When an AI “sends the email”, the model has written a structured request and the application around it has decided whether to act. The risk sits in that wiring, so judge an agent by what it is connected to and who owns the list.