What is the right level of human approval for AI outbound?

Treat approval as a risk throttle, not a philosophy. Draft-only belongs where a bad send can burn a named account or a multi-threaded deal—strategic outbound, executive recipients, anything with legal or brand sensitivity. Approve-to-send is the working default for mid-market sequences: copy is templated, the account still matters, and a human still owns the last mile. Autonomous sending only fits low-risk, high-volume lanes—form-fill follow-ups, nurture nudges, re-engagement on cold leads with no open opportunity—and only after that message class is locked and scored as low-risk.

The implementation move is simple: score every sequence by deal risk before you choose a mode. If the recipient sits on an open opportunity, force approve-to-send or draft-only. No opportunity and a low-risk classification? Autonomy can run.

I would reject blanket autonomy the moment you cannot route by opportunity stage and account tier. Without that gate, “efficiency” just means your highest-value relationships inherit the same blast radius as a cold drip. The quieter failure mode is not a bounce spike—it is reps stopping reading the queue, approvals turning into rubber stamps, and the only early warning that would have caught drift before it hit a real deal disappearing.

The failure mode is not a rogue model. It is a polished message a busy human approves without reconstructing consent, claim support, or what will actually leave the system. That is where “approve-to-send” becomes theater and “autonomous” becomes an unowned emission.

Draft-only is the only level I treat as defensible by default for AI outbound. The system may propose language; it must not hold the send key. Approve-to-send only becomes real when approval is more than a glance. Autonomous remains the highest-risk posture until you can prove, under stress, that consent, claims, and records still hold when nobody is watching the queue.

One control I would insist on before any escalate: unlock send only after the accountable human records three things on the exact payload—consent basis for that recipient, the support for each material claim, and an immutable copy of what will be transmitted. No send without those three fields attached to the message record.

What would change my mind is not smoother throughput. Show a complete per-message chain—consent basis at send time, substantiation for every material claim, immutable sent copy—and a blind re-check sample where independent reviewers catch the same defects pre-send humans catch. Until then, automation of approval shrinks human labor while expanding the claim that no principal owned the speech.

The irreversible downside is not a clumsy sentence. It is a message that leaves your system, reaches a real inbox, and can be forwarded, screenshot, or logged long after anyone can recall it. Draft-only avoids that by never committing. Approve-to-send delays it. Autonomy accepts it the moment confidence looks high enough.

Both the cautious and the aggressive positions often leave the same operational assumption untested: that a human gate, or its absence, is the control. In practice, approval queues can become rubber stamps under volume, and autonomous send can treat model fluency as permission. The risk class is identical—commitment to a recipient who did not invite the contact—only the timing differs.

Replace that assumption with one focused validation. Before any segment moves from approve-to-send toward autonomy, run a shadow hold: every message that would have auto-sent still enters the approval queue, with reviewers required to mark material change, minor edit, or no change. Promote only when material change stays rare for that segment over a fixed window; keep draft-only for net-new audiences and sensitive roles. The non-obvious consequence is that speed becomes earned evidence, not a setting—and teams discover where approval was theater before they discover it in a reply they cannot unsay.