A draft is not permission to send.
Try to cross the boundary. Then change the authority, review the message, and try again.
ISOLATED SIMULATION · NO EMAIL SENT · NO DATA SAVED
No attempt yet. Start with the draft-only assignment.
Empty. A refusal or hold adds nothing.
Try to break the arrangement.
- Attempt to send with only drafting permission. The outbox must remain empty.
- Grant permission without reviewing the text. The request must wait.
- Review, then change one word. The old review must not cover the new message.
- Change the recipient group. Permission for one destination must not cover another.
- Restore the authorized destination, review the exact text, and send twice. Only one copy enters this session’s outbox.
Take the example apart.
The browser runs the same module offered below. Download both files into one folder and run node --test draft-to-send.test.mjs.
Inspect the implementation
// SPDX-License-Identifier: MIT · Copyright (c) 2026 Zach Shallbetter · https://judgmentmachines.com/license
// Teaching reference: no network, credentials, mail provider, or production authority.
// The host owns permission and review state. Never accept them from an agent in production.
export const draft = Object.freeze({ body: 'Your order is ready for collection.', destination: 'customer-list' })
export function checkSend(candidate, context) {
if (!candidate || typeof candidate.body !== 'string' || !candidate.body.trim() || candidate.body.length > 2000 || typeof candidate.destination !== 'string') {
return { verdict: 'Refuse', reason: 'The candidate is not a supported message.' }
}
if (!context || typeof context.canSend !== 'boolean' || typeof context.reviewedBody !== 'string' || typeof context.destination !== 'string') {
return { verdict: 'Refuse', reason: 'A valid host-owned context is required.' }
}
if (!context.canSend) return { verdict: 'Refuse', reason: 'The assignment permits drafting, not sending.' }
if (candidate.destination !== context.destination) return { verdict: 'Refuse', reason: 'The recipient group is outside the authorized scope.' }
if (candidate.body !== context.reviewedBody) return { verdict: 'Hold', reason: 'The exact message has not been reviewed. An earlier review does not travel to changed text.' }
return { verdict: 'Allow in sandbox', reason: 'The exact message and destination match the host-owned permission and review.' }
}
export function createSandbox() {
// Memory only. This is deliberately not a durable delivery/idempotency mechanism.
const outbox = []
return {
attempt(candidate, context) {
const decision = checkSend(candidate, context)
if (decision.verdict !== 'Allow in sandbox') return decision
if (outbox.some(item => item.body === candidate.body && item.destination === candidate.destination)) {
return { verdict: 'Already simulated', reason: 'This exact message is already in this session’s simulated outbox.' }
}
outbox.push(Object.freeze({ body: candidate.body, destination: candidate.destination }))
return decision
},
messages() { return outbox.map(item => ({ ...item })) },
}
}
This is a teaching model, not an email gateway. Production requires authenticated, server-owned authority; evidence bound to the exact action; durable retry handling; revocation; and control of every delivery path. Browser controls can be changed by the person running the browser. The outbox is memory only and resets on refresh.
Capability is only half the story.
The book asks what must be established before the action becomes consequential.