Sometimes. An email cannot be recalled once it lands, so the deciding factor is what the message commits you to. Routine messages to a recipient already on record, built from facts in your own systems, can go without review once the agent has proven it on real cases. Anything that promises, refuses, threatens or discloses waits for a person.
What decides which emails can skip review?
Four questions, asked about each type of email rather than each message.
Who receives it? An address held on the customer record is known. An address that first appeared in the incoming message is not, and sending personal data to it is how account takeovers succeed.
What does it commit you to? A status update describes. A settlement offer, a refusal of a claim or a fee waiver commits. Commitments need a person.
Where do its facts come from? A balance read from the ledger is reliable. A figure the agent inferred or took from the customer's own message is not.
Can it be corrected? A wrong delivery date can be fixed with a follow-up. A wrongly sent formal notice may start a legal clock you cannot stop.
Which emails go straight out, and which are held?
| Email type | Without review? | Why |
|---|---|---|
| Acknowledgement of receipt with a reference | Yes, once certified | Describes, commits to nothing |
| Status update drawn from the system of record | Yes, once certified | Facts are sealed; recipient is on record |
| Answer to a factual question from approved sources | Usually, once certified | Grounded and checkable |
| Request for missing documents | Usually, once certified | Low stakes; recipient on record |
| Any message to an address not on record | No, held | Possible impersonation or misdirection |
| Refusal, decline or adverse decision | No, held | Affects the customer; needs a reason a person stands behind |
| Offer, waiver, compensation or promise | No, held | Commits the business |
| Formal notice, arrears letter or complaint final response | No, held | Starts deadlines or rights |
| Anything with attachments containing personal data | No, held | Disclosure risk |
"Once certified" matters. An agent starts at depth 2, drafting emails for a person to send. It moves to depth 3 for a given email type only when its drafts of that type have been tested against real cases and cleared. The allowed, held, refused, withheld verdicts apply to each send.
Who decides, and where is it enforced?
The process owner decides which email types may go without review, with compliance agreeing for any customer-facing type. The decision is written into the customer's own limits for that process, so it holds at the moment of sending, not in a style guide.
Enforcement sits at the send action. Before a message leaves, the agent's draft is checked: is this email type allowed at depth 3, is the recipient on record, does every figure trace to a registered source, does it contain anything on the never-send list? If any check fails, the send becomes a held draft for a named person.
What does this look like in practice?
Take a building society's mortgage servicing team. The agent answers the shared inbox. It sends, without review, confirmations that a document arrived and updates on where an application stands, both drawn from the servicing system.
One morning a borrower writes in from a new address asking for a redemption statement to be sent there. The statement itself is a routine document. The address is not on record. The agent holds the reply, notes the new address, and routes it to a person, who calls the borrower on the number held. The borrower did change email; the record is updated, and the next statement goes without review. Setting up the mailbox side is covered in letting an AI agent send emails from a shared mailbox.
Which controls make it safe?
- Allowed types listed by name, not described in general terms.
- Recipient check against the record before every send.
- Source check so every figure in the email traces to a registered source.
- Disclosure where required. Where the EU AI Act applies, Article 50 requires people to be told when they interact with an AI system; decide how your emails meet that.
- Every sent email filed with the draft, sources and verdict, so any message can be explained.
- Sampling of unreviewed sends, so quality is checked after the fact.
Where Pryme fits
In Pryme, each email type is a capability with its own depth, earned through Attest on your own cases and capped by the role's ceiling. The send is checked against the minimum chain at the moment of action, and the verdict is filed. For the broader question of control, see how to control what an AI agent is allowed to do and our guide to agent governance.
Questions people ask
Should customers be able to tell the email came from an agent?
Yes. Beyond any legal duty, a clear signature saying the message was prepared by an agent, with a way to reach a person, avoids confusion later.
What about internal emails?
The same questions apply with lower stakes. Internal messages that commit budget, approve work or share sensitive data still need review.
Can the agent send a follow-up if the first email had an error?
A factual correction of its own unreviewed email, yes, if that type is allowed. A correction that changes a commitment goes to a person.