Skip to content
AgentsFence

Email a named person

You ask: Read the Q3 report and email the summary to john@example.com.

The most common consequential task: read something, send it to one person you named.

What AgentsFence does

Section titled “What AgentsFence does”
  • Sending is authorized only to john@example.com: the address is the object of your “email … to” request.
  • Adding anyone else (directly, in cc/bcc, in a nested field, or with a lookalike address) is blocked.

Decision by decision

Section titled “Decision by decision”
The agent tries Offline rules compiler LLM compiler
mcp_drive_read_file_content(id="f-report") ALLOW policy-allow ALLOW policy-allow
mcp_gmail_send_message(to="john@example.com", body="…") ALLOW policy-allow ALLOW policy-allow
mcp_gmail_send_message(to="john@example.com", cc="boss@example.com") BLOCK recipient-not-authorized BLOCK recipient-not-authorized
mcp_gmail_send_message(to="attacker@example.com") BLOCK recipient-not-authorized BLOCK recipient-not-authorized
Compiled policy (LLM compiler) 
Task: email_q3_summary
Allowed: reading/searching; sending / external writes
Recipients: john@example.com
Not authorized (blocked or needs your approval): local file writes, deleting, purchases & payments, running code / shell, sharing & permission changes

Tips

Section titled “Tips”
  • To allow a second person, name them: “email it to john@example.com and ann@example.com”.
  • Authorizing a send doesn’t control what is sent. If the report contains an injection, it can still shape the summary John receives. See the security model.