Is it safe to let an AI agent send emails to customers?
Summary
Only if a person approves each customer email before it goes out, the agent reaches only the right records, and every send is logged. For a chemical supplier's technical team, an AI-drafted reply can still carry a wrong safety data sheet revision or value, so the approval step has to check content, not only tone.
OWASP lists Excessive Agency as LLM06 in its 2025 Top 10 for LLM applications and recommends that a human approve high-impact actions before they are taken (OWASP, 2025).
Gmail lets a sender cancel a sent message only within a cancellation period of 5, 10, 20 or 30 seconds, set by the user (Google Gmail Help, 2026).
Outlook message recall works only when sender and recipient have Microsoft 365 work or school accounts in the same organization and the message is unopened (Microsoft Support, 2026).
NIST AI 600-1 states that an organization's use of generative AI may warrant additional human review, tracking and documentation (NIST, 2024).
When is it safe for an AI agent to send emails to customers, and when not?
An AI agent can send emails to customers safely when a person approves each message before it leaves, and it is not safe when the agent sends on its own. A customer address sits outside your organization, so the send is the last point at which a mistake can be stopped: Outlook recall does not reach recipients in another organization (Microsoft Support, 2026), and Gmail's undo window lasts 30 seconds at most (Google Gmail Help, 2026).
The table below decides which AI agent actions on customer email, records and calendars may run without a person approving them first.
Condition | Verdict | Why |
|---|---|---|
Agent drafts a customer email, a person approves each send | Safe | OWASP recommends human approval of high-impact actions before they are taken (OWASP, 2025) |
Agent sends a customer email without approval | Not safe | No recall outside your organization (Microsoft Support, 2026); Gmail undo lasts 30 seconds at most (Google Gmail Help, 2026) |
Technical reply quoting safety data sheet values or revisions | Only if the approver checks each value against the current sheet | Generative AI can produce confidently stated but false content (NIST, 2024) |
Agent reads incoming customer email and can also send | Only with approval on every send | A crafted incoming email can instruct the agent to forward data (OWASP, 2025) |
Agent deletes a customer record | Only with approval | Deletion without user confirmation is OWASP's example of excessive autonomy (OWASP, 2025) |
Agent invites external attendees to a meeting | Only with approval | The invitation reaches people outside your organization as soon as it is sent |
Agent summarizes incoming mail with read-only access | Safe without approval | Summarizing needs only read access, not sending (OWASP, 2025) |
The row that matters most for a technical team is the technical reply: approval makes a customer email safe only when the approver checks the values, not just the wording. Once a message, a deletion or an invitation has happened, a correction is a second action, not an undo. Read-only summarizing is the one action in the table that needs no approval, because nothing leaves your mailbox.
Which AI agent actions should need approval before they run?
AI agent actions should need approval before they run when they leave your organization or cannot be undone: sending email to customers, deleting records and scheduling meetings with external attendees. OWASP names the failure "excessive autonomy", where an application "fails to independently verify and approve high-impact actions" (OWASP, 2025).
Sort each action your agent can take into one of two groups:
Approve first: anything a customer will see, anything that removes data, and anything that commits another person's time.
Run without approval: reading, searching, summarizing and drafting, because the result stays with your team until someone acts on it.
Reduce the risk before approval is needed. OWASP recommends limiting an agent's functions and permissions to the minimum necessary; an agent that only summarizes a mailbox should not hold the ability to send or delete (OWASP, 2025). Logging and rate limits do not prevent the damage but limit how much can happen before someone notices (OWASP, 2025).
In Lubinpla, the agent shows an approval card before it sends an email, deletes a record or schedules a meeting with external attendees; approval is the default, an organization can relax it, and sending email requires a connected Gmail account.
What can go wrong when an AI agent emails a customer on its own?
When an AI agent emails a customer on its own, three things can go wrong, and none of them can be pulled back after the send: wrong content, the wrong recipient or attachment, and an instruction the agent should never have followed.
Wrong content. NIST defines confabulation as the production of confidently stated but erroneous or false content (NIST, 2024). In a technical reply, that can be a flash point, a shelf life or a compatibility statement that no document supports.
Wrong recipient or attachment. An agent that picks the contact or the file can send another customer's data, an outdated safety data sheet or another lot's certificate.
Followed instructions. OWASP describes a mailbox assistant tricked by a crafted incoming email into forwarding sensitive information to the attacker's address (OWASP, 2025). A customer-facing agent reads exactly this kind of inbound mail.
Each failure lands with the customer and takes a second message to fix. NIST notes that generative AI use may warrant additional human review, tracking and documentation (NIST, 2024), which is the case for an approval step and a send log together.
What should a person check before approving an AI-drafted customer email?
A person approving an AI-drafted customer email should check five things in order: the recipient, the attachments, every quoted value, the document revisions, and the commitments the email makes. The check is faster when the agent shows its sources next to the draft.
Recipient. Confirm the address, the company and every person in copy. A similar name at another customer is an easy slip to miss.
Attachments. Open each file. Confirm product, grade and, for a certificate, the lot the customer asked about.
Quoted values. Match each number and unit to the technical data sheet, safety data sheet or test report it came from. Delete any value without a source.
Revisions. Check that a cited safety data sheet is the current revision for that product and market.
Commitments. Remove or confirm any promise on delivery, price, approval or performance that the agent added.
Record the result. NIST AI 600-1 lists, as suggested action MS-4.2-004, monitoring and documenting instances where human operators or other systems override the system's decisions (NIST, 2024). An approver's edits and rejections are that record, and they show which kinds of drafts need a tighter check.
Frequently asked questions
Can an AI agent send internal emails without approval?
Internal email carries less risk because it stays inside your organization, where an error can be corrected and, in Outlook within one Microsoft 365 organization, an unopened message can be recalled. Whether to drop approval for internal mail is a policy choice for each team.
Is a review of a sample of AI emails enough instead of approving each one?
Sampling finds patterns after the fact; it does not stop the email that goes wrong. For customer email, where recall does not work outside your organization, approval of each send is the control that prevents the error.
Does an approval step slow down customer replies?
Approval adds the time a person needs to read the draft and its sources. Showing the source for each quoted value next to the draft keeps that check short, and the agent's drafting time still saves the writing.