surfaces either hold only Slack posts or don’t offer the card at all. Where the approval gate is armed maps the card surface by surface; this is the same map, read for email.

Where the work happens	Does an agent’s email wait for you?	Why
Web workspace, solo chat, main thread	No	The card is offered here, but it holds only Slack posts, so send-message, send-draft or send-mail runs without one
Web workspace, a reply in a sub-thread	No	The card isn’t offered in a sub-thread
Slack DM with Insulin	No	”In a Slack DM, only posting a Slack message waits for approval”
Slack channel, where you @mentioned Insulin	Yes	A channel turn is untrusted, so “creating, updating or sending anything on your behalf” waits for a card only you can answer. After three minutes it expires and nothing is sent. Insulin in Slack covers the card
Microsoft Teams DM	No	Teams has no approval card, so an action “is not held back there”
Insulin channel	No	The card isn’t offered in a channel
Job run: manual, cron or push	No	The card isn’t offered in a job run, so “the turn proceeds without pausing”
Inbox App	Yes, every time	Every AI reply waits in Approvals ▸ Pending and Send asks you to confirm, except an auto-send rule you write yourself

Slack and Teams reach the built-in Insulin assistant, and it runs on your own connections: personal tools such as Gmail, once connected in the console, “work in Slack too.” Ask it in a Slack DM to reply to Globex and confirm Tuesday, and with Gmail at Edit or Full it can call send-message; nothing in the DM waits for you.

A goal’s background rounds can’t show the card either. The documentation withdraws the Slack send tool from them (“a goal never posts to Slack on its own”) and names no mail tool, so don’t assume a goal holds its email back.

Why doesn’t the Inbox App’s promise cover agents?

Because it’s a promise about the Inbox App, the one place in Insulin built around a review queue for email. The Inbox documentation states it as “Insulin never sends email on its own,” and inside that app it holds: “Every AI-generated reply waits in the Approvals ▸ Pending queue until you review it, and pressing Send requires a separate confirmation step because sending cannot be undone.” Sending a draft from Mails ▸ Drafts asks you to confirm too, and Inbox “never sends a mailbox draft on its own.”

The exception is one you write. An auto-send rule sends without review, within limits Inbox enforces:

• One exact filter decides whether it fires, on the sender’s address or name, the subject or the body. The AI never judges whether it applies.
• No outside context goes into the reply: no customer data from Fours, no knowledge-base passages and no integration lookups. A rule that asks to look something up never sends; its replies wait in Approvals ▸ Pending.
• A pre-send check holds back doubtful replies, such as an empty message, something that looks like a card number, a US Social Security number or a private key, or a link or address outside the sender’s own domain.
• It’s written on the Rules page only. The Inbox chat rail refuses to create one.

When the Inbox App acts, and when it asks covers which rules deserve that exception.

An agent with your mailbox isn’t the Inbox App. Inbox reuses the connection you set up under Settings → Integrations, and the built-in assistant or a personal agent can use that same connection through the integration’s own tools, with no queue between its send-message and the recipient. “Insulin never sends email on its own” is accurate for the Inbox App, and only for the Inbox App.

Does Edit access stop an agent from sending email?

No. Edit keeps every send tool, because a send changes the mailbox without taking anything out of it. Insulin’s levels build on each other: “Read-only looks things up, Edit also changes records, Full also deletes them.” Edit lets an agent “create and change records there, but not delete them,” and a delete “is anything that takes a record out of that service.”

Level on the mail integration	Send tools	Draft tools	Discarding a draft
Read-only	Removed	Removed	Removed
Edit	Kept	Kept	Removed: delete-draft takes a draft out of the mailbox
Full (the default)	Kept	Kept	Kept

Two consequences catch people out:

• Edit isn’t a drafts-only setting. It’s tempting to read Edit as “can write, can’t do anything final.” It’s closer to the reverse: an agent at Edit can send, but it can’t discard a draft, because discarding is a delete.
• No level drafts without sending. Creating a draft is a change, so it needs Edit, and Edit includes the send tools. An agent that may draft may also send.

That makes drafting a habit you ask for, not a permission you set. Telling an agent to save a draft and stop follows the Gmail page’s own advice, and it’s a sound default, but at Edit or Full the send tools are still there, and an instruction isn’t a boundary.

Full is where you start. “An integration you never narrow runs at Full,” and an integration selected on an agent before the access setting existed kept Full. If nobody has changed it, your agent’s mailbox is at the level that sends and deletes.

How do you stop an AI agent from sending email?

Set the mail integration to Read-only on every agent that shouldn’t send, your own built-in assistant included. On Read-only, an agent can “use only that integration’s read tools — listing, searching, fetching,” and its write tools are removed, so the send tools are gone wherever the agent works: chat, Slack, Teams, a channel or a job. Read-only access for AI agents covers where that setting sits for each system. Set any other integration that can send mail, such as an MCP server you added, to Read-only too.

1. On a custom agent, set Gmail or Outlook to Read-only in the agent’s Integrations list unless sending is its job. On an organization agent, only an org admin can edit the integrations.
2. On the built-in Insulin assistant, narrow your own levels. It has no integration list to choose from: “it can always reach every connection you have made.” Open a chat with Insulin, click the pencil in the conversation header, and set the mail integration in the panel’s Integrations section. “An integration you leave alone stays at Full.” The levels are yours alone, so each person who connects a mailbox sets their own; and if Fours can’t read your levels when a turn starts, Insulin runs that turn with every integration at Read-only.
3. Keep Edit for the few agents whose job is sending, such as a follow-up agent that writes to Acme’s buyer at [email protected], and keep them out of jobs and Insulin channels unless you’ve decided they may send there unattended.
4. Ask for drafts and send them yourself. Where an agent at Edit drafts for you, follow the Gmail page: “Prefer having the agent create a draft and reviewing it yourself before a send.”
5. Check what the agent can call. Each connection’s Actions tab marks every action Read-only or Mutating, and an agent can list “the provider actions this agent may actually call, given the integration’s access level and the kind of turn it is running.” Ask it before you trust it.

Can a scheduled job send email while nobody is watching?

Yes. A job runs with its agent’s integrations and never pauses, so a scheduled job whose agent holds Gmail at Edit sends unattended. Insulin Jobs runs a job “as the agent that created it,” with “that agent’s access to resources and integrations,” and the approval card isn’t offered in a job run. A cron job that emails the week’s renewals to [email protected] every Monday at 09:00 sends at 09:00 every Monday, with nobody at the keyboard.

• The job inherits the boundary; it doesn’t get one of its own. Set the agent’s mail level before the schedule goes on. A job you ask the built-in assistant for runs as the assistant, on your own connections.
• A Gmail event can start a run. Gmail events are a push source, set up by asking the assistant. If that job’s agent can send, an email from outside can start a run that sends one, with no person in between. Decide whether that agent should send at all.
• The run shows what went out. Each run’s Steps tab keeps “the tool-call transcript,” with each call’s Args and its Result or Error, so a send and what it was called with are on record. Only the job’s owner can read it: “being an org admin does not give you someone else’s jobs.”

Frequently asked questions

Can an AI agent send email without asking in Insulin?

Yes, if its Gmail or Outlook integration is at Edit or Full. In a web chat or a Slack DM, the approval card holds only Slack posts, so a send tool runs without one. Gmail’s send-draft and send-message deliver immediately, with no recall window.

Does the Inbox App send email without approval?

No. Every AI-generated reply waits in Approvals ▸ Pending, and Send asks you to confirm, because sending can’t be undone. The one exception is an auto-send rule you write yourself, held to one exact filter, no outside context and a pre-send check.

Does Edit access stop an agent from sending email?

No. Edit lets an agent create and change records but not delete them, and a send removes nothing, so Edit keeps every send tool. It can’t even discard a draft, because that’s a delete. Read-only is the level that removes the send tools.

Can a scheduled job send email while nobody is watching?

Yes. A job runs with its agent’s integrations, and the approval card isn’t offered in a job run, so the turn proceeds without pausing. A cron job whose agent holds Gmail at Edit or Full sends on schedule, unattended. Set the mail level before the job exists.

Can an organization agent send email from Outlook?

No. Outlook connects per user only, and an organization agent uses only organization-level integrations, so only personal agents and the built-in assistant can send from Outlook. An organization agent composes Gmail through an org connection made with Sign in with Google.

When does an agent’s email wait for approval?

When you @mention Insulin in a Slack channel. There, anything it can’t recognize as a read, sending included, waits on a card only you can answer, and nothing is sent if three minutes pass. In a Slack DM, only a Slack post waits.

Takeaways

• The Inbox App asks; an agent doesn’t. “Insulin never sends email on its own” is the Inbox App’s promise, with one exception you write yourself, an auto-send rule. An agent with Gmail or Outlook at Edit or Full sends without a card in a web chat, a Slack DM, Teams, an Insulin channel or a job.
• A send is final. Gmail’s send-draft and send-message “deliver immediately, with no recall window,” and Outlook’s send-mail sends “immediately.”
• Edit keeps sending. A send takes nothing out of the mailbox, so Edit keeps every send tool and loses only deletes, delete-draft included. Full is the default.
• Read-only is the switch. It removes the send tools on every surface. Set it on each custom agent, and on your own assistant from the pencil in the conversation header.
• Jobs send unattended. A job runs with its agent’s integrations and never pauses, so set the mail level before the schedule goes on.
• Two places wait for you: a Slack channel where you @mentioned Insulin, where a send waits for your Allow and expires after three minutes, and the Inbox App, unless you’ve written an auto-send rule.

When every reply should wait for a person, use the part of Insulin built for it: the Inbox App, which drafts email replies and holds each one for your approval unless you write an auto-send rule yourself.