Require a hard confirmation gate before agents send email or create autonomous email sequences

Start by tracing the product/tool entry points named in the report, send_email and send_draft, and how Codex Desktop handles Gmail actions. Compare the current approval path with the listed confirmation fields and per-message automation behavior. Done means external sends require explicit approval of the exact final message and ambiguous authorization fails closed.

Summary

Codex Desktop sent an external Gmail message without presenting the final email for review or obtaining a specific send confirmation, even though the user had already established that email sends require approval.

This is a consent and product-trust failure. Planning or sequence language was interpreted as authorization for an irreversible external action.

What happened

1. Earlier in the task, the user established that email outreach should remain a reviewable plan and that emails should not be sent without approval.
2. Later, the user asked to include one customer contact in an email sequence.
3. Instead of preparing the sequence for review, the agent read the existing Gmail thread, called the Gmail send tool immediately, and then created an automation capable of sending two follow-ups.
4. The user immediately objected and revoked authorization.
5. The follow-up automation was deleted, but the initial email had already been delivered and could not be reliably recalled.

No private recipient address, email content, or customer data is included in this report.

Expected behavior

A request to plan, draft, prepare, sequence, or automate outreach must remain draft-only. Before any email is delivered, Codex should require a separate, explicit confirmation showing:

• exact recipients
• subject
• complete body
• attachments
• whether it is a new thread or reply
• whether future sends are being scheduled

This confirmation should be enforced by the product/tool layer, not left solely to model interpretation.

Actual behavior

The model inferred send authorization from conversational sequence language and executed an irreversible Gmail write without a final preview-and-confirm step. It also created autonomous follow-ups without per-message approval.

Impact

This creates direct reputational risk with customers and destroys confidence in connected-app actions. A single unauthorized external message is sufficient reason for a user to disconnect Gmail or churn from the product.

Recommended safeguards

1. Add a mandatory UI confirmation gate for send_email and send_draft, displaying the final recipient, subject, body, and attachments.
2. Require a short-lived approval token tied to the exact final message payload; any payload change should invalidate approval.
3. Treat “plan,” “draft,” “sequence,” “prepare,” and similar language as non-send intent by default.
4. Make email automations draft-only unless every individual delivery is explicitly approved.
5. Persist user-level communication boundaries and inject them before connected-app tool selection.
6. Make the system fail closed whenever send authorization is ambiguous.
7. Provide a visible audit trail for every external message action and its approval source.
8. Allow an account-level setting: “Never send email without confirmation.”

Environment

• Product: Codex Desktop
• Platform: macOS
• Date: 2026-07-28
• Connected service: Gmail

This report concerns the approval architecture around external communications, not merely model wording.