Autonomy is a setting, not a queue.
Every mailbox starts fully autonomous. Turn one down, and its first emails to new contacts, or all of its emails, wait for a person to approve them.
Three levels, per mailbox.
Level 3 sends on its own, and it's where every new mailbox starts. Level 2 holds the first email to anyone the mailbox hasn't talked to before. Level 1 holds every email.
L3 sends on its own (default) · L2 holds first contact · L1 holds every send
A held send waits for you.
Your agent gets pending_approval back instead of a delivery, and the email waits for someone on your team to approve or reject it. If nobody does within 24 hours, it expires unsent.
send_email({ to: "new@lead.io", … }){ "requestId": "9b1e…", "status": "pending_approval", "reason": "autonomy_level"}Your agent can ask. It can't approve.
Approving is a person's decision. When your agent needs one, request_decision hands it a link to pass on to you. It never approves on its own behalf.
request_decision({ kind: "send", id: "5c07…" }){ "error": "human_decision_required", "decisionUrl": "…/app/decide/send/5c07…"}Only a person turns it back up.
An agent can lower its own mailbox's level whenever it likes. Raising it loosens a control, so that change goes to you.
$ molted mailboxes autonomy set 4f2c… \ --level 3{ "error": "human_decision_required", "loosens": ["autonomyLevel 1 -> 3"]}More features.
- Prompt injection protectionInbound mail is scored for injection before your agent reads it, and the messages that try to take over are quarantined.
- Rules and guardrailsDuplicates, cooldowns, suppressions and daily limits are checked on every send. Your agent can tighten them, never loosen them.
- Inbox and handoffThreaded conversations your agent reads and answers, and a handoff to a person when a thread needs one.
- Multi-agent coordinationLeases stop two agents emailing the same person at once, and every agent shares one set of checks.
- Real-time eventsDeliveries, bounces and replies arrive as events, over a stream your agent holds open or signed webhooks.
- MCP, CLI and RESTThe same product over a hosted MCP server, the molted CLI and a REST API, for Claude Code, Cursor, Codex or your own code.
- HumanizerOff unless you turn it on. When it's on, a model rewrites each templated email in the tone you pick.
Hand it to your agent.
It sets up its own inbox. You decide how much it does on its own.