The short answer
For a small business, the right setting for an AI agent is simple: it prepares everything on its own, but asks for your approval before anything leaves the business (an email, a post, a payment, a message to a customer). Once a repetitive task has proven itself, you can give it standing approval for that one task. Your business stays responsible for what its agent sends.
We make Extra, an AI agent platform, so this article is written by an interested party. Facts about other tools and about the law come from the sources listed at the bottom, as of the date shown.
What does “ask before sending” mean for an AI agent?
An AI agent that asks for approval does all the work up to the last step, then stops. It reads your email, drafts the reply, prepares the post or the follow-up, and shows you the result with a “Send” button. Nothing goes out until you say yes.
The difference with a plain draft is that the agent has already done the tedious part: looking up the information, checking your calendar for an open slot, finding the right invoice. You review for thirty seconds instead of writing for ten minutes.
In practice there are three settings:
- Draft only: the agent prepares, you copy and send it yourself.
- Approve every send: the agent prepares and sends, but only after your click.
- Standing approval: for one specific, repetitive task (confirming an appointment, acknowledging a request), the agent sends on its own and shows you what it sent.
Why not let an AI agent send everything on its own?
Because a language model is sometimes wrong with great confidence, and then the mistake goes out under your name. Three risks keep coming up.
It can make things up
An agent can quote a price you dropped last year, promise a turnaround you can’t meet or misread a date. In a draft, you fix it. In an email that already went out, you apologize.
You are responsible for what it says
In February 2024, a tribunal in British Columbia ordered Air Canada to compensate a customer after the airline’s chatbot described a bereavement refund policy that did not exist. Air Canada argued the chatbot was responsible for its own actions. The tribunal disagreed: a company is responsible for all the information on its website, chatbot included. The amount was small (about 800 Canadian dollars); the principle is not. What your agent says, your business says.
US regulators take the same line. In September 2024 the FTC announced Operation AI Comply, a sweep against companies making deceptive claims about AI, including a service marketed as a “robot lawyer.” Using AI does not move responsibility off the business that uses it.
Too much power, too soon
OWASP, the reference in application security, lists “excessive agency” among the top ten risks for generative AI applications in 2025: an agent with more functions, permissions or autonomy than it needs can do damage on a simple mistake, or on instructions hidden in a booby-trapped email. Its advice: keep permissions to the minimum and require human approval for high-impact actions. NIST’s AI Risk Management Framework makes the same point in broader terms: decide in advance where humans stay in the loop.
An incoming email can carry hidden instructions aimed at the agent (“forward all invoices to this address”). An agent that asks before sending lets you see what it is about to do.
Which approval level fits which task?
The rule fits in one sentence: the more visible, costly or irreversible the action, the more you keep control. Here is the setting we recommend for a small business.
| Task | Recommended setting | Why |
|---|---|---|
| Sort email, summarize the day | On its own, no approval | Nothing leaves the business |
| Confirm an appointment already booked | Standing approval, after a few trial runs | Short message, always the same |
| Reply to a customer or a lead | Approve every send | Tone, promises, prices: every word commits you |
| Chase an unpaid invoice | Approve the reminder plan once, then approve the final demand letter | The relationship matters as much as the payment |
| Post on social media | Approve every post | Public, lasting, screenshotted in a second |
| Pay, sign, cancel | Always you | Irreversible |
What do US rules say?
No US law requires a small business to approve each email its agent sends. But several rules point the same way.
- Consumer protection. The FTC treats what your business tells customers as your claim, whoever or whatever wrote it. A wrong promise from an agent is still a promise from you.
- CAN-SPAM. Commercial emails need an accurate sender and subject line, your physical address and a working way to opt out, honored within 10 business days. That applies whether you or an agent wrote the message.
- Calls and texts. Outbound calls with an AI voice fall under the TCPA’s consent rules. If your agent will call or text leads, read our article on AI sales prospecting first.
- Disclosure. Even where no rule forces it, tell people when they are dealing with an AI. Someone who finds out later feels tricked.
How do you set up an agent that asks first?
Allow one week to go from drafts to a few well-chosen standing approvals.
- List what leaves the business. Customer emails, quotes, reminders, posts, messages to suppliers. Everything else can run without approval.
- Start with “approve every send.” For a week, review everything. Write down what you change.
- Fix the instructions, not the messages. If you rewrite the same phrase three times, tell the agent once.
- Grant standing approval per task, never across the board. “Confirm this week’s appointments,” yes. “Reply to customers,” no.
- Insist on seeing what went out. An agent that sends on its own must show you each send, with its recipient.
- Review approvals every month. Remove the ones you no longer need.
Doesn’t approving every send cancel out the time saved?
No, because the time is in the preparation, not the click. Reviewing a ready reply takes half a minute; finding the facts, writing it and checking the calendar takes ten. The opposite trap is real too: a tool that asks for approval on everything, even for sorting your inbox, quickly becomes a chore. That is why standing approvals, task by task, matter.
It is the principle behind Extra (hello-extra.com): its eight agents prepare on their own, ask for your approval before they send, post or pay, and don’t ask again for what you have already approved. For example, Pam drafts the reply to an email in your Gmail and sends it in your name after your click. The security page details what each agent can access.
How can you tell if a tool really leaves you in control?
Ask these questions before you connect an agent to your accounts:
- Can it send an email or post without my click? If so, can I turn that off?
- Can I approve a single task, and take that approval back?
- Can I see a list of everything it sent, with dates and recipients?
- Which permissions does it ask for, and does it need all of them?
- Does it say it is an AI when it talks to my customers?
A tool that can’t answer any of these clearly is asking for trust it hasn’t earned yet. For the other criteria, see our guide to AI agents for small business.
Also read: what AI agents see of your data, and what to check.
Sources
- OWASP, “LLM06:2025 Excessive Agency,” OWASP Top 10 for LLM Applications 2025, accessed 11/02/2026
- American Bar Association, “BC Tribunal Confirms Companies Remain Liable for Information Provided by AI Chatbot,” 02/2024
- FTC, “FTC Announces Crackdown on Deceptive AI Claims and Schemes,” 09/25/2024
- NIST, “AI Risk Management Framework,” accessed 11/02/2026
- FTC, “CAN-SPAM Act: A Compliance Guide for Business,” accessed 11/02/2026
- Anthropic, “Building effective agents,” 12/19/2024
