The moment you let an AI assistant message other people on behalf of your business, you hand it the ability to speak for you—and to get things wrong in front of customers, partners, or your own team. The safest way to let an AI assistant message other people is to give it the ability to draft and propose, but never to send until a person approves. An approval-first architecture puts a human checkpoint between what the AI suggests and what actually goes out the door.
That approval step becomes the control layer. The assistant reads your business knowledge, drafts a reply or a note, and surfaces it for review. You see what it wants to say, why it's saying it, and where it pulled the information from. You approve, edit, or reject. Only then does the message reach another person. This pattern keeps the AI useful without handing it unsupervised access to your communication channels.
Key Takeaways
- The safest architecture for an AI assistant that messages others is approval-first: the assistant drafts, a person reviews and approves before anything sends.
- Show which documents or vault folders the AI read to form its answer, so the approver can verify the source and catch mistakes before they reach someone else.
- In team chat, typing @assistant should surface an answer inline with citations, and any proposed follow-up action—filing a note, adding a task, sending a message—waits for explicit approval.
- Restrict which folders or records the AI can read using role-based permissions and folder-level access controls, so sensitive information stays out of scope.
- An assistant that shows its work and waits for approval becomes a draft generator, not an autonomous agent—and that boundary is what makes it safe to use with other people.
Why AI Assistants Need an Approval Layer When They Message People
An AI assistant that can send messages without review introduces several risks that are hard to catch until after the damage is done. The assistant may read the wrong document, misinterpret context, or generate a reply that sounds plausible but contains a factual error. It may pull from an outdated folder, apply the wrong tone, or reference a customer detail it should not have access to. Each of these mistakes is recoverable when it stays inside a draft. Once it lands in someone else's inbox or chat thread, the error becomes a trust problem.
An approval workflow makes every outgoing message a deliberate choice. The assistant generates the draft, the person decides whether it goes out. That single checkpoint prevents the assistant from acting on incomplete information, misread context, or a folder it should not have touched. It also creates an audit trail: who approved what, when, and based on which sources.
The approval layer does not slow the assistant down in a way that defeats its purpose. The assistant still does the work—reading the vault, synthesizing an answer, drafting the message—but the final send is a one-click decision by someone who knows the context. The delay is typically seconds, not hours, and the tradeoff is that nothing leaves your business until a person with authority says it should.
What an Approval-First Assistant Looks Like in Practice
An approval-first assistant makes its drafts visible before they become real actions. When someone types @assistant in a team chat thread, the assistant reads the business vault, finds relevant documents, and replies in the thread with an answer. That answer shows which vault documents it read—folder names, file names, or document titles—so anyone in the thread can verify the source. If the assistant read nothing from the vault for a particular reply, that fact is marked explicitly.
After answering, the assistant may offer to take a follow-up action: file a decision note into the vault, add a task, or draft a message to someone outside the thread. That offer appears as a proposal, not a completed action. A button or inline prompt asks the person who invoked the assistant to approve, edit, or dismiss. Until someone clicks approve, nothing changes in the vault, no task is created, and no message is sent.
This pattern keeps the assistant in the role of a draft generator. It reads, it synthesizes, it proposes—but it does not execute on its own. The person who approves the action sees what the assistant wants to do, the text it drafted, and which documents informed that draft. If the draft is wrong, the person can edit it inline or reject it outright. If it is right, one click sends it or files it.
The same approval-first logic applies when the assistant works across connected apps. In Mycel, when the assistant would change something inside a connected Martello app—Relay, TradesBackbone, ReputeLift, or SynthPrism—it surfaces the proposed change in the Approvals section first. The owner or admin sees the draft, the app it affects, and the reasoning. Nothing touches the external app until a person with the right role approves it. That boundary prevents the assistant from filing incomplete customer records, updating a brand voice document without review, or changing a folder shared with another app's AI.
How to Control Which Information the Assistant Can Read
Letting an AI assistant message other people safely starts with controlling what it can see. If the assistant can read every folder in your business vault, it may pull sensitive financial records, employee notes, or draft contracts into an answer intended for a customer or a contractor. The solution is to restrict access at the folder level and control which apps and assistants can read which parts of the vault.
In a business workspace with team roles, a folder can be set to one of three access levels: everyone in the business, team members but not viewers, or owners and admins only. A folder marked owners and admins only is invisible to members and viewers, and an assistant answering a question for a member will not read from that folder. This keeps payroll records, legal notes, and strategic planning documents out of scope for the assistant when it answers routine questions in team chat.
When you connect an external Martello app to Mycel, you share specific folders with that app's AI. Relay's AI and TradesBackbone's AI read only the folders you share with them; they cannot see the rest of the vault. ReputeLift's AI reads the full business vault to understand tone and service details. SynthPrism's assistant reads the vault for brand voice and business facts. You choose which folders each app can see when you connect it, and you can revoke access or change the shared folders at any time.
This folder-level control becomes the information boundary. If a folder contains customer credit card notes or internal complaints, you do not share it with the app that drafts public review responses. If a folder holds product specs that are not yet public, you do not share it with the assistant that answers customer questions in chat. The assistant can only draft from what it can read, so limiting read access limits what it can accidentally disclose.
Designing the Approval Workflow for Team Chat
Team chat is where an AI assistant can add the most value—and where it can cause the most visible mistakes if it sends something wrong. The workflow needs to be fast enough that people will use it, and safe enough that a bad draft never becomes a real message.
In Mycel's Team chat, which is available in business workspaces, channels and direct messages work like any other team messaging tool. Every business has a #general channel. People can create additional channels and send direct messages to others in the business. The difference appears when someone types @assistant in a message or thread.
The assistant reads the business vault, finds documents relevant to the question or request, and posts an answer in the thread. The answer includes inline citations: which vault documents it read, by folder and file name. If the assistant did not read anything from the vault for that answer, it says so explicitly. This transparency lets anyone in the thread verify the source or challenge the answer before acting on it.
After the assistant answers, it may offer to file a decision or add a task based on the conversation. That offer appears as a button or prompt in the thread: "File this decision to the Policies folder?" or "Add a task to follow up with the vendor?" Clicking the button does not immediately file the note or create the task. Instead, the action moves to the Approvals queue, where an owner or admin sees the proposed text, the target folder or task list, and the thread context. The approver can edit the draft, approve it as written, or dismiss it. Only after approval does the note appear in the vault or the task appear in the connected app.
This two-step pattern—answer with citations, then propose with approval—keeps the assistant useful in real-time chat without giving it the ability to change records or send messages on its own. The person who asked the question gets an immediate answer. The person with authority to change the vault or contact a customer makes the final call.
What Happens When the Assistant Gets It Wrong
An AI assistant will sometimes read the wrong document, misinterpret a question, or draft a reply that does not fit the situation. The approval workflow is designed to catch these errors before they reach another person, but it only works if the approver actually reviews the draft.
Every answer the assistant gives shows which vault documents it read. If the assistant pulled from a folder labeled "Old Pricing 2024" instead of "Current Pricing 2025," the citation makes that visible. The approver sees the source, realizes the error, and rejects the draft. If the assistant read nothing from the vault and generated a reply anyway, that fact is marked, and the approver knows the answer is not grounded in the business's own records.
Something the assistant filed into the vault can be undone. Every document in Mycel keeps a history of who changed what and when, with restore. If the assistant filed a decision note with incorrect details and someone approved it without catching the mistake, the document history shows when the assistant created it and who approved it. An owner or admin can restore the previous version or delete the note outright.
This version history also creates accountability. When a draft goes through approval, the record shows who approved it and when. If a wrong message reaches a customer because someone approved a bad draft too quickly, the history makes it clear that a person, not the assistant, made the final decision to send. That accountability is what keeps the approval step from becoming a rubber stamp.
How to Set Up Folder Permissions for Safe Messaging
Folder permissions are the first line of defense when an AI assistant reads your business vault to draft messages. The goal is to give the assistant access to the information it needs to be useful, while keeping sensitive or incomplete records out of reach.
Start by organizing the vault into folders by topic and audience. A folder named "Customer FAQs" holds answers the assistant can safely share with anyone. A folder named "Internal Policies" holds documents team members need but customers should not see. A folder named "Legal and Payroll" holds records that only owners and admins should access. Once the folders are organized, set each folder's access level to match who should be able to read it—and which assistants should be able to draft from it.
In a business workspace, the four roles are Owner, Admin, Member, and Viewer. A folder set to "team members but not viewers" is visible to everyone except viewers. A folder set to "owners and admins only" is invisible to members and viewers. When the assistant answers a question for a member in team chat, it cannot read from the owners-and-admins-only folder, so it will not accidentally pull payroll figures or legal strategy into the draft.
When you connect a Martello app to Mycel, you choose which folders that app's AI can read. If you connect Relay to manage customer communication, you might share the "Customer FAQs" and "Service Policies" folders with Relay's AI, but not the "Employee Onboarding" or "Vendor Contracts" folders. Relay's AI drafts replies to customers using only the folders you shared, and it cannot see the rest of the vault.
This folder-sharing model means you can give different apps and assistants different scopes. TradesBackbone's AI reads the folders you share to draft estimates and invoices. ReputeLift's AI reads the full business vault to understand tone and service descriptions. SynthPrism's assistant reads the vault for brand voice and business facts. Each app sees only what it needs, and you can revoke or adjust access at any time from the Vault section.
How the Today View Keeps Approvals From Piling Up
An approval workflow only works if approvals happen promptly. If drafts sit in a queue for days, the assistant becomes a bottleneck instead of a help. The Today view in Mycel is designed to prevent that backlog by surfacing everything waiting on a person in one place.
When you open Mycel's Home section, the default view is Today: a list of what is waiting on you across the connected apps. Each item shows which app it came from, why it surfaced, how long it has waited, and a link straight to it. If the assistant filed a draft message to a customer in Relay and it is waiting for your approval, Today shows the draft, how long it has been waiting, and a link to the approval in Relay. If the assistant proposed a decision note for the vault, Today shows the proposed note and a link to the Approvals queue.
This unified inbox keeps approvals visible. Instead of checking each app separately or relying on email notifications, you see everything that needs a decision in one list. The list updates as soon as someone on your team adds an item or the assistant proposes an action. You can click through to approve, edit, or reject without leaving the Today view.
The Today view also makes it clear when approvals are aging. If a draft has waited three days, the wait time appears next to the item. That visibility creates an implicit deadline: approvals should not sit for days, and the Today list makes it obvious when they do.
What to Do When You Need the Assistant to Message Someone Directly
There are situations where you want the assistant to send a message without a manual approval each time—automated reminders, receipt confirmations, or status updates that follow a strict template. The approval-first model still applies, but the approval happens once at the design stage instead of once per message.
In Mycel's business workspaces, automations let you define a rule: when this happens, do that. An automation can watch for a specific event—a new file in a folder, a completed task, a date—and trigger an action, including drafting and filing a note or sending a message. The assistant can be part of that automation: read this folder, draft this message, file it here. But the automation itself is something you design and approve once, and then it runs according to the rule you set.
This is different from giving the assistant unsupervised send access. The automation follows a rule you defined. The assistant reads only the folders you specified in the automation. The message template is one you reviewed and approved when you built the rule. The assistant fills in variables—customer name, date, account number—but it does not compose freeform replies. This keeps the assistant's role narrow and predictable.
If the message the assistant drafts under an automation rule turns out wrong, you can disable the automation, edit the rule, or change which folders the assistant reads. The automation logs every action it takes, including which drafts it generated and when. That log lets you trace a bad message back to the rule that created it and fix the rule so it does not happen again.
How to Train Your Team to Review AI Drafts Properly
An approval workflow is only as good as the people who approve the drafts. If someone approves every assistant draft without reading it, the workflow becomes a rubber stamp, and bad drafts will eventually reach customers or partners. Training your team to review drafts properly is part of making the assistant safe to use.
The first step is to make the review fast and specific. Every draft the assistant surfaces for approval should show what it wants to do, which vault documents it read, and where the draft will go. The approver should not need to open three other tabs or reconstruct the context to decide whether the draft is correct. The approval interface should make the review take seconds, not minutes.
The second step is to create a habit of checking the citations. When the assistant drafts a reply and cites "Pricing 2025" and "Refund Policy," the approver should glance at those folder and file names to confirm they are current and relevant. If the assistant cites a folder the approver does not recognize, or if it cites nothing at all, that is a red flag. The approver should reject the draft and either answer the question manually or update the vault so the assistant can find the right document next time.
The third step is to treat assistant mistakes as vault problems, not assistant problems. If the assistant drafts a wrong answer because it read an outdated folder, the fix is to archive or delete the old folder and make sure the current information is clearly labeled and easy to find. If the assistant drafts a vague reply because the relevant policy is not in the vault, the fix is to add the policy. Over time, the vault becomes more complete and better organized, and the assistant's drafts get better.
This feedback loop—review the draft, check the citations, fix the vault when something is wrong—turns the approval workflow into a quality control process for your business knowledge, not just a safety check on the assistant.
How Mycel's Approval Workflow Keeps Team Chat Safe
Mycel is built around the approval-first model. When you type @assistant in a team chat channel or direct message, the assistant reads the business vault, drafts an answer, and shows which documents it read. If it offers to file a decision note or add a task, that proposal moves to the Approvals queue. Nothing changes in the vault or in a connected app until someone with the right role approves it.
The same pattern applies when the assistant works with connected Martello apps. When Relay's or TradesBackbone's AI reads the folders you shared and drafts a reply to a customer, that draft waits in Relay or TradesBackbone for your approval. The assistant cannot send the message on its own. When ReputeLift's AI drafts a review response, you approve it in ReputeLift before it posts. When SynthPrism generates social content based on the vault, you review and approve the draft before it publishes.
This consistent approval boundary means the assistant can propose actions across your business—team chat, customer messages, vault notes, tasks—without any of those actions happening until a person says yes. The assistant becomes a draft generator, not an agent. It does the reading, the synthesis, and the first draft. You do the final decision.
The vault exports as plain markdown at any time, so you can take your business knowledge with you. Each exported file carries its created and updated dates and metadata in a frontmatter header. The export is the current version of each document, so you can version-control it externally, back it up, or move it to another tool. That export gives you an exit and a backup, which matters when you are letting an AI assistant file notes into your records.
Mycel's pricing ladder includes a Free plan for one person with vault, filing, and search, and 50 AI credits per month. The Personal plan is $50 per month or $500 per year for one person, with 1,500 AI credits per month and your own assistant and vault. The Business plan is $119 per seat per month for up to 20 seats, or $1,190 per seat per year, and it includes everything in Personal per seat, plus connecting the Martello apps, Today, team roles, private folders, document history with restore, automations, and every add-on. Team chat, team roles, and private folders belong to a business workspace, so they are not part of the Personal or Personal Plus tiers. Enterprise pricing for more than 20 seats is custom.
Common Mistakes When Setting Up an AI Assistant for Team Messaging
One common mistake is sharing too many folders with the assistant or with connected apps. If the assistant can read the entire vault, it may pull outdated policies, internal complaints, or sensitive financial records into a draft intended for a customer. Start by sharing only the folders the assistant needs to answer common questions, and expand access gradually as you verify the drafts are accurate and appropriate.
Another mistake is approving drafts without reading the citations. If the assistant cites a folder you do not recognize or cites nothing at all, the draft is probably wrong. Clicking approve without checking the source turns the approval workflow into theater, and bad drafts will eventually slip through. Make checking the citations part of the approval habit.
A third mistake is treating the assistant as an autonomous agent instead of a draft generator. If you set up an automation that lets the assistant send messages without approval, you are bypassing the safety layer. Automations are useful for templated, predictable messages, but they should follow strict rules you defined, not give the assistant freeform send access.
A fourth mistake is not maintaining the vault. If the folders the assistant reads are outdated, incomplete, or badly organized, the drafts will reflect that. The assistant reads what you give it. If the vault is messy, the drafts will be messy. Treat the vault as the source of truth, keep it current, and the assistant's drafts will improve over time.
Comparing Approval Models for AI Assistants
| Approach | How It Works | Safety Level | Speed | Best For | |--------------|------------------|------------------|-----------|--------------| | Approval-first | AI drafts, person approves before send | High; human checkpoint on every outgoing message | Fast; typically seconds to approve a draft | Businesses where mistakes in customer communication carry high cost | | Auto-send with audit log | AI sends immediately, logs the action for review | Medium; mistakes reach recipients before you see them | Instant; no approval delay | High-volume templated messages where occasional errors are acceptable | | Human-only messaging | No AI; people write all messages manually | Highest; no AI errors | Slowest; every message written from scratch | Businesses that cannot tolerate any AI error in customer-facing communication | | AI suggests, human writes | AI surfaces relevant vault documents, person writes the message | High; AI does not draft the final message | Medium; person writes but with context at hand | Teams that want AI help finding information but not drafting messages |
The approval-first model balances safety and speed. The assistant does the work of reading the vault and drafting the message, so the person approving does not start from scratch. The approval step is typically a few seconds—read the draft, check the citations, click approve or edit—so it does not slow down customer replies or team communication in a way that defeats the purpose. The tradeoff is that the assistant never sends a message on its own, which means you cannot walk away and let it handle an inbox unsupervised.
Frequently Asked Questions
How do I let my assistant AI message other people safely?
Use an approval-first architecture where the AI drafts the message but waits for a person to review and approve before it sends. Every draft should show which documents or folders the AI read, so the approver can verify the source and catch mistakes before the message reaches the recipient. Restrict the folders the AI can read using role-based permissions, and treat the approval step as a review of both the draft and the information the AI used to create it.
What happens if the AI assistant reads the wrong folder and drafts a bad message?
The approval workflow catches that mistake before the message sends. When the assistant drafts a reply, it shows which vault documents it read. If it cites an outdated folder or a document that does not match the question, the approver sees that in the citation list and can reject the draft. The fix is to archive or delete the outdated folder, add the correct information to the vault, and ask the assistant to draft again.
Can I let the AI send messages automatically without approval every time?
You can set up automations that let the AI send templated messages based on strict rules you define once and approve at the design stage. The AI reads the folders you specify in the automation, fills in variables, and sends the message when the trigger event happens. This works for predictable, low-risk messages like appointment reminders or receipt confirmations, but the automation follows a template you reviewed, not a freeform draft the AI composes on its own.
How do I control which vault folders the AI can read when it drafts messages?
Set folder-level access controls in your business workspace. A folder can be shared with everyone, with team members but not viewers, or with owners and admins only. When you connect an external app, you choose which folders that app's AI can read. The assistant only drafts from the folders it can see, so restricting read access limits what it can accidentally include in a draft.
What should I do if someone on my team approves a bad draft without reading it?
Check the document history to see who approved the draft and when, then restore the previous version or delete the incorrect note if it was filed into the vault. Use the mistake as a training moment: walk the person through the citations the AI provided and show them how to spot a bad source. If the pattern repeats, adjust that person's role so they no longer have approval authority, or add a second approver for high-risk messages.
Does the AI assistant show which documents it read when it answers a question in team chat?
Yes. When you type @assistant in a team chat channel or direct message, the assistant replies with an answer and shows which vault documents it read—folder names and file names. If the assistant did not read anything from the vault for that particular reply, it marks that fact explicitly. This transparency lets anyone in the thread verify the source or challenge the answer before acting on it.
An AI assistant that can message other people becomes safe when it cannot send anything until a person approves it. That approval step is where you verify the draft, check the sources, and decide whether the message should go out. The assistant does the reading and the drafting; you do the final call. That division of labor keeps the assistant useful without making it autonomous, and it keeps your communication channels under your control.