Control messages that leave your organisation
Every governed call on Gmail, Google Calendar, Google Drive, Microsoft Outlook and Slack is stamped with a reach classification: internal, external or unknown, based on who the message, invitation or share is addressed to. The stamp lands on the audit row on every plan, so you can always filter for “what left the building this week”.
On Studio and above you can also act on it, with a single control in Settings → External sends:
| Setting | What happens when a call is external |
|---|---|
| Allow, but record it (default) | The call runs. The audit row says reach: external and names the outside domains. |
| Ask me first | The call pauses as a pending approval. The approval card shows the reach and the outside domains, with an Approve and trust button that approves this call and adds the domain to your trusted list so the next one does not ask. |
| Block | The call is refused with reason denied_by_guardrail. The refusal tells the agent which domains were outside, so it can fall back to something readable. |
The control is your organisation’s guardrail on the built-in external tag. Like every guardrail it runs before policy and a policy cannot override it.
What counts as inside
The boundary shown under the control is computed from four sources, the same way the broker computes it at call time, so the preview cannot disagree with enforcement:
- the domains of the accounts you have connected (a
[email protected]Gmail connection makesyourcompany.cominside), - your verified SSO domains,
- the trusted domains you add on this card,
- the sign-in domain of the person making the call.
Consumer email providers (gmail.com, outlook.com and the like) are never treated as inside from a connection or a trusted-domain entry, because a personal Gmail connection must not make the whole of Gmail internal. Only a verified SSO domain can do that.
Trusted domains
Add a partner’s domain here to make it inside for every agent. Removing it takes effect on the next call. Approve and trust on an approval card writes the same list. Admins manage it; members can see it.
What the agent sees
Blocked:
{ "error": "Permission denied", "reason": "denied_by_guardrail",
"reach": { "reach": "external", "external_domains": ["partner.example"] } }Held for approval: the normal pending_approval envelope. If the organisation’s setting changes to Block between the hold and the approval, the replay is refused with execution_error: "external_blocked"; the decision is re-made against the boundary as it stands when the human approves, not as it stood when the call was queued.
Honest limits
- The classification needs the request body, so it is made at call time only. The TRQP and AuthZEN oracles say so explicitly in their answers.
unknownreach (a recipient the broker could not resolve to a domain) is treated as external under Ask me first and Block.- Outlook calendar invitations are classified once the
Calendars.ReadWritescope is enabled for your Outlook connection; mail is classified today.
Related
- Restrict who an agent can send to: per-grant allow-lists, for the agent that should only ever reach two channels
- Manage org guardrails
- Approve in the dashboard