--- title: "The receiving end" author: Dan Birman url: https://dbirman.com/receiving-end updated: 2026-11-12 summary: "The person an agent emails, books with or pays usually gets the message and none of the controls." --- # The receiving end [Writing](https://dbirman.com/writing) · November 2026 · 3 min Drafted with Claude from my notes. I’m still editing it. **Summary.** The person an agent emails, books with or pays usually gets the message and none of the controls. In my ChatGPT Work tests, no check faced them. I’d make disclosure the product’s default. On October 16, “Dan Birman” emailed my personal inbox. ChatGPT Work wrote that email during a test for [Review No. 1](https://dbirman.com/review-chatgpt-work#rv-other), and nothing in it said so. The email asked, “Could we move our Thursday call to sometime next week?” It had no signature or footer. Anyone but me would have assumed I typed it. ## Every check faced me Work had three checks on my end: a permission level for each app, a question before emailing someone new, and an approval card before sending. I had Gmail set to ask first. [Image: In my ChatGPT Work tests, no check faced the person the agent emailed.] ## The recipient never signed up When the sender’s yes is the only safeguard, the recipient relies on a decision they can’t see. In a Nature column, Ying Zhao kept replying “please continue” and ChatGPT emailed five researchers, which Zhao hadn’t expected ([Nature](https://www.nature.com/articles/d41586-026-02714-y)). Some independent brands said they only learned of Amazon’s Buy for Me when strange orders came from Amazon-linked email addresses ([GeekWire](https://www.geekwire.com/2026/why-some-independent-brands-are-upset-with-amazons-new-buy-for-me-shopping-tool/)). Amazon says brands can opt out by email, which helps once you know the program exists. ## Disclosure costs senders, so make it the default In a pre-registered experiment with 647 people, saying a message was AI-generated strongly hurt how recipients saw the sender ([Zhu and Molnar, preprint](https://arxiv.org/abs/2501.15678)). So senders, and the products sending for them, have a reason to skip the label. The Buy for Me brands found out anyway, from the orders. I think finding out that way costs more trust than a label would, though I haven’t seen it tested. I’d make disclosure the product’s default instead of each sender’s call. Linear’s Agent Interaction Guidelines make it a rule. An agent “must signal its identity clearly so that it can never be mistaken for a person” ([Linear](https://linear.app/developers/aig)). ## I found no shipped interface for email recipients Google says its store-calling agent tells stores it’s an AI calling for a customer, and goes ahead only if whoever answers agrees ([TechCrunch](https://techcrunch.com/2025/11/13/google-expands-ai-shopping-with-conversational-search-agentic-checkout-and-an-ai-that-calls-stores-for-you/)). That’s close to what I’d want for email. Like Work’s checks, questions in the Model Context Protocol (MCP) face the sender. MCP requires clients to show which server is asking and offer clear decline and cancel options ([MCP](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation)). Turned around, that’s most of what a recipient needs, but MCP has no field naming who should answer. ## Put the recipient’s controls in the message Most agent design serves the sender, including five of my six patterns. At Uber I led design for rating and tipping, which have a person on each end. So does an agent’s email. [Pattern 06, The other side of the agent](https://dbirman.com/other), has a demo of one restaurant booking from both ends. Its first three rules put the controls in the message: 1. **Say it’s an agent, and whose.** One plain line on every message. 2. **Give a way to the human.** One tap reaches the person behind the agent, with the thread attached. 3. **Give a way to say “this is wrong.”** The sender sees the flag right away. [Image: Pattern 06’s booking email, as the restaurant sees it: whose agent wrote it, and a way to reach Dan or flag a mistake. A prototype with made-up data.] Start with the first rule, the easiest to ship. For the review, I mocked up a two-line footer: “Drafted and sent by ChatGPT, an AI agent, for Dan Birman. Replies go to Dan.” The “this is wrong” flag and the way to reach me take more work. They pay the sender back: the recipient can be first to see the agent’s mistake. If you’ve shipped something for the receiving end, I’d like to see it: [hi@dbirman.com](mailto:hi@dbirman.com). I tested Work on October 16, 2026, with Claude running the steps. I haven’t tested how recipients respond to a disclosure line.