AI Agent发邮件最忌讳的就是“自作主张”

很多人习惯在System Prompt里加一句“发送前请询问我”，但这种纯靠模型自觉的确认机制根本不可信。模型在某些上下文中会产生幻觉，或者直接跳过确认步骤。真正的可靠方案应该是建立一个物理级别的“审批门禁”，让AI Agent在逻辑上根本无法直接调用发送接口，除非外部系统返回一个 approved 状态。

这种工作流的实操逻辑是：Agent生成草稿 → 推送到审批端 → 人工审核/修改 → 触发发送。

下面是一个基于 Node.js 和 TypeScript 的实战部署参考，通过引入外部审批机制来拦截 AI 的盲目发送：

import nodemailer from "nodemailer";

const IMPRI_KEY = process.env.IMPRI_API_KEY!;
const IMPRI_BASE = "https://api.impri.dev";

async function sendWithApproval(opts: {
 to: string;
 subject: string;
 body: string;
 expiresIn?: number;
}): Promise<string> {
 // 1. 将草稿推送到审批端，而非直接发送
 const push = await fetch(`${IMPRI_BASE}/v1/actions`, {
 method: "POST",
 headers: {
 Authorization: `Bearer ${IMPRI_KEY}`,
 "Content-Type": "application/json",
 },
 body: JSON.stringify({
 kind: "email.send",
 title: `Email to ${opts.to}: ${opts.subject}`,
 preview: {
 format: "markdown",
 body: `**To:** ${opts.to}\n**Subject:** ${opts.subject}\n\n---\n\n${opts.body}`,
 },
 editable: ["preview.body"], 
 expires_in: opts.expiresIn ?? 3600,
 }),
 });

 if (!push.ok) throw new Error(`Push failed: ${push.status}`);
 const { id: actionId } = await push.json();

 // 2. 轮询审批状态，直到人工决定或超时
 let result: { status: string; decision?: { final_preview?: { body: string } } };
 for (;;) {
 const poll = await fetch(`${IMPRI_BASE}/v1/actions/${actionId}`, {
 headers: { Authorization: `Bearer ${IMPRI_KEY}` },
 });
 result = await poll.json();
 if (result.status !== "pending") break;
 await new Promise((r) => setTimeout(r, 10_000));
 }

 if (result.status !== "approved") {
 return result.status as "rejected" | "expired";
 }

 // 3. 仅在状态为 approved 时，使用人工最终确认的内容发送
 const approvedBody = result.decision!.final_preview!.body;
 const transporter = nodemailer.createTransport({
 host: process.env.SMTP_HOST,
 port: 587,
 auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
 });

 await transporter.sendMail({
 from: process.env.SMTP_FROM,
 to: opts.to,
 subject: opts.subject,
 text: approvedBody,
 });

 return "sent";
}

这种做法把“确认”从提示词层面提升到了架构层面。对我来说，任何涉及资金变动或对外沟通的 AI Agent 流程，如果没有这种硬性的审批拦截，都不敢在生产环境上线。