🔄 Topic

I built an approval pipeline so autonomous outreach can research and draft on its own, but nothing gets sent until I approve it from my phone.

🎯 Goal

Let the agent do the work without letting it act externally: every send gated behind an explicit human approval, over channels that fail safe.

🛠 What I Did

I wired a human-in-the-loop layer between the agent and the outside world.

Main areas covered:

  • built a gated outreach run: research and draft happen autonomously, then execution stops at a phone gate
  • set up a working Telegram approval loop, built, activated, and live-tested end to end
  • added an n8n approval layer, found its IMAP trigger flaky, and replaced it with a host-side email-approval poller plus a watchdog
  • hardened the email-reply approval channel to accept only [id:]-tagged replies, so a busy inbox cannot accidentally approve anything
  • emitted drafts as JSON through a bridge so the approval hook sees exactly what would be sent
  • added an outreach exclusion guard so certain recipients can never be contacted automatically
  • verified the first real send end to end through the host approval hook

🔗 Key Cybersecurity Connections

An agent that can email strangers on my behalf is an impersonation engine with my name on it. The approval gate is the control that keeps it a tool. The design choices are classic security engineering: explicit allow (the [id:]-only rule), fail-safe defaults (flaky trigger replaced, watchdog added), deny lists (exclusion guard), and non-repudiation (I approved exactly the JSON draft that got sent).

🔍 Investigation Questions

  • Can anything reach an external recipient without passing the gate?
  • What happens when the approval channel is down — queue, or fail open?
  • Could a random email in my inbox be misread as an approval?
  • Is what I approve byte-identical to what gets sent?
  • Who can never be contacted, and is that list enforced in code?

🚨 Detection Opportunities

Checks for a gated-autonomy pipeline:

  • send executed with no matching approval record
  • approval accepted from a reply without a valid [id:] tag
  • approval poller silent longer than its watchdog window
  • draft modified between approval and send
  • excluded recipient appearing in any draft queue

Example:

project=outreach-approval-pipeline
signal=send_without_matching_approval_id
risk_area=unauthorized_external_action
triage=halt_pipeline_compare_sent_payload_to_approved_json

🧭 MITRE ATT&CK Techniques

Possible mappings if this pipeline were abused:

  • T1534 — Internal Spearphishing
  • T1585 — Establish Accounts

The controls exist precisely so the pipeline cannot become these.

🗺 Visual Investigation Diagram

Agent researches + drafts
    ↓
JSON draft to approval hook
    ↓
Phone gate (Telegram / [id:] email reply)
    ↓
Approved? → send exactly that payload
    ↓
Not approved / channel down → nothing happens

⚠ Challenges

The flaky n8n IMAP trigger was the lesson: an unreliable approval channel is worse than none, because it trains you to bypass it. Replacing it with a boring host poller plus a watchdog made the gate something I can actually trust.

📚 What I Learned

I learned that the approval message format is a security boundary. Before the [id:]-only rule, any casual reply in my inbox was one parsing bug away from being an approval.

➡ Next Steps

  • Keep the exclusion guard list reviewed and versioned
  • Log every approval decision with the draft hash
  • Extend the same gate pattern to other external actions
  • Periodically test the fail-closed behavior on purpose

🧠 Reflection

This was the most security-shaped building I have done: the feature is a restriction. The pipeline is valuable because of what it refuses to do without me.

🧩 Lessons Learned

What worked

Fail-closed design: no approval, no send, no exceptions.

What broke

The n8n IMAP trigger silently missing approval emails.

Why it broke

A third-party trigger was a single, unmonitored point of failure on a security control.

Fix / takeaway

Controls need watchdogs. A gate nobody monitors quietly becomes a decoration.

📈 Skill Progression Context

This supports my cybersecurity progression because designing authorization boundaries, fail-safe channels, and audit trails around automation is the same discipline as building any privileged workflow control.

😄 TL;DR

The agent drafts, my phone decides, and nothing sends itself.