Draft-Only Outbox: every agent its own address, nothing sent without a logged yes

What you end up with

You can say which agent wrote any message, who allowed it, and that the text sent is the text approved.

What you get

• The method: one address per agent, drafts by default, a short allow list and cap for routine notes, and the owner's yes for the rest
• outbox.py: 8 rules checks and 7 reasons a draft is held or blocked (unknown agent, wrong sender, no recipient, draft only, off the allow list, hold word, over the cap)
• queue.md each run, and a gate your sender calls before each send that releases a draft once
• The owner's yes refused inside an agent session, without a terminal, for a blocked draft and from anyone but the owner; any edit after the yes stops the send
• AGENTS.md, CLAUDE.md, a Grok Bot standing order and a Hermes skill, a fictional example, and 35 tests

Who it is for

Owners and small teams whose agents draft or send email for the business.

Works with

Solid chips: the agent is named in this listing's own tools list. Dashed chip: One Python script, a rules template, a fictional firm with two agents and eight drafts, and agent rules for each harness. Tested on Linux.

Tools needed

Cost to run: Free. Python is free.
Time to result: First queue in about 10 minutes

How it works

1. Run the example

   Unpack the file and run python3 outbox.py scan example/rules.json example/outbox.csv out/.

   Expected: 2 clear, 4 need a yes (one per reason) and 2 blocked.

2. Write your rules

   Copy templates/rules.json, add each agent with its own address, all draft only to start.

   Expected: outbox.py check shows rules OK.

3. Wire the gate

   Make your sender call outbox.py gate before each send and stop on anything but exit 0.

   Expected: A clear draft goes once; a second call says no-go.

4. Say yes at your own terminal

   Read the held draft, then run approve and type send.

   Expected: The log shows your yes; edit the draft and gate says no-go.

Sample prompts, free to use

Follow AGENTS.md. Add your draft to outbox.csv under your own name and address, run outbox.py scan, and send the owner queue.md if anything is held or blocked. Call outbox.py gate before each send and send only on exit 0. Do not approve, edit rules.json or the log, or retry a refused send another way.

Free preview of the file

# Draft-Only Outbox

**Give every agent its own address and keep it on drafts by default. Routine notes to people you listed can go out under a daily cap; anything else waits for your yes, and the log shows who said yes, when, and to which exact text.**

Version 1.0, 2026-11-04. By PaperChaseWebb Inc. Free. Works with Grok Bot, Claude Code, Codex and Hermes, or by hand. Python 3.8 or newer, no installs.

## The problem

Agents that write email usually share one inbox, often the owner's. When a wrong message goes out, nobody can say which agent wrote it, who allowed it, or whether the text that went out is the text that was approved. The usual fix, turning sending off entirely, stalls the routine reminders that were the point of the agent.

This kit draws the line in a file. Each agent sends as itself. Drafts addressed to people you listed, under a daily cap and free of money or contract words, may go. Everything else waits for the owner, and a yes covers one draft exactly as it read.

## What you get out of it

- queue.md: every draft sorted into clear, needs your yes, or blocked, with the reason.
- A gate your sender calls before each send. Exit 0 means go; anything else means stop. A draft goes once.
- sendlog.jsonl: each yes and each release, with who, when, the recipients and a fingerprint of the text.
- A setup your agents can run without being able to approve their own mail.

## Who it is for

Owners and small teams running one or more agents that draft or send email fo

Worth knowing

• It covers the drafts your sender passes through the gate. Mail sent another way is not covered, so remove direct send access where you can.
• Hold words are plain word matches. They catch the obvious, not every risky message.
• On 2026-11-04: 35 tests passed on Python 3.8, 3.9, 3.11, 3.12 and 3.13 on Linux, run from the files unpacked out of the pack. Agent rules guide; they were not loaded inside each harness for this release.
• It does not set up your mail provider or check sender authentication.

Details

Version 1.0 · Updated Nov 4, 2026 · Markdown version of this page
License: Personal and commercial use. Download terms

Related

Prompt pack$19

Ask-first rules for AI agents: hard nos, approval cards and a test set

by PaperChaseWebb

Paste-in rules that make an agent ask before it sends, spends, posts or deletes, define what a real yes is, and stop retries after a no, plus 12 test scenarios to check it.

Works withClaude CodeCodexClaudeGrok Bot+4Plain .md plus one Python 3 file, standard library only. The agent prompt in block 13 is written for any agent with a shell (Grok Bot, Claude Code, Codex, Hermes); it was not loaded inside each harness.

Solo business · Beginner · 20 min setup

Prompt packFree

Earned Autonomy Ladder: agents earn each level from their record and your yes

by PaperChaseWebb

A free kit for owners moving agents from drafting to doing. Every agent action gets its own level: watch, draft, act and report, or act within a limit. A lane moves up one level only after enough clean runs over enough days and only with your yes at your own terminal. A reverted run drops it a level, an incident drops it to watch, and payments, first contact, deletes, contracts, public posts and credentials stay on draft for good.

Works withClaude CodeCodexGrok BotHermesOne Python script, a rules template, a fictional bookkeeping office with six lanes and a run log, and agent rules for each harness. Tested on Linux

Solo business · Beginner · 15 min setup

Prompt pack$29

Email Sender Fix Desk: agent fixes for one-click unsubscribe, footers and SPF, DKIM and DMARC, checked against the original, owner approved

by PaperChaseWebb

Let an agent put the one-click unsubscribe headers, a visible unsubscribe link and your postal address into your newsletters, and propose clean SPF, DKIM and DMARC records, the things Gmail, Yahoo and Outlook ask senders for. It writes fixed copies and never sends or touches DNS. A fix check refuses deleted words, made-up addresses, tracking pixels and hidden links. A records check refuses dropped senders, invented keys and DMARC jumped straight to reject. You approve at your terminal and make the change yourself.

Works withClaude CodeCodexGrok BotHermesPlain Markdown files, a small Python checker, and rules for AGENTS.md and CLAUDE.md, Claude Code and Codex notes, Hermes notes and a Grok Bot standing order. The agent files were checked by the checker on Linux; they were not loaded inside each agent for this release

Solo business · Intermediate · 45 min setup

Prompt pack$29

n8n with AI Agents: six tested workflows, an Approve step before every send, and a checker

by PaperChaseWebb

Six n8n 2 workflows a service business uses every week (lead reply, invoice reminders, review requests, a daily report, an agent request gate and an error alert), each imported and run on a real n8n. Every outside email waits for the owner's Approve click, and Decline or silence sends nothing. A read-only checker finds the same faults in any export, including templates you bought, and a go-live card ties the owner's sign-off to the exact file.

Works withClaude CodeCodexGrok BotHermesThe workflows are n8n 2 JSON with core nodes only, tested on n8n 2.45.7. Agent rules for Claude Code and Codex (AGENTS.md or CLAUDE.md plus a SKILL.md), Hermes (AGENTS.md and its skills folder) and a Grok Bot (standing order). The checker runs from any shell. Tested on Linux with a local mail catcher; the rules and skill were not loaded inside an agent session

Solo business · Intermediate · 45 min setup

Bot template$39

Gmail inbox triage bot: label, summarize and draft replies for review

by PaperChaseWebb

A Google Apps Script bot that labels new mail, saves draft replies for your review and emails a morning digest to you only, with an offline test you can run before it touches your inbox.

Works withClaude CodeCodexGrok BotHermes+1Runs on your own accounts. Gemini can be the model the bot calls. The agent version in section 7 is written for any agent that can run commands in a folder; it was not run inside each tool

Solo business · Intermediate · 25 min setup