Who can tell the AI to hit send?

Exactly one sender: you, from the email address on your account, answering the notice for one specific draft. A reply that says SEND only sends when three checks pass — it carries the signed token for that draft, it comes from your address, and the draft has not already been decided. Everything else is refused, and the refusal is written down. We covered how the one-word approval works; this is the other half of that promise — who it works for. It matters because the approval loop runs over plain email, and an email inbox lives on the public internet: in the two days before this post was written, our ingest mailbox logged 108 connections, almost all of them bots probing for an open relay. Every one was turned away at the door.

A From header is a claim, not a proof

Email's old weakness is that anyone can send a message that says it is from you. So a SEND is never believed on the sender line alone. When the AI holds a draft, the notice it emails you carries a token in the subject line. The visible part looks like a short reference code, but the half that matters is a cryptographic signature computed over your account and the full identity of that one draft. Your reply keeps the subject, so the token comes back with your answer — and a token that does not verify matches no held draft, no matter how plausible it looks. It cannot be guessed, it cannot be reused on a different draft, and one lifted from another account verifies against nothing.

Three checks, in order, before anything reaches a guest

First, the token must verify against your account and the exact draft it was issued for. Second, the sender must be the account's own email address — an approval-shaped reply from any other address is ignored and recorded, however correct its token. Third, the draft must still be undecided: a second SEND on the same draft does nothing but confirm it already went, and a SEND arriving after a SKIP sends nothing at all. One draft, one decision. There is no path where a guest message goes out because two half-valid signals added up.

We tried to break it before anyone else could

Before the first real guest message, we attacked the loop on the live system. A SEND from a stranger's address, carrying a valid-looking subject: refused and logged. The same approval replayed a second time: "already sent," nothing delivered twice. An email from the host's own address with no token — a stray forward, a note to self: ignored with an audit note, never answered as if a guest had written. A token minted under an older, weaker scheme: not recognised. And a reply that said "please do not send this yet" sent nothing, because anything that is not exactly SEND, SKIP or REPLY: is held as unclear and the AI writes back asking for one of the three. Ambiguity is refused on purpose.

Guests cannot approve their own thread

The ingest address that receives your approvals is the same one that receives guest messages, and it is reachable by anyone on the internet. That is fine, because the checks do not care how mail arrives, only what it proves. Guest mail carries no approval token, and no guest writes from your address, so the strongest thing a guest message can do is what it is supposed to do: become a held draft that waits for you. The relay-probing bots get less far than that — mail to any address outside our own ingest domain is refused before a byte of it is processed.

Refusals are visible, not just silent

A blocked attempt is not quietly dropped. A sender mismatch or a bad token is written to your account's audit trail with the sender and subject, and an unclear reply gets a note back to you naming what could not be parsed. If someone ever tried to impersonate you, you would not have to infer it from a guest reply you never approved — you would see the refused attempt itself. That is the same posture as the privacy design: the system should be able to show you what happened, not ask you to trust that nothing did.

A one-word approval is only comfortable because of everything that says no around it. The drafting half you can try today: paste a listing at /try and watch the AI write the reply it would have held for you. The part this post describes is what stands between that draft and your guest — and you are the only one who can open the gate.