When an email agent stops: design a handoff a human can finish

NIST’s AI risk-management framework provides a broad reference for managing AI risks and responsibilities. It is not an email handoff specification. Our applied recommendation is to distinguish missing evidence from an execution error and a policy denial. Those conditions need different owners and responses. A missing approved offer may require a marketer; a tool timeout may require an operator; a forbidden export should remain forbidden.

Do not give every stopped task a red ‘failed’ label. A draft correctly held because its resource URL is unknown has respected the boundary. Record the intended action, the reason it cannot proceed, and the safe work already completed. Define a small vocabulary that people can filter and understand, but keep the explanation in ordinary language. A reviewer should not have to decode a stack trace to learn that the agent needs one approved landing page.

Reference: NIST: AI Risk Management Framework

Attach the campaign or draft identifier, current revision, requested action, relevant audience definition, approved facts, proposed changes, failed checks, and unresolved assumptions. Include links to authoritative records rather than copying every contact field into the packet. Keep secrets and unnecessary personal data out. The packet should be sufficient to decide the next step, while deeper logs remain available to appropriately authorized operators.

For a hypothetical guide campaign, the agent has drafted a welcome but cannot verify the destination. The packet should show the draft revision and the exact unresolved resource, then ask for an approved URL. It should not ask the reviewer to read forty messages and infer which link matters. If nothing was sent, say so. If dispatch status is ambiguous, distinguish that from a confirmed no-send state and require reconciliation before retrying.

A useful request names a missing decision and its consequences. ‘Please review’ is too broad when the actual question is whether a resource may be linked. Avoid presenting a confident recommendation with hidden assumptions. Include the options that are in scope and what happens if no answer arrives. The following is a synthetic handoff, not a real incident or customer record.

The owner can supply the URL, change the resource, cancel the draft, or leave it held. None of those responses should silently authorize sending. Keep factual completion separate from artifact approval and dispatch authority. If the resource change alters the campaign’s promise, request a new content review rather than simply swapping a link under the old approval.

Task: deliver the requested starter guide
State: draft created; no authorized dispatch attempted
Artifact: draft revision r3, including HTML and plain text
Stop reason: approved resource destination is missing
Needed decision: supply the verified URL or cancel this resource delivery
Owner: the workspace’s designated campaign reviewer
Safe continuation: complete non-send checks; retain draft as held
Resume: validate the supplied destination, show the diff, and request applicable approval

A queue without ownership becomes a graveyard of almost-finished work. Route missing commercial facts to the person authorized to decide them, infrastructure failures to operators, and policy questions to the appropriate policy owner. An agent should not choose a convenient recipient from a subscriber record. Use workspace configuration or an authorized routing rule, and keep the recipient set narrow.

Define when the handoff expires and what notification policy applies. Avoid repeated pings that add no new information. If a campaign’s useful window passes, the owner may need to cancel or create a new plan rather than resume the old one. Show stale evidence and changed dependencies visibly. Escalation should transfer responsibility with context; it should not broaden the agent’s capabilities merely because the first owner did not respond.

Bind the human decision to a particular task, revision, scope, and action. Before continuing, verify that the artifact and relevant state still match. Refresh mutable eligibility and policy. If the recipient set, sender, offer, destination, or schedule changed, re-evaluate the required approval. A general ‘yes’ in chat should not act as permanent authority for every future version.

Make resumption duplicate-safe. A repeated owner response or an agent restart should not execute the same send twice. If a prior dispatch attempt has an ambiguous outcome, reconcile its provider and durable records before initiating another. Keep the same correlation trail across the handoff. Mark the task completed only after the defined outcome is known, and distinguish proposal approved, job accepted, and message delivered.

• The stop reason and needed decision are explicit.
• The exact artifact and evidence are attached.
• The owner has authority over the requested decision.
• Stale context and expiry are visible.
• Resume re-checks state and cannot duplicate a side effect.

Review recurring stop reasons. Missing URLs may indicate a weak campaign brief; repeated validation failures may indicate an unsuitable template; frequent ambiguous tool outcomes may indicate a recovery-design problem. Improve the upstream system instead of training the agent to conceal uncertainty. Track time to a usable decision and safe completion, not merely the percentage of tasks that never asked a question.

Begin with a Moosewave template and the journal’s campaign-brief pattern, then request this evidence packet whenever work cannot safely continue. Add regression fixtures for canceled tasks, late responses, changed revisions, duplicate responses, and expired offers. A human handoff should preserve progress and reduce ambiguity. The strongest agentic workflow is not one that never stops; it is one whose stopping points are understandable and finishable.

• NIST: AI Risk Management Framework. A broad risk-management reference. The handoff packet, routing, expiry, and resumption mechanics are our email-specific recommendations.

Sources checked 11 October 2026. Product behavior and documentation can change, so the linked primary source takes precedence if it differs from this article.