The most reliable guardrail for an email-sending agent isn't a smarter prompt — it's making the agent physically unable to send. Let the model write all it wants; route every outgoing message through a draft that a human (or a stricter second model) has to approve. The LLM gets creative latitude, the send button stays out of its reach.
Nylas Agent Accounts — hosted mailboxes your app controls through the API, currently in beta — make this pattern almost boring to implement, because the drafts surface is a full CRUD API with webhooks on both the create and update steps.
The gate, conceptually
Split your agent's email pipeline into two privileges:
Write privilege — the agent process. It can create and update drafts. It cannot send.
