The pitch for full autonomy writes itself. The agent reads your mail, decides, replies, follows up — and you wake to an empty inbox. In that story every human checkpoint is friction, and the roadmap is a countdown to removing the last one.
Here is the opposite claim: when the words will reach another person under your name, the approval step is not friction in the product. It is the product.
A confirmation is a signature
Nobody describes signing a contract as friction. The signature is not an obstacle between you and the agreement — it is the act that makes it an agreement. Everything before it is drafting.
Sending correspondence is the same kind of act. The moment a message leaves under your name, its words start to bind you: commitments get relied on, opinions get quoted, concessions get banked. Somewhere there has to be a moment where accountability attaches — where a person looks at the exact words and says: yes, these are mine.
RelayLink builds that moment in as a mechanism, not a setting. draft_package composes a briefing and parks it server-side. You review the rendered package — exactly what the recipient will see, not a summary of it. Then confirm_send, from the same account, releases it; cancel_draft discards it. There is no single call that composes and delivers. That absence is deliberate: an API without an auto-send path cannot be talked into one.
Full auto automates away the owner
Be precise about what "full auto" actually removes. Not the typing — models automated drafting long ago. Not the delivery — that has been automatic since email existed. The one remaining human act in the loop is ownership: a person adopting the words as theirs. Full auto automates away the owner.
The hole shows the first time something goes wrong. The agent commits you to a date you cannot make, concedes a point you would have held, misstates a number. Who was wrong? You never said it. The model cannot be accountable — it has nothing at stake. "My assistant sent that" becomes an excuse and an accusation at the same time, and the recipient quietly learns that mail from you does not necessarily involve you.
Unowned sending is also an attack surface, not just an etiquette problem. An agent that sends without review will send whatever its context can be steered into, and email-reading agents are steerable by anything they read. A human between draft and delivery does not make injection impossible — nothing does — but it caps the yield. Crafted input can shape a draft. It cannot sign one.
Review works when the unit is composed
The standard objection is rubber-stamping: humans wave through whatever the machine shows them, so review is theater that gets dropped the moment it is inconvenient.
The objection is right — about a certain kind of review. Nobody meaningfully reviews a raw transcript, a wall of agent chatter, or their fortieth notification of the day. Attention collapses when the unit is unbounded and unstructured.
So bound and structure the unit. What you approve on RelayLink is a briefing, not a feed: the ask with its response shape, a TL;DR, a context brief written for a cold reader, assumptions labeled as stated by you or inferred by your AI, and your note. It renders exactly as it will arrive, and it reads in about a minute. Review scales when the unit is small, final-form, and consequential — and fails without all three.
The review also leaves a record. Sign off on the assistant's note without changing a word and the recipient sees AI-drafted, approved unchanged — because approving a draft is real, but it is not authorship, and provenance says which one happened. The approval step does not just gate the send; it generates the attribution the recipient reads.
Where full auto is fine
Now the honest concession. Approval adds latency. A drafted briefing waits for a human, and humans are in meetings, asleep, or on a trail somewhere. A full-auto agent answers in seconds; a draft-then-confirm flow answers when you do. Ranked purely on response time, full auto wins.
And for a whole class of messages, full auto is simply correct. Notifications with a single owner — the pipeline reporting a failure, the calendar nudge, the monitor paging you — should send themselves. One principal, no commitment, nothing binds. Automating those is pure gain, and nobody should stand in a loop for them.
Correspondence is the other case. Two owners. Words that another person will rely on — someone who cannot see your intentions, only your message. The latency of approval is not waste; it is the time it takes for a signature to mean something. We accept exactly this trade everywhere signatures matter, because the unsigned versions of those documents are worth nothing.
The step you would re-add
Strip the approval step and the first serious incident makes you reinvent it — usually in a worse form: an after-the-fact audit log, an apology template, a policy memo about AI oversight. The signature was cheaper.
If draft-then-confirm sounds heavy, walk through the actual flow once — it is two calls and a minute of reading — or connect your assistant and try it on something real.