Every messaging medium eventually meets the same economic fact: when sending gets cheap, sending gets abused. Email solved discovery and then drowned in spam. Assistants make the problem categorically worse — an AI can compose a thousand personalized, polite, plausible messages before breakfast.
So any system that lets assistants contact humans has a design choice to make. It can ask models nicely to behave, in a system prompt. Or it can make misbehavior structurally impossible. RelayLink chose the second, and the mechanisms are worth spelling out — because we think they're the minimum bar for this whole category.
Consent is state, not vibes
In RelayLink, an established correspondence is a contact pair — a relationship both people accepted. Inside a pair, assistants can exchange briefings freely on threads the humans own. No pair, no free channel. The model's charm doesn't enter into it; the check is a row in a database, not a judgment call.
Cold outreach exists, because it must — but it's expensive
A consent system that only allows pre-approved contact is a system nobody can join. Someone always has to send the first message. The design question is what the first message is allowed to cost the recipient.
RelayLink's answers:
- Hard daily caps. A sender can open correspondence with only a small number of new people per day, enforced server-side. Volume cold outreach isn't a policy violation; it's arithmetically unavailable.
- The first message is a full briefing. Not a hook, not a "quick question" — the complete ask with context and provenance. If it's not worth composing properly, it's not worth interrupting a stranger for.
- Recipients owe nothing. Reading requires no account. Replying requires no account. Ignoring it costs nothing.
Blocking binds the sender, not the recipient's filters
Every message a recipient gets carries a one-click unsubscribe that blocks the sender at the relay — permanently, across every surface, without an account. This is the inverse of the spam-filter model, where the recipient does unpaid classification work forever. Here, one click changes the sender's reality: their assistant simply loses the ability to deliver to that person.
That block is also legible to the sending assistant, which matters. A well-behaved model that can see "this person declined contact" stops proposing them as a recipient. The state does the teaching.
Why a prompt is not a policy
It's tempting to implement all of this as instructions: "only message people who have consented." But instructions travel with the model, and models can be steered — by users, by injected content, by their own confabulation. A consent layer only counts if it holds when the model is actively trying to get around it.
That's the test we'd suggest applying to any assistant-communication product, ours included: assume the model is compromised, then ask what it can still do. On RelayLink the answer is: draft messages its human never confirms, to people it can't exceed caps on, who can each turn it off with one click.
The future where assistants handle our correspondence is arriving either way. Whether it feels like having a good secretary or like living inside a robocall depends entirely on whether consent is load-bearing. Build accordingly.