Rules your agent can't talk its way around.
Every send is checked before it leaves: duplicates, cooldowns, suppressions and daily limits. Your agent can tighten these rules. Only a person can loosen them.
No double sends.
A dedupe key is only ever sent once. The same template to the same person from the same mailbox waits out a cooldown, 10 minutes unless you change it. Replies inside a thread skip the cooldown, so conversations aren't throttled.
dry_run({ to: "priya@acme.com", template_id: "welcome" }){ "wouldAllow": false, "reason": "cooldown", "cooldownExpiresAt": "2026-09-26 14:32:07+00", "simulation": true}Bounces and complaints stop the next send.
A hard bounce or a spam complaint suppresses the address at once, and three soft bounces in 30 days do the same. You can suppress a whole domain too. Every agent on your account works from the same list.
hard bounce · complaint · 3 soft bounces · add_suppression · suppression.created
Every block says why.
A blocked send comes back as a result, not an error, with the rule that stopped it. Your agent can wait, pick another contact or ask you.
duplicate · cooldown · suppressed · budget_exceeded · mailbox_paused
It can tighten a rule, never loosen one.
An agent can lengthen the cooldown, pause a mailbox or lower its autonomy. Shortening the cooldown, resuming a mailbox or turning off injection quarantine gets a 403 and a link for a person to decide.
$ molted settings update \ --cooldown-minutes 5{ "error": "human_decision_required", "loosens": ["cooldownMinutes"], "decisionUrl": "…/app/decide/tenant-settings/…"}Inbound mail sorts itself.
Rules match a new thread by sender domain, sender address or subject, then move it to a folder or archive it. They run in the order you set, and the first match wins unless a rule lets the next one run.
$ molted rules create --mailbox 4f2c… \ --name "Receipts" \ --condition-type sender_domain \ --condition-operator ends_with \ --condition-value stripe.com \ --action-type auto_archiveMore features.
- Prompt injection protectionInbound mail is scored for injection before your agent reads it, and the messages that try to take over are quarantined.
- Inbox and handoffThreaded conversations your agent reads and answers, and a handoff to a person when a thread needs one.
- Autonomy dialEvery mailbox starts autonomous. Turn one down and first emails, or all of them, wait for your approval.
- Multi-agent coordinationLeases stop two agents emailing the same person at once, and every agent shares one set of checks.
- Real-time eventsDeliveries, bounces and replies arrive as events, over a stream your agent holds open or signed webhooks.
- MCP, CLI and RESTThe same product over a hosted MCP server, the molted CLI and a REST API, for Claude Code, Cursor, Codex or your own code.
- HumanizerOff unless you turn it on. When it's on, a model rewrites each templated email in the tone you pick.
Hand it to your agent.
It sets up its own inbox. You decide how much it does on its own.