How Do I Make an AI Agent Wait for My Go-Ahead Before It Sends Anything?

One of the things I like to do with my AI agents is give them guardrails. I tell them what they can do and what they can't do (41:26). If you run a team, a program or a donor list, the same habit applies if you want an AI agent that drafts and does not send, book or post on its own. In the session on October 7, 2026, built on Gumloop, I showed where the platform lets you set that for Gmail, and the instructions file on the session page shows the written version of the same rule.

I told the group this about my relationship with the platform in the same session:

From the recording, 33:22. I don't work for Gumloop. I found this tool over the summer through Lenny's podcast, and I started using it and have since made myself an ambassador for them. I've created a relationship with Gumloop. I am not an employee.

Where in the connector can you restrict sending?

The steps are as shown October 7, 2026. Screens change, so your account may look different.

1. 01

   Open the connectors section and click Gmail. A new screen opens.

2. 02

   Find tool management and select read only tools. I said there are six options under it (44:05).

3. 03

   Look beneath that section for the write/delete tools. I named four actions there: sending emails, updating, creating drafts and forwarding emails.

On the read side I said I can restrict or give permission to the AI agent on what I wanted to read only (44:07). On the write side:

From the recording, 44:19. I can then give permission or restrict access to sending emails, updating, creating drafts, forwarding emails, et cetera.

Checked on 2026-11-05 against Gumloop's Agents documentation, whose Tool Management panel controls which of a connector's tools the AI agent can call and which ones need your approval first. It groups a connector's tools into read-only tools and write/delete tools, and lists the presets Always allow, Ask each time, Ask for writes/deletes and Custom. In the recording I name the two groups and the four write actions. The documentation adds the presets.

What does the instructions file say about sending?

The second place is the instructions themselves. The Chief of Staff file on the session page puts the rule in writing, under the heading "What you never do". It is a reminder to the AI agent; the tool setting above is the guard:

You never send an email. Every reply is a draft, saved as a Gmail draft, never sent, until I say the words "send it" in that exact turn. You never create or move a real calendar event on your own. You propose a hold or a reschedule, and I confirm it before it becomes real, unless I say "add it" in that exact turn.

The same list covers deleting, responding to invites and posting outside the chat. The file also says where the answers go:

Everything stays in this chat and in draft form, whether that's a Gmail draft or text in this window. You never claim to have sent, scheduled, or deleted anything outside this chat unless I told you to in that exact turn and you're reporting that it's done.

I described the habit behind it in the session:

From the recording, 41:32. I tell them what they can do and what they can't do.

I said that is just as important as telling the AI agent what you want it to achieve (41:35).

What does a permission worksheet look like?

The cells are blank because the decisions are yours. The source column says where each action comes from: the toggles I named on October 7, 2026, or the lines in the file on the session page.

| Action | Where it comes from | Your decision | | --- | --- | --- | | Read mail | Read only tools, six options (my words) | | | Send an email | Write/delete tools; file line 45 | | | Update | Write/delete tools | | | Create a draft | Write/delete tools | | | Forward an email | Write/delete tools | | | Create or move a calendar event | File line 46 | | | Delete anything | File list of what the AI agent never does | | | Respond to a calendar invite | File list of what the AI agent never does | | | Post or message anyone outside the chat | File list of what the AI agent never does | | | The words that count as a yes | File uses "send it" and "add it" | |

How does the same rule read for donor email?

My published Insight on nonprofit AI governance sets the same stopping rule for a donor-facing AI agent: nothing sends without a human yes. In it I describe my Sprint Philanthropy AI Agent, which drafts the next donor outreach grounded only in what it was told about that donor, and which never sends anything. I also write there that a donor who discovers the note they replied to was sent without a person reading it has learned something about how your organization values them.

Below is a slot swap of the sentence shape in the file on the session page. Example, replace with yours:

``` You never send a donor email. Every [message type] is a draft, saved as a draft, until I say the words "[your phrase]" in that exact turn. ```

The pipeline version of the same idea is in how to automate donor pipelines.

What goes wrong

From the session page and the recording:

• A connector added without the approval rule first. The session page says an AI agent with an inbox connector and no rule can send a draft you did not read. For connectors added later, from your own account, the page says to add the approval rule first, so every send asks you.
• Instructions that update themselves. I said to read the instructions on a schedule if you give the AI agent access to auto update:

From the recording, 43:10. Put a reminder on your calendar at a frequent cadence to go in and read agent instructions.

What the recording does not show: the six read options named one by one, any toggle being switched, or a send attempt being refused. I named the groups and the four write actions, then moved to switching the Gmail account.

Where this comes from

This article grows from the session I taught live with Women Applying AI on October 7, 2026. The quoted passages are my own words, taken verbatim from the recording or from the Chief of Staff instructions file on the session page. The worksheet, steps and tables around them were drafted by my team's AI agents from those words and my published pages, and checked against the recording before publishing. Screen steps are dated as shown October 7, 2026.

Build Your First AI Agent in One Hour: the full session with the clips, the prompts and the transcript. The file is on the session page.

Related reading: How Do You Control What an AI Agent Can Do in Your Gmail?, What Are AI Agent Guardrails?, Nonprofit AI Governance.