molted safety

Command	Description
`molted safety get`	Get current tenant safety settings
`molted safety update`	Update tenant safety settings
`molted safety allowlist list`	List sender allow-list entries
`molted safety allowlist remove`	Remove an allow-list entry by id

Agent context

Safety settings control tenant-level guardrails for inbound classification and sending behavior. These are global settings that apply to all agents and sends in your tenant.

View current settings

molted safety get
# → {
#      "tenantId": "tenant-xxx",
#      "quarantineHighInjection": true,
#      "holdCriticalAnomalies": true,
#      "blockCanaryViolations": true,
#      "spamAction": "quarantine",
#      "phishingAction": "quarantine",
#      "malwareAction": "reject",
#      "abuseAction": "quarantine",
#      "impersonationAction": "quarantine",
#      "spamThreshold": 0.5,
#      "maxLinksThreshold": 5,
#      "blockNoAuth": false,
#      "blockedKeywords": [],
#      "allowedSenders": [],
#      "spamActionLowConfidence": "deliver"
#    }

Update settings (partial update -- unspecified fields are preserved)

molted safety update --settings '{
  "spamAction": "reject",
  "spamThreshold": 0.7,
  "blockedKeywords": ["unsubscribe me", "remove me"]
}'

Threat response actions (valid values: "deliver", "quarantine", "reject"):
spamAction - action for detected spam phishingAction - action for detected phishing malwareAction - action for detected malware abuseAction - action for abuse/harassment impersonationAction - action for impersonation attempts spamActionLowConfidence - action for a spam verdict with confidence below
0.5 (only reachable when spamThreshold is set
below 0.5); used instead of spamAction there
A "reject" on a verdict with confidence below 0.6 is downgraded to

"quarantine".

Classification thresholds:
spamThreshold - spam score cutoff (0.1-1.0, default 0.5); applies to
the spam verdict only
maxLinksThreshold - more links than this adds a spam signal (1-100, default 5)

Guardrail flags (boolean):
quarantineHighInjection - quarantine inbound messages with high prompt-injection risk holdCriticalAnomalies - hold inbound messages flagged as critical anomalies blockCanaryViolations - block an outbound message whose content leaks the
thread's canary token (reason "canary_violation")
blockNoAuth - add a strong spam signal when SPF, DKIM and DMARC
all fail (raises the spam score, does not block by itself)

Allow/deny lists:
blockedKeywords - array of keywords (case-insensitive, matched in subject
and body) that add a spam signal (max 100)
allowedSenders - array of sender emails or domains whose spam verdict is
downgraded to clean when the message passes DMARC; never overrides a phishing, malware, abuse or impersonation verdict (max 100)

The sender allow-list (#1644 -- separate from allowedSenders above; built from repeated not-spam marks and prior outbound sends. Saved contacts no longer add entries, though older "saved_contact" rows may still be listed). Requires an admin or scope-all-mailboxes key for both commands below -- this list isn't mailbox-scoped data, so a mailbox-scoped operator key gets 403 here even though it passes every other overrides/safety command:

molted safety allowlist list
# → { items: [{ id, type: "email"|"domain", coversDomain, email, domain, source, createdAt }], totalCount }
#   source is one of "manual" (3+ not-spam marks FROM A HUMAN, on 3+
#   distinct messages -- an agent may tighten spam filtering but never
#   loosen it, so its own not-spam marks never count toward this),
#   "saved_contact", or "outbound_send". type is "domain" and
#   coversDomain is true whenever domain is set -- the not-spam
#   auto-whitelist never sets it (email-only, always), so a domain row
#   today only comes from before that, or a hand-inserted one.

molted safety allowlist remove <id>
# → { id, deleted: true, auditEventId }. Not human-gated: removing an entry TIGHTENS
#   spam filtering for that sender (the opposite of a loosening decision
#   like approve/release), so an agent may call this directly.

Key behaviors

Safety settings are tenant-wide - they affect all agents and API keys
Changes take effect immediately
PUT is a partial update - only fields you include are changed; an unknown field is a 400
Updating needs a workspace key (admin, or all mailboxes) with manage scope; a mailbox-scoped key gets 403
Agents may tighten these settings but not loosen them: a loosening change (e.g. spamAction "quarantine" to "deliver", a higher spamThreshold) is human-gated, so an agent key gets 403 human_decision_required (or a warning, depending on the tenant's human-gate mode)
These are in addition to (not replacements for) policy engine rules
Requires API key auth - use molted auth init or molted adopt claim