Superintelligent Outreach: Approval Rules for AI Outbound Messages

An AI agent should send an outbound message on its own only when the message is routine, every fact in it comes from a verified source, and a mistake is easy to correct. Messages that make a new commitment, change terms, answer a complaint, or reach a contact the company has never dealt with need an approved template or a named person's review before they leave. Write these rules before the agent gets any sending channel, not after the first awkward message.

Key takeaways

• Sort every outbound message into one of three lanes: send alone, send from an approved template, or hold for a person.
• Decide by consequence: what happens if the message is wrong, who receives it, and whether it makes a promise.
• An approved template should fix the wording, the allowed fields and the stop conditions, not only the greeting.
• Every send needs a logged reason, the source of each fact used, and a named owner for exceptions.
• Start with the narrowest lane and widen it only after reviewing drafts the agent actually produced.

Why outbound messages need their own approval rules

An internal draft can be edited before anyone reads it. An outbound message cannot be recalled once a customer, supplier or prospect has it. That asymmetry is the reason outbound messages need rules of their own, separate from the general idea that an agent is "helpful" and "careful."

Most companies already have approval habits for people. A sales representative may send a standard follow-up without asking anyone, but needs a manager's sign-off before offering an exception on terms. An agent does not infer those unwritten habits from the org chart or from office culture. It needs the same logic written down as explicit lanes, owners and permissions. The NIST AI Risk Management Framework treats this kind of work as governance: deciding who is accountable for an AI system's outputs and how people oversee them, before the system is used in real operations.

Which messages an agent may send alone, which need a template, and which wait for a person

The three lanes are simple to state. The hard part is applying them consistently, so write the lane definitions in the operating rules and not in someone's memory.

Lane one is send alone. This covers messages that only repeat information already in your system of record, such as an acknowledgment that a document arrived, an appointment confirmation that already exists in the calendar, or a status update pulled from the order record. The recipient is an existing contact, the message makes no new commitment, and every statement can be traced to a source the agent can cite.

Lane two is send from an approved template. This covers recurring messages where the wording and the business position have already been agreed, such as a follow-up after a proposal, a reminder about an overdue invoice in the approved language, or an onboarding step. The agent may fill only the fields the template allows, and it cannot add sentences the owner has not approved.

Lane three is hold for a person. This covers messages that change price, scope, dates or legal terms, responses to complaints, messages to prospects whose fit the agent must judge, anything that mentions other customers or internal decisions, communications with regulators, press or lawyers, and any case where the sources disagree. The agent may draft the message and prepare the context, but a named person sends it.

Use this decision order for each draft. The first yes sets the lane:

• Does the message make a new promise, state a price or change a term? Hold for a person.
• Is the complaint, dispute or sensitive topic present in the thread? Hold for a person.
• Is the recipient unknown to the company or outside the agreed contact list? Hold for a person.
• Does every fact in the message trace to a named source the agent can cite? If not, hold for a person.
• Is there an approved template with an owner that covers this situation? If yes, use lane two with only its allowed fields. If no, hold.
• Would a wrong message be hard to correct publicly or with the recipient? Raise the lane one level.
• Otherwise, the message qualifies for lane one and may be sent with a logged reason.

Illustrative scenario: a follow-up that changes lanes

Illustrative scenario, not a real client case: a supplier has received a standard follow-up from an agent working from an approved template. The supplier replies and asks whether a delivery date can be moved up by a week. The template covers the follow-up, but the date question is a commitment. The agent does not answer it. It places its draft reply, the relevant order lines and the supplier's exact question into the exception queue, with the account owner named as the decision maker. The owner confirms or declines, and the thread then continues in lane two with wording the owner has approved. The follow-up logic itself is covered in AI customer follow-up drafts that keep the context.

What an approved template must contain

A template is a control, not a convenience. If it only supplies a greeting, the agent will fill the gaps with its own judgment. A usable template states the following:

• The single situation it covers, written in one sentence, so the agent cannot stretch it to a neighboring case.
• The fixed wording, with each variable named and typed, such as order number, appointment time or document name.
• The source for each variable, such as a CRM field, an order record or a calendar entry. A variable with no source is a stop condition.
• Forbidden content, such as price figures unless the price field is supplied, date promises, legal or medical claims, and references to other customers.
• The accountable owner who approved the template, the reviewer for changes, and the date of the last review.
• Stop conditions: a missing variable, an unknown recipient, an unsupported language, or a reply that asks something the template does not answer.

For a deeper look at who can change these rules and who can instruct the agent, see Who can give your AI agent instructions? Authority rules. Approval routing for requests that need a human decision is covered in AI approval workflow: route each request to the right approver.

Keeping inbound text from steering the agent

Outbound approval rules fail in a specific way when the agent reads incoming messages. A customer, a vendor or a spam sender can write text that asks the agent to ignore its rules, send a discount or copy a list of contacts. The OWASP guidance on prompt injection describes this class of risk: instructions embedded in content the model reads can override the intent of the operator. Treat incoming text as material to classify, never as a source of new permissions. Permission to send should come from the agent's configuration and the lane rules, and an email should never be able to widen them.

The OWASP authorization guidance points to the same principle from the system side: access decisions should be enforced by the system, not left to the model's reading of a request. In practice, this means the sending tool itself should refuse a lane-three message, whatever the agent's draft says.

Rolling out the lanes without overreaching, and how Be Human handles it

Start from the messages your team already sends, not from what the agent is capable of. Then move in small steps:

• Collect a sample of recent outbound messages from each channel the agent might touch.
• Sort each one into lane one, lane two or lane three using the decision order above.
• Write one template for each repeated message in lane two, and name its owner.
• Run the agent in draft-only mode first, and compare its drafts with what people actually sent. The approach is described in Shadow mode for AI agents: watch before you grant autonomy.
• Grant send rights for lane one only, with a log of each send and a regular review of exceptions.
• Widen lane two template by template, only after each template has a clean review history.
• Re-review the lanes whenever a new channel, tool or type of recipient is added.

In Be Human's managed model, the lanes, templates and permission boundaries are defined during the first engagement, alongside the memory and tools the agent needs. The agent receives send rights only for the lanes that have been approved, and the company's owner keeps control of the template library. Recurring evaluations check drafts against the rules, permission reviews remove rights that are no longer needed, and incident response handles a send that should not have happened. The sending log remains available to the company.

Choosing the first outbound task to hand over

The safest first outbound task is usually a repetitive confirmation or status update that already has a clear source of truth and a named owner. Avoid starting with prospecting, pricing or complaint handling, even when those tasks feel like the biggest opportunity. Pick one message type, write its template, and watch the drafts for a while before any send right is granted. If you are not sure which outbound task to hand to an agent first, take the free Be Human AI diagnostic to find the first task worth handing to an agent.

Frequently asked questions

Can an AI agent send customer emails without any human review? Yes, but only in lane one, where the message is routine, every fact comes from a verified source, and a mistake is easy to correct. Keep this lane limited to confirmations and status updates that repeat information already in your systems. Anything that commits the company to something new should still wait for a person.

Who should approve an outbound template? The owner of the process the message belongs to should approve it, with a second reviewer from sales, support or legal when the risk is higher. The approver should sign off on the fixed wording, the allowed fields and the stop conditions, not only the greeting. Record who approved it and review it again whenever the underlying process changes.

What happens when a reply asks something the template does not cover? The agent should stop, send the thread to the exception queue with the reason, the question and the draft it prepared, and name the person who must answer. A human writes the reply, and if the same question recurs, the approved answer can become a new template. The agent should never improvise a commitment just to keep the conversation moving.

How is this different from a basic email automation? A basic automation sends the same message whenever a trigger fires, with no judgment about content. An agent reads context, so it can drift outside approved wording unless the lanes, templates and permissions are enforced outside the prompt. Keeping the rules in the permission setup and the send log lets you check each message after it goes out.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.