Sixteen checks before a draft leaves

Approval is the moment a human reads a draft and says yes. It is necessary. It is not sufficient, because between “yes” and “sent” the world can move: the recipient can unsubscribe, the research can be paused, a newer reply can arrive, the sender address can change, the draft itself can be edited.

So approval is not what authorises a send here. The gate at the exit is, and it runs every time, on a draft that has already been approved. Sixteen checks, in order, and the first failure stops the message.

Nothing in this list is clever. It is a list of the specific ways an outreach system embarrasses the person operating it, written down so they cannot happen twice.

Who and what

Ownership. The person exporting must hold an operator seat in the account that owns the site. Not “must be the account holder” — an agency has staff, and every action is recorded against the human who took it rather than a shared login.

Direction. Outbound only. An inbound message is a record of what someone sent you; there is no version of exporting one that is correct.

Workflow state. The draft must be approved or already exported. A draft still being written is not a thing to send.

Approval currency. A human must have approved it, and the approval must still match the text. The approved body is fingerprinted. Edit a word after approval and the fingerprint stops matching, and the message stops being sendable until someone approves it again. This is the check that prevents the oldest trick in the category: approve a polite draft, then change it.

Consent and jurisdiction

Compliance. The operator must have accepted the current policies and the outreach attestation. A policy update genuinely blocks sending, on purpose.

Tenancy. The research must belong to the site, and the page to the research. A chain that has come apart usually means a bug somewhere upstream, and the right response to an inconsistent chain is to refuse, not to guess which link is right.

Sender identity. The from-address must still be the one the draft was approved under. If the site’s sending identity changed after approval, the approval was for a different email than the one that would go out.

Recipient identity. The to-address must still match the conversation. For a reply, that means the address that actually sent the last inbound message. For an initial, it means the page’s contact address and the thread’s recorded recipient. This is the check that stops a message being redirected by a data change nobody noticed.

Page approval. For an initial message, the page must still hold approved, current evidence. Evidence that was withdrawn or superseded takes its drafts down with it.

Jurisdiction. The recipient’s jurisdiction must be one we are approved to contact. Where someone is determines what may lawfully be sent to them, and that is not a runtime detail to work out after the fact.

The state of the conversation

Conversation. Three failures live here, and they are the ones that cause real damage:

• the thread is on outbound hold and this is not the authorised reply;
• a newer inbound reply arrived after the draft was approved;
• the thread’s status does not permit this kind of message.

The middle one deserves a sentence of its own. Someone replies to you. Ten minutes later a follow-up that was approved yesterday goes out, ignoring what they just said. To the recipient that is not an automation glitch; it is proof that nobody is reading. The timestamp comparison that prevents it is two lines long and it is one of the most valuable things in the file.

Research. The research must be active. Pausing has to actually pause.

Site. The site must be entitled under the current plan, operationally active, and configured for export.

The recipient’s own record

Suppression. A suppressed address is never contacted, for any reason, under any research on that site. Suppression is the one signal that outranks everything above it.

Cooldown. For an initial message, the recipient must be outside the site’s cooldown window. Two agencies-worth of enthusiasm arriving at the same editor in one week is how a domain earns a reputation it cannot spend.

Final lint. The message is re-linted at the exit — link count, formatting, the patterns that make a message read as bulk. A draft approved a week ago is checked against the rules as they are today.

Why the exit, and not the entrance

Every one of these could be checked when the draft is created. Most of them are, and that is where the useful error messages live: it is much kinder to tell someone their research is paused while they are looking at the research.

But a check at the entrance answers a question about the past. The only check that can answer “is this safe to send now” is the one that runs now. So both exist, and the one at the exit is the one with the authority.

There is a related principle worth stating plainly: the export path deliberately skips the transport, DNS, scheduling, and send-capacity checks, because a manual export does not use our transport — you send it from your own mailbox. It skips none of the checks that protect the person who might receive it. Those are not features of a delivery mechanism. They are the reasons the message is allowed to exist.