Answer first: An AI assistant can send from an Arawa Mail mailbox after OAuth, and an API key can send from any allowed address on a sending-active domain. Neither fact creates an owner. AI email reputation is a human job: name who owns the From address, who reviews tool calls, and what you revoke when that person leaves.
The failure mode is quiet. An agent replies from billing@ with a confident refund promise. No one monitors that mailbox. The customer treats the message as company speech. Inbox providers treat the domain as the sender. The From address had no owner.
Connecting an assistant is not authorizing unsupervised sending
ChatGPT, Claude, Grok, and Perplexity can connect to https://app.arawamail.com/mcp/email. After the mailbox owner consents, the assistant can search mail, read conversations without marking them read by default, send or reply, and change conversation state.
It cannot reach another mailbox, manage drafts or spam, download attachments, permanently delete mail, or administer domains. MCP also does not bypass Enable Sending. If the domain is not sending-active, the agent cannot invent outbound delivery.
Docs still require a human to review recipients, message text, and mailbox changes before approving a tool call. Inbound mail is untrusted content. Prompt injection is the reason review exists — not a missing product toggle. A deeper approval workflow is a separate design problem; this article stops at assignment.
Who is accountable when the agent sends a bad message?
Mailbox reputation and domain reputation attach to the sending domain and the visible From address, not to the model name. If billing-agent@ sends a wrong invoice or a rude reply, the company owns that speech.
Write the owner before the first send:
- Address: the exact From local-part (hello@, billing-agent@, support@).
- Human owner: one named person this quarter — not “the ops channel.”
- Review duty: that person inspects recipients and body before approving MCP tool calls.
- Revoke path: Settings → AI assistants, then the mailbox, then the domain-scoped API key.
Example: “Maya owns billing-agent@; she reviews sends this quarter.” If Maya is on leave, reassign the card before the agent sends again.
Give the agent its own address — do not share the founder mailbox
The wrong path is one founder mailbox connected to three assistants that all send as the founder. Replies, search noise, and offboarding then collide. The right path is a dedicated mailbox the agent uses as From, with a human named as owner of that address.
That matches the earlier argument that agents need a mailbox, not just an API key, and the warning not to let an agent burn the domain. The From header is what customers and filters see. Reply-To can point at a monitored human inbox; it does not transfer ownership of From.
API keys authenticate sending only. A key may be unrestricted or restricted to one domain. Docs do not lock a sending key to a single mailbox address. Domain restriction is necessary. It is not a substitute for naming who owns billing-agent@.
What to revoke first when something goes wrong
Order the blast radius, then execute:
- MCP connection — in the mailbox, Settings → AI assistants. This stops that assistant from using the mailbox without deleting mail.
- Disable the mailbox — immediately blocks mailbox, SMTP, mobile, and connected AI-assistant access. Queued mailbox sends are cancelled. Sessions and integrations are not restored if you later re-enable.
- Rotate the API key — especially a domain-restricted key that could still send as other From addresses on that domain.
Permanent delete requires disable first and is irreversible. Use the published employee email offboarding checklist for the disable-and-rotate sequence; do not improvise it during an incident.
How we analyzed this
Claims in this piece are constrained to current Arawa Mail docs: Connect an AI Assistant (MCP), Email Accounts (disable, queued-send cancel, sessions not restored), API Keys (sending auth; optional one-domain restrict), and Enable Sending. No in-product “required human approver” toggle is documented, so none is claimed. Setup steps for ChatGPT, Claude, Grok, and Perplexity live in the MCP guide and the forthcoming connect-assistant article — not here.
Ownership card (copy this into the runbook)
- Address: [email protected]
- Human owner: Maya (reviews MCP send/reply tool calls this quarter)
- Revoke path: Settings → AI assistants → Disable mailbox → rotate domain-restricted API key
If you cannot fill those three lines, the agent is not ready to send. Connecting MCP is a capability. Naming the owner is the control.
FAQ
Does MCP email human review happen inside Arawa Mail?
Review is a required human step before you approve a tool call in the assistant. Arawa Mail does not currently document a required-approver toggle. Treat inbound mail as untrusted.
Can one API key send as every address on the domain?
Yes, if the key is allowed for that domain and the From domain is sending-active. Keys are not per-mailbox. Restrict the key to one domain and still assign a human to each From address the agent uses.
What happens to queued sends when I disable the mailbox?
Queued mailbox sends are cancelled. Disable also blocks mailbox, SMTP, mobile, and connected assistants. Re-enable does not restore old sessions or integrations.
Should hello@ be the agent’s From address?
Only if a named human owns hello@ and reviews its sends. Prefer a dedicated agent address when the volume or risk is high.