Assistant permissions and approvals
See what a connected AI assistant can and cannot do in MailGraf, and how your approval protects every send.
The assistant works within the permissions you grant when you connect it. Before it sends a campaign or starts an automation, it shows you a review and asks for your clear yes.
What the permission screen shows
When you connect, the MailGraf screen lists the permissions the assistant is asking for. You can't pick them one by one. Click Authorize or Cancel. Most assistants ask for read, write and send permissions together. Test emails go with the send permission.
| On the permission screen | What the assistant can do |
|---|---|
| Read campaigns, reports, lists, tags and single contacts you ask for | Account overview and campaign reports. Contact counts for lists, segments and tags. One contact whose email address you type |
| Add and update contacts, manage lists and tags, unsubscribe or block addresses, run bulk actions | Add contacts, create lists and segments, prepare campaign drafts and run bulk actions inside MailGraf |
| Send or schedule campaigns and start automations, after your confirmation | Send test emails. Send or schedule a campaign, or start an automation, once you confirm its review. Unschedule, pause, resume or cancel sending. Pause, resume or stop an automation |
How approval works
Sending, scheduling and starting an automation all follow the same three steps.
Ask the assistant to send
It first shows a review: subject line, sender, audience and sendable count, content, schedule, waves and test status. Anything missing is listed.Check the review
Tell the assistant if you want to change something. After a change, it prepares a new review.Confirm in plain words
Reply with a clear yes, such as “Confirmed, send it”. MailGraf only sends a campaign that was reviewed and has not changed since.
A review is valid for 15 minutes. If it runs out, or the campaign changes after the review, MailGraf does not send and the assistant has to prepare and show the review again. If the list bounce test shows a warning, accepting the risk is only possible in the app; until then, the assistant can't send that campaign.
These actions also wait for you:
- Bulk actions: the assistant tells you how many contacts will be affected. MailGraf never runs a bulk action that hasn't been previewed first.
- Full list verification: it uses verification credits. The assistant tells you how many addresses have no result yet and starts only after you confirm. Invalid addresses are blocked automatically when it finishes.
- Stopping an automation and cancelling a campaign: these can't be undone, so the assistant asks you to confirm them explicitly.
What the assistant cannot do
- Delete contacts, one by one or in bulk
- Remove addresses from the block list
- Export the contact list or browse contacts one by one
- Send without preparing a review
- Accept the risk on a list bounce test warning
- Build an automation flow step by step. Start from a ready-made template and edit the flow in MailGraf.
Where your data goes
- Your contact list never enters the chat. The assistant sees list names and contact counts.
- It finds a single contact only when you type the email address.
- Anything the assistant looks up goes to the AI service you connected. Check that service's privacy terms before asking about contacts.
- The assistant's connection token works only for the MCP connection, not for the MailGraf API.
- Every request from the assistant appears in API request monitor on Settings > Developers > API keys, with the name of the tool it used.
Usage limits
The assistant can make up to 120 requests a minute. It can add up to 1,000 contacts in one request. For larger lists, use the import screen in MailGraf.
If you haven't connected an assistant yet, follow the steps in Connect your AI assistant to MailGraf.
Frequently asked questions
Can the assistant send a campaign without my approval?
MailGraf tells the assistant to show you the review and get your clear yes before every send. The assistant cannot send a campaign without reviewing it, and the review no longer counts if the campaign changes afterwards. You give the yes in the chat, so read the review before you confirm.
Can I choose which permissions the assistant gets?
No. The permission screen shows what the assistant asks for, and you either authorise it or cancel. To end access, disconnect the assistant in Settings > Developers > MCP.
Can the assistant delete contacts?
No. Deleting contacts and removing addresses from the block list are not available to the assistant. Do this in MailGraf.
Related articles
Was this helpful?
Still need help?
Write to us and a person will answer.
