Home › Guide

How to stop an AI agent from sending the wrong email

AI agents increasingly draft and send emails on their own. That speed is useful — until one message leaks a secret, promises a discount nobody approved, or lands in the wrong inbox. Here's why it happens and the simplest pattern to prevent it. Version française →

The problem: autonomous send is fast, but unguarded

When an LLM agent can call a "send email" tool, it will — sometimes with content a human would never have approved. Three failure modes show up again and again:

Secret / data leak. The agent pastes an API key, password, internal document, or personal data into the body.
Unapproved commitment. It promises a 30% discount, a refund, or a contractual term that needed sign-off.
Wrong or hostile recipient. It sends sensitive content to an external, mistyped, or unintended address.

Each is cheap for the agent and expensive for the business. A spam filter won't catch them — the email is "well written", it's just wrong to send.

The pattern: a permission point before every send

The reliable fix is not a better prompt — it's a control point between the agent and the actual send. Before sending, the agent asks one question and obeys the answer:

Send Ask a human Block

Most email passes (send). Risky-but-legitimate cases pause for one-click human approval (request_human_confirmation). Clear hazards are stopped (do_not_send). Every decision is logged for audit.

Keyword filters vs. judging intent

Blocklists of words break in both directions: they miss a paraphrased commitment ("you have my word we'll waive that charge") and they over-flag benign mentions ("the parking price is now free"). A useful guard reads intent in any language, with pattern detection for real secrets (e.g. sk_live_…, AWS keys, private keys) as a deterministic backstop — and falls back to rules if the model is unavailable.

How to add it in practice

With Qorami, the agent makes one API call before sending and obeys nextAction.type:

curl -X POST https://qorami.fr/api/verify-email \
  -H "x-qorami-api-key: YOUR_KEY" -H "content-type: application/json" \
  -d '{"recipient":"client@example.com","subject":"Offer","body":"...","policyProfile":"sales"}'
# -> { "nextAction": { "type": "send | request_human_confirmation | do_not_send" } }

Two lines with the JS/Python SDK or a LangChain tool. When a human is needed, the owner is notified and approves in the dashboard; the agent learns the outcome by polling or a signed webhook. Full details in the API docs, and common workflows in use cases.

FAQ

Does the guard send the email?

No. It decides; your agent sends. It's the control point before the send, never the sender.

What does it cost to try?

Qorami gives free credits to test; 1 traced verification = 1 credit, and a block is free. Create an account to get a key.

What about email privacy?

Email content is redacted and auto-deleted on a retention schedule; only decision metadata is kept for audit.

Try Qorami free →