Yes. Once an email reaches someone outside your organisation, it cannot be recalled, and whatever it disclosed or promised is beyond your control. Internal notifications built from approved templates are low risk. Free-text external email is not, so an AI agent should draft it and a person should send it until that capability has earned more.
Why can't an email be taken back?
Recall features work, at best, inside one organisation's own mail system and only before the message is opened. For anything sent outside, the message is delivered, stored on another server and read on the recipient's terms. A correction can follow, but the original remains.
Three kinds of harm travel with an email. Disclosure: personal data, account details or confidential information sent to the wrong person cannot be unsent, and may need to be handled as a data breach. Commitment: a sentence such as "we will refund the full amount" may be relied on and, in some contexts, be binding. Reliance: a customer told their claim is approved, or that a payment has cleared, will act on it.
That makes email one of the clearest examples of the principle in why autonomy in regulated industries is a question about reversal. For a wider list of actions in the same group, see which AI agent actions are irreversible.
Which emails can an agent send on its own?
| Email type | Depth | Why |
|---|---|---|
| Internal notifications to staff from a template | 3 | Stays inside, factual, low exposure |
| Customer acknowledgements from an approved template, with no variable claims | 3 | Fixed wording, no commitment beyond receipt |
| Customer status updates built from system data and a template | 3, within limits | Facts drawn from the record, not written freely |
| Free-text replies to customers | 2 | The agent drafts; a person sends |
| Emails that state a decision, such as a decline or a refund outcome | 2 | Decisions are sent by the person who made them |
| Emails containing personal or account data to a new address | 2 | Disclosure risk |
| Emails to regulators, courts or counterparties | 2 | External, formal and often binding |
The line falls between template-bound messages whose content is fixed and checked, and messages where the agent chooses the words. Templates limit what the agent can say; free text does not.
A worked example
Take a wealth manager's client service team. An agent handles the shared inbox.
A client emails to ask whether their quarterly statement is ready. The agent checks the system, finds the statement published, and sends the approved "your statement is available in the portal" template at depth 3. Nothing in the message discloses data beyond the client's own name.
Another client writes from a new email address, asking for their portfolio valuation to be sent to them. The address does not match the one on file. The agent does not send anything with data in it. It drafts a reply asking the client to confirm through the secure portal, and holds it for an adviser. The adviser checks, recognises a common impersonation pattern, and passes the case to the fraud team.
What controls apply?
- Separate capabilities for template and free-text email. The agent's role scope names each one, with its own depth.
- Recipient checks at the moment of sending. Is the address on file? Is the domain new? Does the message contain personal data? Any doubt holds the message.
- Content checks. Template messages are checked for unfilled fields and data from the wrong record before sending.
- Rate limits. A cap on how many messages the agent sends in a period, so a fault sends 50 wrong emails, not 50,000.
- A record of every message. What was sent, to whom, from which template or draft, and who approved it.
Use the irreversible action checklist for AI agents to sort your own email types. Deleting data raises a similar question in reverse, covered in whether deleting data is an irreversible action.
Where Pryme fits
In Pryme, sending a template notification and sending a free-text reply are separate capabilities, each certified on the organisation's own past cases. A free-text reply is held for a named person by default, and the recipient and content checks run at the moment of sending. The verdict, allowed or held, is filed with the message.
Questions people ask
Can an agent send emails on a person's behalf?
It can draft them under that person's name for the person to send. Sending under someone's name without their review makes them accountable for words they did not see.
Is a text message or app notification different?
The same logic applies. Once delivered to a customer's device, it cannot be withdrawn. Fixed templates can run unattended; free text should be reviewed.
What about emails between two agents?
Messages between agents inside your own systems are internal and can usually be logged and replayed. If either agent can act externally on what it receives, the message still needs the same provenance and bounds.