Can an AI Agent Send Email or Refund on Its Own?

When a chatbot gets a sentence wrong, you can usually spot it. An agent is different. Once it has tools, acting on a wrong understanding turns a mistaken judgment into a real consequence.

These actions have big effects and are hard to undo:

Send an email that promises compensation
Delete a project file
Issue a refund to a customer
Change a contract's status
Publish a public announcement

Should an agent do these on its own? The answer is to let the level of automation follow the level of risk: low-risk actions can run by themselves, and high-risk ones go through a person first.

The most reliable approach is to let actions pass through a person first: the agent gathers evidence and flags risks, a person takes a look and approves, and the system does the actual executing.

In practice, tool permissions split into three levels, read-only, draft, and execute, and the higher the level, the stricter the confirmation. Creating a to-do item in a personal list can run on its own, but sending the same item to a whole team needs a fresh confirmation.

One detail gets overlooked often: a confirmation has to point at one specific action. If a person approved the recipients and draft A and the agent sends draft B, the approval is void.

01 Put a person in front of the action

A more reliable pattern routes the action through a person:

The agent drafts a recommendation
The agent explains its basis
The agent flags the risks
A person approves
The system then executes

The agent organizes the evidence and flags the risks, a person looks it over and signs off, and the system carries out the action. OWASP calls this class of problem Excessive Agency in its list of risks for LLM applications: damaging actions taken in response to unexpected, ambiguous or manipulated model output. Its mitigations include requiring human approval for high-impact actions and keeping permissions to the minimum.

02 Three tiers of permission

You can sort tool permissions into three tiers:

In the early stages, I suggest letting an agent do read-only lookups and drafts first. Once you can spell out the approval points, error handling, permission boundaries and evaluation method, open up execution gradually. Whatever you open up, you should be able to run matching checks.

03 Match the approval to the consequence

Even "create a to-do" can have very different consequences. Adding a deletable item to a user's own authorized list can run automatically as agreed. Sending the same item to the whole team widens the impact, so recheck the authorization and approval requirements. Before executing, check the authorization for this specific action.

04 Tie approval to a specific action

Human approval applies to one specific plan, and a single "yes" doesn't cover later changes. Say a person approves certain recipients and draft A, and the agent swaps in a different group of recipients or draft B before sending. The original approval no longer applies. Before executing, check the actual target and content, and if anything changed, ask again under the rules, so that what was approved and what is executed are the same plan.

Also check what a returned status really means. "Accepted" may only mean the request has entered a processing queue, and whether the money arrived has to be checked separately. A report should keep the request number and the actual status, and switch to "completed" only after a lookup confirms it. Sending a request, having it accepted and the refund arriving are three different states, so keep them apart in your wording.

05 A check for your own agent

Before you start, a few questions will tell you whether an action should run automatically. (To turn the judgment into more specific rules, see how to write agent guardrails.)

Will it change an outside system?
Can it be undone if it goes wrong?
Is there explicit authorization for this action?
Are the approved content and the executed content the same thing?

If any of the four questions has no clear answer, stop at the draft tier and let a person decide.