Email Decision Record

Every email from a person or an AI agent gets a decision before it goes, and a signed record you can check without us.

When a person you have linked, or an AI agent working for your organisation, proposes to send an email, your policy decides first: send it, hold it for a named person to approve, or refuse it. Whatever the answer, a record is made. It is signed, it is time-stamped by an outside authority, and it is linked to the record before it, so a change or a missing record can be seen. Anyone can check it years later, offline, without asking us.

It works beside the mailbox you already use: Gmail, Microsoft 365 or any SMTP mail service. It adds a decision and a record. It does not replace your mail.

Records are held in New Zealand or the European Union, and they are yours to export.

See one email go through Check a sample record yourself How to get it

What it does

Four things, in the order they happen to an email.

It decides before the email goes

Your policy reads each proposed email and answers with one of three decisions, and the reason. The rules are plain. The owner or a moderator drafts and previews them, and only the owner adopts them, after signing in again. Nothing about a decision is guessed by an AI.

Send it, hold it for a person, or refuse it.
Rules on who it goes to (new recipients, addresses outside your organisation, addresses you watch or refuse), what it carries (attachments, large attachments, blind copies) and how many people it reaches.
Eight ready-made starting policies, with a preview of what each would have decided before you adopt one.
An owner can describe the email policy they want in plain words; an AI assistant fills in one of the starting email policies, and the owner checks the preview before adopting it.

It holds for a named person

A held email waits for an approver you have registered. The approver is shown the exact message and attachments, and the release is only valid for what they were shown.

Four-eyes by default: the person who registered an agent cannot approve that agent's held email. A sole owner can turn this off when adopting a policy.
Approvers are reminded partway through and near the end of the hold window. A held email that is not answered in time can no longer be released, and its expiry is recorded.
A policy can require two different approvers before an email is released.

It records every decision

Each decision, each release or refusal and each send is a signed receipt. A receipt says whether a person or an agent proposed the email, and names the exact message and every attachment by a fingerprint, so the record can prove what was sent without holding the words.

Signed with an Ed25519 key, and linked to the receipt before it.
Receipts are gathered each day into a single signed root.
Replies that arrive in a mailbox you connect for capture join the same record, with the sender checks (SPF, DKIM, DMARC, ARC) noted.

It lets anyone check, offline

An outside European time-stamping authority stamps the record, so the time does not rest on our word. A standalone checker verifies a record in a browser or from a file, with no account and no call to us.

The checker returns a plain result for each record and says what it could not check.
A dossier export carries the records in an open format, a README and a copy of the checker.
Years later, a regulator, a client or an auditor needs nothing from us to read it.

Incoming mail joins the same thread

A decision about an email is only half of the story. The reply is the other half.

Replies are captured into the record

Connect a mailbox for capture and each message that arrives is recorded the same way an outgoing one is: a signed receipt that names the message and its attachments by fingerprint, without putting the words in the signed receipt (the message is kept encrypted in a separate vault and can be erased). The receiving mail system checks the sender (SPF, DKIM, DMARC and ARC), and the receipt records those checks. A gap in capture is itself recorded rather than hidden.

Capture is available on request, from a mailbox you connect, and runs beside your own mail.
Senders are held as pseudonyms in a register, so the record can say that two messages came from the same correspondent without storing their address in the open.

People who write to you for the first time wait to be sorted

Each new person who writes in appears in a list for the owner, shown only as a reference with no address or subject. The owner marks them as known, approved or blocked, and each choice is signed into the record as its own receipt, with the choice made by a person.

Outgoing mail to a blocked person is refused, including address variants with a plus tag and messages already waiting for approval.
Blocking someone needs a fresh sign-in, and so does lifting the block.

One view of the whole conversation

The thread view joins what you sent, what was decided about it, what was handed over for delivery and what came back, into one conversation, using the fingerprints already inside the signed receipts. Reading it changes nothing and signs nothing.

The same joining is used when you export a dossier, and by the offline checker.
Messages that cannot be tied to a conversation are shown as separate rather than guessed at.

How it fits with what you already use

Your mailbox stays your mailbox

Email Decision Record sits beside Gmail, Microsoft 365 or any SMTP mail service. Mail goes out through your own account once it is allowed or released. We set up Microsoft and Google connections with you on request.

Built for AI agents as well as people

An AI agent proposes its email through a programme interface or an MCP server, and gets the decision back. The record shows whether it was a person or an agent.

Nine MCP tools: propose, check a decision, fetch a receipt, list held emails, release, fetch a record, verify, export a dossier and simulate.
A sandbox for testing an agent: it answers from a fixed published table rather than your policy, so an agent can be tried against each of the three decisions, and nothing is sent. Sandbox receipts are signed with a separate sandbox key, and the checker marks each one as a sandbox receipt, so it never passes as verified evidence.
Keys per agent, which you can create, rotate and revoke.
A spending ceiling on each agent key, and a cap on how many of an agent's emails can wait for approval at once.
Each receipt can name the mandate held for the agent at the time, and an email is refused when the mandate in force does not permit the agent to send email.

Your records, kept as long as you choose

You set how long records are kept, from thirty days to seven years, per mailbox. Messages are sealed one by one, so deleting a message destroys its key while the receipt and its fingerprints remain.

An erasure certificate is issued, and the record still passes the checker.
You can leave at any time with a full export; your stored records are then purged and you are given a certificate.
Signing keys can be held on a separate signing host, outside the application that writes records, and MDSL operates that host. A 2-of-3 split-key scheme is built and deployed and is available on request; the first step is choosing the custodians. Your Order Schedule states where your key is held.

One email, from proposal to proof

A demonstration with a fictional trust. The names, the email and the figures are invented; the sequence and the record fields are what the product does.

An agent proposes an email
The Fernside Trust runs an assistant agent. It proposes to send the annual grants summary, with a spreadsheet attached, to an address the trust has never written to.
The policy decides: hold
The rules "new recipient" and "attachment going outside" both apply. The decision is hold, and the reasons are written down. Nothing has been sent.
A named person approves
Aroha, a registered approver who did not set the agent up, is shown the exact message and the spreadsheet. She releases it, and her reason is recorded.
The email is handed to the trust's own mailbox
The email goes out through the trust's Microsoft 365 account. The record notes that it was handed over for delivery. It does not claim that it arrived or was read.
Three signed receipts exist
A decision, a resolution and a send confirmation, each signed and each pointing at the one before. The day's receipts are gathered into one signed root and time-stamped by an outside authority.
Two years later, an auditor checks
The trust exports a dossier. The auditor opens the checker in a browser, loads the file and sees each receipt checked, with no account and no call to us.

What the decision receipt carries (fictional values)

Fields of a decision receipt, what each holds and why it matters
Field	Example	What it shows
Who proposed it	agent: grants-assistant	Whether a person or an agent submitted the email.
The decision	hold: new recipient, attachment going outside	What your policy decided and why.
The message	fingerprints of each recipient, the subject, the body and the spreadsheet	Exactly which message, without storing its words in the record.
The link	points at the receipt before it	A removed or altered receipt shows as a break.
The signature	Ed25519, by the trust's own signing identity	Who made the record, checkable without us.
The time	daily root stamped by an outside authority	When the record existed, not just when we say it did.

Try it: check a genuine sample, then a copy with one character changed

The checker page includes two sample dossiers signed with a demonstration key. The second differs from the first by one character in the subject, and the checker shows exactly where.

You will want it when

a board, a regulator or a client asks what your organisation sent, who sent it and who said it could;
your records must stay under New Zealand or EU jurisdiction;
an email, from a person or an AI agent, is about to go and cannot be taken back;
AI agents send on your behalf and you need a named person between the agent and the outside world;
a payment instruction, an invoice or an attachment is going to a new address, and someone should look first.

How to get it

Email Decision Record is a managed service, available on request. There is no self-service signup.

Ask
Tell us who you are and what you want to govern. We reply with a time to talk.
Evaluate
We send a one-time link tied to one address. It opens an evaluation Village, so you can watch a real decision and its record in the console.
Order
Your order form names the plan, the number of agents and mailboxes, and whether your records are held in New Zealand or the European Union. Billing is through Airwallex, a New Zealand company.
Connect
We connect your mailbox with you, set your first policy from a starting template, register your approvers and agents, and check a first record together.

Standard

For a small team or a first agent: two agents and two mailboxes.

— /month per organisation

— /month for each further AI agent

— per qualified time stamp, on request

Assured

For several agents and mailboxes: six of each.

— /month per organisation

— /month for each further AI agent

— per qualified time stamp, on request

Enterprise

Larger numbers and your own arrangements, agreed in the order form.

from — /month per organisation

No GST is added.

Ask for an evaluation Read the guide

What it does not do

It shows whether a record has changed. It does not stop a change, and it does not show that a message was delivered or read.
It is not a mail security gateway. Its screening of incoming mail is optional. It checks sender authentication, domains made to look like another domain, links and attachment types, and reports what it found. It never blocks a message and does not scan attachments for malware. Keep your own gateway.
It governs mail that goes through it. We have built a Gmail add-on; it is offered once its card wording is written. There is no Outlook add-in.
Timestamps come from an outside authority; qualified timestamps are available on request. It is not legal advice.
Some parts are built and are turned on by arrangement when we set up your connection: approver reminders and the expiry record, refusing mail to a blocked correspondent, plain-language policy drafting, and the mandate citation and check.

Ask about Email Decision Record

Evaluation access is by invitation: a one-time link, issued at our discretion.

Check a record yourself, in your browser, with no account needed.

Check one email

About the consignment file →