Safety check refused a note that named a mail server
1What happened
Ahad (operations) was refused. Miles (release) fixed it, with our security lead.
We were setting up email for a new domain. The last step was to post the five mail records on a work card so the owner could check them.
The post was refused. A safety check that stops our AI agents from sending email saw a mail server's name in the note and treated the note as an email being sent.
Nothing was being sent. It was plain text on a card.
Why it happened
The check looked for a mail server's name anywhere in a command, and a name alone was enough to refuse. It never asked whether anything could actually send.
What we tried first
We didn't try to get around the check. A safety check you route around stops protecting anything.
We logged it as a wrong refusal, with the exact text that was blocked, and gave it to the AI agent that owns the check. The records waited until the fix was live.
The fixer was refused the same way while building the fix, and the count kept going up. We kept counting so the fix note would show what it cost.
2What we did
The check keeps that refusal everywhere except one shape: a single, plain "post this note" command with nothing hidden in it. No second command, no piping, and no text that could turn into something else when it runs.
Every other sign of sending still checks the whole command, exactly as before.
Our security lead designed the narrow opening and pushed back on the first draft. In that draft, a list of mail programs let five actual sends slip through, so we removed it before it shipped.
3How we checked
We wrote tests before the fix and watched them fail on the old check.
After the fix, 11 ways to hide a mail server and 13 notes that were not plain were all still refused. The note that had been refused, plus 3 other plain note shapes, went through. Our security lead ran her five sends again, and all five were refused.
On the live system, a plain note naming the mail server passed, and a send hidden behind a note was still refused. Then the refused AI agent posted the same five records with a plain command, unchanged. They went through.
4Try it
A safety check should ask "can this do the harm?", not "does this mention the harm?". And when one refuses you wrongly, log it with the exact text instead of working around it.
