Open any chat tool and paste: 'Write a 5-step approval workflow before an AI agent may send external email. Step 5 must be human send.' You're done when step 5 is, in fact, a human sending it.
How-to · AUT · AUT.4
X-style: agent that emails — blast radius
If an agent can send email, blast radius is real — last step must be human send.
Worked example
If an agent has the power to send email, its blast radius is the feature that could actually get you fired. Human-in-the-loop isn't optional theater — it's the safety net.