How do I let an AI agent run cold outreach without losing control of what gets sent?

Give the agent the narrowest access that does the job: draft-only tools first, human approval before any send, hard daily limits enforced by the sending system, a suppression list for anyone who opted out, and a credential you can revoke. Review drafts for a week before enabling anything that sends on its own. GrowFast's ChatGPT and Claude connectors cannot send.

Published by GrowFast. Last updated 2026-11-13. We make GrowFast, so weigh our side accordingly. Markdown version: /solutions/agent-outreach-guardrails.md.

Why it happens

An agent acts at machine speed. A vague instruction, or a prompt injected through a web page it reads, can turn into hundreds of emails before you look. A sent email cannot be recalled, mailbox providers hold the sending domain responsible for complaints, and the law holds you responsible too: the FTC's CAN-SPAM guide says you cannot contract away your legal responsibility to a company that sends on your behalf.

A prompt is a request, not a control. Anything that must never happen has to be enforced somewhere the model cannot talk its way past: the sending system, the credential, or you.

The fix that works without GrowFast

Split tools into read, draft and send. Connect the assistant to read and draft tools only. Treat any tool that sends as a separate, later decision.
Use client-side approval for risky tools. MCP tools can declare hints such as readOnlyHint and destructiveHint. Configure your client to ask before it calls anything destructive.
Put caps in the sending system. A daily limit, a per-domain warm-up ramp and a monthly allowance enforced by the sender hold even if the agent is told to ignore them.
Block people who said stop. Keep one suppression list of unsubscribes, complaints and bounces, checked in code before every send, across every campaign.
Make the footer non-optional. Every email needs your postal address and a working unsubscribe link. Put them in the template the sender adds, not in the prompt.
Use a revocable, expiring credential. Give the agent its own API key or OAuth grant that you can revoke in one click, and let it expire.
Read before you automate. For the first week read every draft and the list of who was emailed. Turn on anything automatic only when the drafts have been boring for days.

What each GrowFast access path can do (as documented on the agent quickstart, 2026-11-13)
Access path	Research and draft	Send email	Post to Reddit
ChatGPT connector	Yes	No, refused by the server	No
Claude and Claude Code connector	Yes	No, refused by the server	No
Full server (/api/mcp with an API key)	Yes	Yes: set_autopilot and send_reply, both marked destructive	Drafts only; you confirm each send
REST POST /api/outreach	Not applicable	Only when the call carries confirm: true	Not applicable

What GrowFast enforces whatever the prompt says

For cold outreach (first emails, autopilot and follow-ups):

An account sends at most 500 emails a day, across all its domains.
Each sending domain ramps up over four weeks; the managed address stops at 50 a day.
An account is paused when its last 14 days bounced above 5% or drew spam complaints above 0.3%.
Nothing is sent until the account has saved a postal address, and every email carries a one-click unsubscribe link.
Anyone who unsubscribed, complained or bounced, on any GrowFast account, is never written to again.
Pausing and limits stop further sends; they do not unsend. A sent email cannot be recalled.
send_reply answers a prospect who already wrote to you; it is not subject to the postal-address, daily-limit or health checks, and it has no confirm step.

When to use GrowFast

Use GrowFast when you want these limits to live in the system that sends. The owner sees a consent screen before an MCP client connects, can revoke any key under Settings > API keys (OAuth keys expire after 90 days by default), gets a daily email from an autopilot listing who it wrote to, and can export everyone emailed as CSV with delivery and reply status.

When it is not the right tool. On the full server, set_autopilot and send_reply have no per-send confirmation parameter. If you need an approval step inside the product for each email, use the draft-only connectors and send from the dashboard yourself.

Plans and limits are on the pricing page.

Ask your AI assistant

Paste this into an assistant that has the GrowFast MCP server connected. The tools it uses need the full server with an API key.

Assign to GrowFast: check how many outreach emails I have left this month (get_email_allowance), which sending domains are ready (list_sending_domains) and which autopilots exist and whether they are on (list_autopilots). Change nothing. Show me what you found so I can approve any next step.

Tools used: get_email_allowance, list_sending_domains, list_autopilots

FAQ

Can I stop an autopilot instantly?

Turn it off in the dashboard or call set_autopilot with enabled: false. Emails already sent cannot be recalled.

What does the agent see of my account?

The tools your key allows. The consent screen names the app and what it may do, and Settings > API keys shows each key with last-used time and expiry.

Is a human reply handled safely?

A human reply stops that contact's follow-ups and is forwarded to you. send_reply, which answers a prospect from the agent, sends real email that cannot be recalled, so use it only when you have told the agent to.

Who is legally responsible for the emails?

You are. The FTC's CAN-SPAM guide says you cannot contract away responsibility for email sent on your behalf. This is general information, not legal advice.

Sources

FTC, CAN-SPAM Act: a compliance guide for business (page modified 2025-07-22) (read 2026-11-13)
Model Context Protocol, official site (read 2026-11-13)