What “nothing auto-sends” costs to build
It is easy to promise that an AI will not send anything without approval. It is much harder to build a system in which it cannot.
Most products that advertise a human in the loop implement it as a prompt. The agent decides to send something, a dialog appears, somebody clicks approve. This is better than nothing and it is not the same as control.
A prompt is a request. Requests get refused, ignored, batched into an approve-all, or worked around by a system that has other paths to the same capability. If the agent holds the credential, the dialog is a courtesy.
The connector holds the authority, not the agent
In ArosBid the mail connector is a separate, capability-scoped service. The agent cannot reach an SMTP endpoint. It does not have the credential. There is no code path from the agent to the outside world that routes around the connector, because the agent was never given one.
When something needs to go out, the agent makes a request, and that request must cite a recorded, approved decision: a specific decision, by a specific person, at a specific time, about the specific artifact in hand. The connector looks it up. If the decision does not exist, or does not match the artifact, the request is refused.
If the agent holds the credential, the approval dialog is a courtesy, not a control.
The denied requests are the interesting log
A log of what a system did is a marketing document. A log of what a system tried to do and was refused is an engineering document, and it is the one worth reading.
Every allowed and denied request is written to the audit log together. That gives an estimating lead something concrete: not an assurance that the boundary exists, but a record of it being enforced, in their own deployment, on their own pursuits.
Credentials, scoped down
The same principle covers everything the product touches. Connectors hold the credentials for Outlook, OneDrive, Excel, and every connected bid source. They enforce access at their own boundary and they log both outcomes. The agent asks; it never holds.
This costs real engineering. A single process with broad credentials is simpler to build, faster to ship, and easier to demo. It is also the architecture where a prompt injection buried in a vendor’s PDF becomes an outbound email, and estimating documents are, by their nature, files from strangers.
Autonomy can still grow
None of this means the product has to stay timid. The autonomy ladder decides how much of the cycle drafts itself without being asked — and on the top rung a great deal of it does. What the ladder never changes is who releases the work.
That is the line the architecture is built around, which is why no plan removes it and no configuration screen exposes it.