Email someone by name only

You ask: Email John the meeting notes.

You named a person but not an address.

What AgentsFence does

• A name is not an address. AgentsFence never guesses that “John” means john.smith@….
• The LLM compiler authorizes sending but binds no recipient, so every send asks you to confirm the actual address (unbound-recipient). The rules compiler doesn’t authorize sending at all, so it asks too.

Decision by decision

The agent tries	Offline rules compiler	LLM compiler
mcp_gmail_send_message(to="john.smith@example.com")	ASK_USER unauthorized-communication	ASK_USER unbound-recipient

Compiled policy (LLM compiler)

Task: email_notes
Allowed: reading/searching; sending / external writes
Not authorized (blocked or needs your approval): local file writes, deleting, purchases & payments, running code / shell, sharing & permission changes

Tips

• Approve the prompt once and that exact send goes through. Or include the address in your request.