What sits between the model deciding to message someone and the message leaving?
Ask it while a message is on the screen and nobody has clicked yet. Somewhere in the demonstration the agent will compose something addressed to a real person, and the salesperson will pause on the draft, because the draft is the impressive part. Use the pause. Point at the send button and ask what runs in the gap between the agent choosing to send and this landing in somebody’s inbox. You are asking about the seconds nobody has ever shown you.
The gap has a size
The model chooses the words and the recipient. Something else decides whether the sending happens. That something is either a named sequence of checks or it is nothing at all, and there is no third arrangement.
The Cabinet, ArkOne’s reference design for an executive agent, calls that sequence the Door, and every check in it runs in code after the model has finished deciding. The recipient must be someone already on the roster, never an address the model composed. Nothing goes out while a person is on leave or outside their working hours in their own time zone. No more than five messages reach one person in an hour. Anything near-identical to something sent to that person in the past six hours is refused. When a check refuses, the reason goes back to the agent so it can reschedule rather than retry blind. The Register carries each of these as a value, including the awkward one: if the Door itself errors, the message goes and the fault is written down, on the reasoning that a check which fails closed makes an outage look like a quiet afternoon.
Six checks on one reply
Suppose the reply on the screen is going to a supplier who wrote forty minutes ago, in a scenario invented for the exercise. Here is the sequence a well-built design runs.
| Order | The check | On this message |
|---|---|---|
| First | Is the recipient a person on the roster | Yes, and so is the colleague copied |
| Second | Are they inside their working hours | Yes, late morning where they are |
| Third | How many have they had this hour | One, forty minutes ago |
| Fourth | Is this near-identical to something recent | Yes. Refused |
| Fifth | Is the agent told why | The duplicate rule, named, with the earlier message |
| Sixth | What if the checks themselves failed | Not reached; the checks answered |
Exhibit 1. Illustrative. One outgoing reply, and the checks a well-built design runs on it in order before anything leaves.
The fourth row is the one that saves you an apology. An agent reaching the same sensible conclusion twice is normal. An agent saying it twice to the same person inside an hour is the thing your supplier remembers about the whole arrangement.
The fifth row is the one that separates a designed system from a bolted-on filter. An agent told only that the send failed will try again. An agent told which rule refused and why can do something else instead, and in this scenario it writes one short line to the colleague alone.
Walking the checks, or describing intentions
The reply worth hearing walks the checks in order, unprompted, and can point at where each value is set. Follow it by asking to watch a refusal happen live: the agent wanting to send, something declining, the reason appearing on the screen.
Where none of that has been built, the conversation goes one of two ways. Somebody says a human approves everything, which is a real control and a different one, worth testing by asking what happens on the day the approver is on a flight. Or somebody says it will not spam anybody because it has been told not to. The follow-up for both: what stops it, in code, from sending the same person the same thing twice in one afternoon, and can you show me the rule?
Then the last one, which most vendors have never been asked. When the checking machinery itself fails, does the message go or does it stop? Both answers are defensible. Only one of them should surprise you at three in the morning, and it should be your choice which.
What the gap is worth
Everything else about an agent is recoverable in some fashion. This gap is where the unrecoverable things pass through, one at a time, at whatever rate somebody set. Every rule in that sequence, and the argument for each value, is set out in the Cabinet paper on the Door. Why this particular gap deserves its own controls is the question before this one.
Asked plainly
What checks should run before an AI agent sends a message?
At a minimum: the recipient is a named person the system already knows rather than an address the model composed, the person is at work rather than on leave, a limit on how many messages reach one person in an hour, and a rule refusing anything near-identical to something sent recently. All of them run after the model has decided and before the message leaves.
Can an AI agent message my whole company by mistake?
Only if it is able to form an address for your whole company. A design that will send only to named people on a roster it was given has no route to a group address, so the failure is not prevented by good behaviour, it is unavailable. Ask which arrangement you are buying.
How do I stop an AI agent messaging someone twice about the same thing?
With a duplicate rule that runs on the way out and refuses a message closely resembling one already sent to that person inside a set window. Instructing the model to remember what it has already said is weaker, because a fresh conversation can start with no memory of the earlier one.