# Safe automatic replies to prospects

> What must be true before software answers a sales reply on its own: approved links and figures, confident intent, caps, a delay you can cancel, a kill switch.

Source: https://docs.ayinbox.com/learn/safe-automatic-replies/

An automatic reply is safe only when what it may say, who it may say it to and when it must hand off are fixed in advance and checked again at send time. In AY Inbox, a campaign's automatic answers may carry only links and figures a person approved, go only to the contact's stored address in the same thread, and hand any unsure or sensitive reply to a person.

An **automatic reply** here means an answer an AI writes and sends with no person approving it. That is different from an AI draft, which a person reads and sends. AY Inbox's [auto-reply](/guides/auto-reply/) is off by default at three levels (the instance, the workspace and each campaign), and this page explains the guardrails behind it and why each one exists.

Start supervised [#start-supervised]

Do not begin with sending. Supervised mode runs every check and sends nothing: each answer arrives as a normal pending draft, marked either "would have sent automatically" or with the reason it would have asked you. The campaign panel then totals the result in a line such as "Last 30 days: 18 would have sent, 15 sent as written, 2 edited, 1 discarded".

That line is the evidence you need. The confidence thresholds below are fixed in code, not tuned to your market, so supervised drafts are how you find out whether they suit your replies. A practical order:

1. Fill in the campaign's [brain](/guides/campaign-brain/) or the workspace product description, so there is something to answer from.
2. Set the campaign to Supervised and let it run on real replies.
3. Read every draft. Count the ones you would have edited or discarded, and note why.
4. Approve the links and figures the answers need.
5. Switch to Automatic only when the edit count is one you can live with.

Automatic stays unavailable until the campaign passes a checklist: stop on reply is on, no reply branch leads to another email step, and there is something to answer from. Turning it on needs the **Send campaigns** permission and a recent sign-in confirmation.

Fix the recipient and the facts [#fix-the-recipient-and-the-facts]

The model writes body text and nothing else. The recipient, the sender, the subject and the threading come from AY Inbox's own records: an automatic answer goes only to the contact's stored address, from the mailbox the contact wrote to, in reply to a message of ours, in the same thread.

What the body may contain is bounded the same way:

| Rule       | Detail                                                                                                                |
| ---------- | --------------------------------------------------------------------------------------------------------------------- |
| Links      | Only entries in the campaign's **Approved links**, each a full `https://` address with a public host name, at most 20 |
| Figures    | Only entries in **Approved figures**, each holding a number, at most 40 characters, at most 20                        |
| Length     | Plain text, at most 1,200 characters and 15 lines                                                                     |
| Format     | No markup, no tracking pixel, no link wrapping, no invisible characters                                               |
| Do-not-say | No phrase on the brain's do-not-say list                                                                              |

Nothing widens the approved lists at send time: not the inbound email, not the brain, not your product description. Anything shaped like a web address counts as a link, including a dot written out (`acme dot top`), spaced or bracketed. The answer is checked again just before it leaves, against the lists as they are at that moment, so removing a link after an answer was written still stops it.

A second reading then looks at the written answer as a whole. It refuses an answer that promises a discount, refund, contract term, delivery date, guarantee or legal position; proposes a specific meeting time; describes other customers or internal notes; mentions its instructions or says software wrote it; or asks the reader to call, visit, pay or download something other than through an approved item. If that check cannot run, the answer is not sent. Automatic answers also read only the brain's public facts, never its internal rules or internal material. See [a knowledge base for AI sales replies](/learn/campaign-knowledge-base/).

Only answer what is clearly answerable [#only-answer-what-is-clearly-answerable]

A reply qualifies only when [inbox tagging](/guides/inbox-tagging/) has a confident verdict on it, and every one of these holds:

| Check               | Required                                                                                                                                                         |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| It is a human reply | Confidence of at least 0.70, with no review flag                                                                                                                 |
| Its intent          | One the campaign allows, at confidence of at least 0.80                                                                                                          |
| Blocking signals    | Each answered and below 0.30: asks to be removed, threatens legal action, hostile tone, needs human judgement, names another contact, contains a scheduling link |
| Sentiment           | Neutral or warmer                                                                                                                                                |
| Effort              | More than a one-line acknowledgement                                                                                                                             |

The intents a campaign may allow are `agreed`, `scheduling`, `wants_info`, `question_answered` and `wants_pricing`, and the default leaves out `wants_pricing`. The intent floor sits above the floor used for labels on purpose: sending asks more than filing. A blocking signal that is merely unsure still blocks. How the verdict itself is reached is covered in [classifying cold email replies](/learn/reply-classification/).

The message must also be ordinary: in the inbox folder, under an hour old, at most 4,000 characters once quoted history is removed, from the contact's stored address with nobody in Cc, keeping the subject of the email it answers.

Never answer these [#never-answer-these]

Some replies go to a person whatever a setting says:

* an opt-out request, which is handed off with no AI text at all (see [handling opt-out replies](/learn/handling-opt-out-replies/))
* legal or complaint language
* out-of-office and other automatic replies, ticket receipts, bounces and notifications
* the intents `not_now`, `not_interested`, `wrong_person`, `opt_out`, `unclear` and `in_progress`
* a hostile tone, a reference to an attachment, cold inbound and internal mail
* anything the classifier could not read with confidence

The opt-out and legal checks run before the classifier's verdict is read, so a person asking to stop never receives AI-written text. No verdict, or an unsure one, means no automatic answer.

Cap it [#cap-it]

Caps bound the damage of a mistake you have not spotted yet. They are fixed limits, not settings:

| Limit                                              | Value                                                |
| -------------------------------------------------- | ---------------------------------------------------- |
| Automatic answers per thread                       | The campaign's setting, 2 by default, at most 5      |
| Per contact                                        | The same setting in total, and at most 2 in 24 hours |
| Between two answers in one thread                  | At least 10 minutes                                  |
| Per mailbox in 24 hours                            | 20, and never above the mailbox's campaign limit     |
| Model calls per thread and per contact in 24 hours | 3                                                    |
| Model calls per workspace in 24 hours              | 200                                                  |

A reply that arrives within 2 minutes of our answer is never answered automatically, which keeps two programs from talking to each other.

Leave room for a person [#leave-room-for-a-person]

An answer is scheduled 60 to 150 seconds after the reply arrived, and never sooner than 30 seconds after it was written. That delay is a window for a person to step in:

* **Cancel** on the thread card stops one answer.
* Opening the composer on the thread cancels a pending answer.
* **Edit first** turns it into a normal draft you send yourself.
* Once a person has written in a thread, auto-reply stays out of it for good.

A reply sent from your own mail client is only seen once its Sent copy syncs, so the delay narrows that overlap but cannot close it.

The kill switch and the run log [#the-kill-switch-and-the-run-log]

The workspace switch under **Settings, Workspace** is the kill switch, and **Stop all auto-replies** on a campaign's Auto-replies tab turns that workspace switch off. A campaign's Off and a single answer's Cancel stop less. None asks for confirmation, and anyone with inbox access can use them.

The Auto-replies tab is the run log: every reply the campaign handled, its status, the reason, the intent and how long the answer took. A row opens the inbound message, the written answer and each check's result. A handoff notifies members under **Auto-reply needs you**, and an answer whose outcome is unknown is never sent again.

What no check catches [#what-no-check-catches]

A persuasive, wrong answer that stays inside the facts you gave passes every check above. No link or figure check knows whether your pricing note is out of date or whether a sentence oversells. Supervised mode, the per-thread cap, the kill switch and the run log are how you watch for that, and an accurate brain is how you prevent it.

No wording and no check guarantees inbox placement or stops a mailbox provider from acting on your account. For the drafting side of the same problem, see [AI replies to cold email](/learn/ai-replies-to-cold-email/).

## Frequently asked questions

### Is it safe to let AI reply to sales prospects automatically?

It can be, when what the reply may say, who it goes to and when it must hand off are fixed before anything is written and checked again at send time. In AY Inbox, automatic answers are off by default, carry only links and figures a person approved, and hand any unsure or sensitive reply to a person.

### How do I stop every automatic reply at once?

Turn off the workspace switch, which is the kill switch. In AY Inbox, Stop all auto-replies on any campaign's Auto-replies tab turns that switch off; it needs no confirmation and anyone with inbox access can use it.

### Does AY Inbox answer pricing questions automatically?

Not by default. The pricing intent is left out of a campaign's default allowed intents, so a reply asking about price goes to a person unless a member with send permission adds that intent.

### How many automatic replies can one prospect receive?

In AY Inbox, at most 2 per thread by default (a campaign can allow up to 5), the same total per contact, never more than 2 to one contact in 24 hours, and at least 10 minutes apart in one thread. Each mailbox sends at most 20 automatic answers in 24 hours.

### Will an automatic reply go out in the middle of the night?

Only if the campaign's sending window and the mailbox's working hours allow it. In AY Inbox, a reply that arrives outside the sending window waits for it to open unless the campaign turns that wait off, the mailbox's own working days and hours always hold, and an answer that waits more than 72 hours becomes a draft instead.