When a team says "we want AI to handle replies," they can mean two different things. One is that the AI writes the reply. The other is that the AI sends it. The first is a drafting tool. The second is an agent acting on your behalf. They carry very different risks, and it helps to decide which one you are building before you build anything.
Why the line matters
A draft sits in a queue. A person reads it, fixes the tone, corrects a wrong detail and sends it. If the draft is bad, the cost is a few seconds of editing.
A sent reply is out of your hands. If it quotes the wrong price, promises a date nobody agreed to, or goes to the wrong person, you cannot pull it back. Someone now has to write a second message, and that one is harder than the first.
The model can make the same mistake in both cases. What changes is whether a person gets a chance to catch it.
A hypothetical example
This is a demo scenario, not client work. Say a small equipment supplier gets parts questions in a shared inbox. The workflow is bounded:
- A new email arrives and the AI reads it.
- It looks up the part in a read-only copy of the catalog.
- It writes a draft reply and attaches the catalog row it used.
- The draft lands in a review folder. A person sends it, edits it or discards it.
The AI has no send permission. The lookup is read-only. The person sees the source next to the draft, so checking takes seconds instead of a second search.
Checks worth setting up
Even for internal, non-regulated work, the inbox holds customer names and contact details. Those deserve care.
Limit what the AI can read to what the task needs. Keep the lookup read-only. If the workflow connects through MCP, look at which tools the server exposes and whether any of them can send, write or delete. Give the draft step only the permissions it uses.
Log what was drafted, what was changed and what was sent. That record tells you later whether the drafts are good enough to trust more.
Moving toward sending
Some replies may eventually be safe to send automatically, such as a fixed acknowledgment that a message was received. That is a separate decision for a narrow case, made after you have watched the drafts for a while.
Start with the draft. Keep the send button with a person. Widen it only when the evidence supports it.
I'm Jonathan Melton. I run FusionAL, focused on reviewing and integrating lower-risk internal AI workflows, one bounded workflow at a time.
Top comments (0)