The drafts-only rule: my AI writes everything and sends nothing
Every automation I run can draft an email, a reply, a report. None of them can hit send. That one design rule is why I can run AI against real business email without losing sleep.
My systems triage inbound email several times a day. They read the message, check the sender's history, pull relevant context, and write a reply in my voice. Then they stop. The reply sits in my drafts folder until a human, me, reads it and sends it.
That is not a technical limitation. It is the single most important design decision in my whole stack, and it is enforced in three places at once.
Why so paranoid
Inbound email is attacker-controlled input. The moment an AI reads a message and can also take actions, every email in your inbox is a potential instruction to your AI. The industry calls this prompt injection, and there is no reliable fix. There are mitigations, and I use them: sanitizing hidden content, treating unknown senders differently, watching for business email compromise patterns. But mitigations fail, and when they fail, the difference between an embarrassing draft and a wired payment is whether the system could act on its own.
So I removed the capability instead of trusting the countermeasures. The scheduled jobs that process email run in a mode where sending does not exist. Not discouraged. Absent.
The three gates
- Environment. Automated runs are read-and-draft only. A send can only happen in an interactive session with me present.
- Explicit command. Even interactively, nothing sends because a model decided to. It sends because I told it to send that specific thing.
- Out-of-band confirmation. For anything that matters, the send waits for a confirmation I give on a separate channel. Two systems have to agree that I said yes.
Overkill? The drafts are good. Most days I edit nothing and send them as written. The gates cost me maybe two minutes a day, and in exchange, the worst case of any failure anywhere upstream is a bad draft I delete.
The general rule
This generalizes to every AI system I build for clients: let the AI do 100 percent of the labor and 0 percent of the authority. Reads are broad, writes are gated. The AI reads six systems to diagnose a phone problem; a human applies the fix. The AI fills 600 title forms; the questionable ones queue for human review. The AI drafts the morning news brief; a human hits publish.
People hear this and assume it kills the productivity gain. It does not, because the labor was never the bottleneck you think it is. Reading, correlating, drafting, formatting: that is 95 percent of the time cost, and the AI eats all of it. The 5 percent that remains, judgment, is the part you wanted a human doing anyway.
