Should an AI Agent Send Emails or Update Records Without Human Approval?
Published August 2026 by Solarc Labs
Start with the consequence, not the AI capability
The useful question is not whether an AI agent can click a button, send a message or update a record. It is what happens if the action is wrong, duplicated, mistimed or taken for the wrong customer. Drafting a reply is different from sending it. Preparing a CRM change is different from overwriting the live record. Producing a refund recommendation is different from moving money. The more difficult an action is to reverse, the more people it affects, or the more authority it exercises, the stronger the case for a human approval boundary before the external effect.
Bound the task before granting access
The UK National Cyber Security Centre recommends introducing agentic AI incrementally through tightly bounded pilots with clearly defined tasks. It also warns against unrestricted access to sensitive data or critical systems. For a business workflow, that means defining the exact job, data, systems, allowed actions and stop conditions before deciding how autonomous the agent should be. A vague goal such as “handle customer operations” is not an operating boundary. A narrower instruction such as “prepare a draft response from these approved sources and wait for approval before sending” is easier to review, test and contain.
Use approval gates where a mistake creates a real external effect
NCSC guidance published in August 2026 says teams should decide when an agent must stop and seek human approval, and that these approvals should be guaranteed and gated. It distinguishes human-in-the-loop approval from looser monitoring after an action has already happened. For consequential workflows, an approval gate should be a real control rather than a prompt asking the model to behave carefully. The system should be unable to perform the protected action until the authorised reviewer explicitly approves the specific proposed effect.
The reviewer needs evidence, not a blind approve button
Human oversight is only useful when the reviewer can understand what is about to happen and can genuinely refuse it. UK government AI guidance says people should be able to monitor and influence automated systems, with roles and responsibility for oversight made clear. A review screen therefore needs the proposed action, target, relevant source evidence, important assumptions and any uncertainty that could change the decision. If the reviewer is expected to approve hundreds of opaque actions automatically, the workflow has human presence but not meaningful human control.
Earn autonomy one reversible workflow at a time
A sensible rollout can start with read-only analysis, move to drafting, then allow narrowly defined low-impact actions only after the team has evidence that the controls and recovery path work. Higher-impact actions can continue to require approval even if lower-impact work becomes more automated. That is the boundary behind the QUALITY OS pilot: make intent, evidence, authority, allow or deny state and the approval point visible before an external effect. It is not a promise that every AI workflow should stay manual, and it is not a claim that an agent becomes safe merely because a human reviewed some earlier examples.
Primary sources
Sources used for this article
Continue the job