What should organisations do when an agent can send messages on a user’s behalf?

Why sending needs its own approval step

When an agent can send messages, the dangerous moment is not the login, it is the commit to external action. A user may be comfortable letting an agent draft or summarise content, but sending creates real-world impact, legal exposure, and reputational consequences. Treating send as a separate control point keeps drafting errors from becoming outbound harm.

This separation also matches how users think about intent. A prompt may authorise the agent to prepare a reply, but that does not mean the user intended publication, escalation, payment, or disclosure. The more the message can reach customers, partners, regulators, or internal executives, the more important it is to require an explicit send-time decision.

What effective send-time control looks like

Good designs make the final act visible and deliberate. The agent can prepare a draft, but a human must confirm the exact recipient, content, and context at the moment of send. For higher-risk channels, the approval should be tied to the specific message, not a broad session permission that lasts for the whole sign-in period.

That control should be narrow enough to preserve automation where it is safe, but not so broad that one approval silently authorises many messages. If the message content changes materially, the audience changes, or the agent starts a new thread with different implications, the send decision should be revisited. This is where AI Agent Authorisation Guide is useful, because it frames per-action approval and delegated authority as the right control model for agents.

For teams building the identity model behind this behaviour, Agentic AI Identity Guide helps distinguish acting on behalf of a user from merely reading data on the user’s behalf. That distinction matters because a send action is a delegated act, and delegated acts need clearer boundaries than passive access.

Why message sending is a governance and safety boundary

Outbound communication is where an agent crosses from assistance into representation. If it misreads a thread, hallucinates a detail, or copies sensitive information into the wrong channel, the consequence is not just a bad draft. It becomes a statement or disclosure attributed to the user or organisation, which changes accountability and can trigger downstream business or compliance issues.

That is why message send should be controlled with the same seriousness as other high-impact delegated actions. Organisations should make it easy to draft, edit, and review, but hard to silently release. For broader operating models, Zero Trust for AI Agents reinforces the principle that each action should be verified rather than assumed safe because the user is signed in.

Risk and Threat Considerations

Sending on behalf of a user creates a privilege boundary that attackers and failure conditions can exploit. If a prompt injection, misleading context, or compromised draft pipeline can influence the final send, the agent may become a high-speed channel for fraud, disclosure, or impersonation. The risk increases sharply when send approval is implicit, cached, or bundled into a long-lived session.

Failure mechanism: The agent forms or carries an incorrect message from partial context, then uses standing user authority to transmit it without a fresh decision at the point of send.

Impact: Wrong recipients, unintended disclosures, reputational damage, and authenticated abuse of the user’s communication channel can follow, especially when the message appears to come from an approved sender.

Practitioner Guidance

What to verify: Confirm that the approval is bound to the exact outbound action, not just to the user session. The user should see the recipient, channel, and final body immediately before send, with any materially changed content forcing a new approval.

What good looks like: Drafting can be autonomous, but send is explicit, attributable, and logged as a separate event. The best pattern is a clear handoff point where review teams can see who approved, what was sent, and under what authority it was released.

Common mistake: Teams often protect sign-in and then treat all subsequent agent actions as equally trusted. That collapses reading and sending into one risk class, which is exactly how a harmless draft turns into an external incident.

Practitioner takeaway: Preserve automation for composition, but make outbound transmission a deliberate, separately governed act with fresh approval and clear auditability.

Related resources from NHI Mgmt Group

• When should organisations treat an AI agent as a privileged system?
• What do organisations get wrong when they assume AI agent access is safe because the agent is working on behalf of a user?
• What is the difference between human identity governance and AI agent governance?
• When does AI agent access create more risk than it reduces?