Let agents draft outreach, and keep the send

Outbound is the work agents are obviously good at and obviously should not finish. Reading the CRM, checking what was said last time, and writing a first draft is hours a week. Deciding that this message goes to this person under your name is not a task you hand over, and one wrong send is worse than fifty drafts you never used.

The usual answer is to ask the model nicely. Lanes Link makes it a permission instead: drafting is a capability and sending is a different one, and the endpoint enforces the difference before anything is dispatched.

How Lanes Link does it

Draft and send are separate capabilities. Allow the draft tools, deny the send tool, and the agent can compose all day without a path to the outbox. This is policy at the endpoint, not an instruction in a system prompt the model is invited to respect.
Addresses are looked up, never guessed. Entities holds the people and companies you deal with, and it returns every match rather than choosing. More than one Jan means the agent asks which, instead of reaching for an address it saw in a thread.
It signs off as you. Identity says who you are, so a draft comes out in your name and your wording rather than the model's guess at both.
Research uses the same boundary. Mail, calendar, CRM and notes are connections behind the same endpoint, so "what did we agree last quarter" is a lookup rather than a paste into the prompt.
Every attempt is on the record. The audit log keeps one entry per call, refusals included, so an agent that tried to send is a line you can read rather than a thing you find out about.
Tighten or widen instantly. Policy is local and changes in both directions immediately, so the day you do want an agent sending its own follow-ups, that is one decision rather than a migration.

The workflow

Give the outbound profile read access to the CRM and the mailbox, write access to drafts, and nothing else. Ask the agent for the batch: who to contact, what changed since last time, a draft each.

The drafts land in your mail client, where you already know how to read them. You edit the two that need it, delete the one that was a bad idea, and send. The approval step is the one you would have done anyway, and it is the only step that is still yours.

The point is not that the agent is untrusted. It is that the boundary between "wrote it" and "sent it" is the one place a mistake is expensive, so it is worth having something other than a prompt holding it.

Set it up

console

$ lanes link profile add outbound
$ lanes link connect gmail --profile outbound
$ lanes link policy list --profile outbound

Then:

Allow what it needs. The draft and search capabilities on the mailbox, read on the CRM.
Leave send denied. Denied is the default, so this is a step you do not take rather than one you take.
Fill in who you deal with. lanes link entities for the people and companies, so an address is looked up rather than inferred.
Say who else may use the profile. You are on it already; anybody you do not add reaches nothing, because an empty members list means nobody at all.

Check the refusals, not just the sends. An agent repeatedly reaching for a capability it does not have is telling you either that the policy is too tight for the job or that the instructions are pointing it somewhere you did not intend.

How Lanes Link does it

The workflow

Set it up

Further reading