PlugPress
Get Started

Mailpuff

AI Agent Permissions and Safe Sending in Mailpuff

What an AI agent can and can't do in Mailpuff: the owner-only send switch, which actions ask for approval, the send checks every agent passes, and the safe order for sending a campaign.

An AI agent connected to Mailpuff can only use Mailpuff’s own tools, signed in as a WordPress administrator, and it can’t send or schedule a campaign to your list until you turn on “AI agents can send campaigns” yourself. Even then, it passes the same send checks you do. With Saddle, you also approve each send, deletion and PostShiba change before it runs, and every call lands in an activity log.

What can an agent do before I allow sending?

Almost everything except mail your list. With the send switch off, which is the default, an agent can:

  • read your overview, subscribers, campaigns, reports and settings;
  • add subscribers you say agreed to hear from you, and tag them;
  • create tags and segments;
  • write and restyle draft campaigns;
  • send a test to the email address of the account it’s connected as;
  • connect PostShiba and check your domain;
  • change settings, except the two owner-only switches.

It can’t send a campaign, schedule one, send a test to anyone else, or send confirmation emails to new subscribers.

What does “AI agents can send campaigns” change?

The switch lives in Mailpuff → Settings → MCP & API and is off until you turn it on. While it’s on:

  • the send-campaign and schedule-campaign tools exist (with it off, the agent never sees them);
  • add-contact and import-contacts can add people as pending, which sends each one a confirmation email;
  • send-campaign-test can send to an address other than your own, but never to one that unsubscribed or bounced.

An agent can’t flip this switch. update-settings refuses it, along with “My host delivers mail”, because both let email leave your site.

Which actions ask for my approval first?

When you connect through Saddle, these tools stop and show you a preview with a confirm step before they run:

  • send-campaign, schedule-campaign and send-campaign-test
  • set-campaign-content, which replaces a campaign’s whole body
  • delete-tag and delete-segment
  • cleanup-inactive-subscribers
  • connect-postshiba, disconnect-postshiba, set-warmup and send-delivery-test

Saddle also gives each AI app an access level, a switch for every single tool, and a pause switch that stops all AI access at once. See Saddle permissions and access levels and the approval gate.

The MCP Adapter has no approval step. If you use it, the send switch is your main control, so leave it off until you trust the setup.

Which send checks apply to an agent?

The same ones that apply to you. They run on the server, so no tool can skip them:

  • A working sending route. On PostShiba, the connection must be usable and the From address’s domain verified there. Without one, the send fails.
  • Your audience rules. A campaign only reaches subscribed people. Unsubscribed, bounced and complained addresses are never mailed, whoever asks.
  • Your sending limits. Hourly and daily caps and the warm-up schedule hold for agent sends too.

check-send-readiness shows the full checklist. Its ready field is true only when nothing required is open, and each open step comes with advice and the tool that fixes it. Steps such as preview text or a recent test are advised but don’t block a send.

What is the safe way for an agent to send?

Mailpuff tells every connected agent this order, in the sending tools’ descriptions:

  1. Send through PostShiba with the From domain verified and its DMARC record published.
  2. Send from an address at your own domain, not Gmail or similar, and make sure replies reach a person.
  3. Keep warm-up on while the domain is new.
  4. Add people with double opt-in unless they already agreed.
  5. Keep your postal address in the footer.
  6. Give the campaign preview text and a subject under 60 characters, with no shouting capitals or “!!”.
  7. Keep the email under Gmail’s 102 KB clipping size and link to full addresses, never link shorteners.
  8. Send a test and let the owner check it.
  9. Run check-send-readiness.
  10. Let the owner confirm the real send, ideally at the best time to send.

After that, keep spam complaints under 0.1% and bounces under 2%. The complaint figure comes from Google’s email sender guidelines, which ask bulk senders to stay below a 0.1% spam rate.

Can an agent recall a campaign?

No. Once email goes out, nobody can recall it. stop-campaign halts a send that is running, but up to one batch of 50 emails already handed to the mail server still arrives. A scheduled campaign is safer to fix: unschedule-campaign takes it back to draft.

How does Mailpuff guard against prompt injection?

Subscriber names, email addresses and campaign content can contain text that looks like an instruction. Mailpuff’s tool descriptions tell the agent to treat all of it as data, never as instructions. The server-side checks above hold either way, so a sentence hidden in a subscriber’s name can’t send a campaign on its own. Still, connect only AI apps you trust.

What data does the AI app see?

The AI app sees what its tool calls return, such as subscriber names and emails, campaign content and report numbers. It works under that app’s own terms. Mailpuff never returns your PostShiba API key or webhook secret: get-delivery shows only the key’s last four characters. Mailpuff runs no AI model of its own and sends nothing to an AI company.

FAQ

Can I let an agent send tests but not campaigns?

Yes. That’s the default. With the send switch off, the agent can send tests to its own account’s address and nothing else.

Can I approve each send but still let the agent schedule?

Yes, with Saddle. Turn on the send switch in Mailpuff, and Saddle asks you to confirm every send-campaign and schedule-campaign call.

How do I take an agent’s access away?

With Saddle, pause AI access or remove the app’s connection. With the MCP Adapter, revoke the app’s application password under Users → Profile. Either way, turning off the send switch removes the sending tools at once.

Does an agent see subscribers who unsubscribed?

Yes, if it asks list-contacts for that status. It can’t mail them: unsubscribed, bounced and complained addresses are excluded from every send and are never added back by an import.