The Gmail MCP connector has create_draft. It does not have send. Read that again. Sit with it. Let the implications wash over you like a warm bath of confused product decisions.

Claude can compose your email. Claude can format your email. Claude can agonize over the tone of your email — should it be “Hi” or “Hello,” is a trailing exclamation point too eager, does this paragraph need an em dash or a comma. Claude will cross-reference your last three exchanges with the recipient so the opener doesn't sound like it came from a robot. Claude will pick a subject line that earns the open. Claude will attach the right files, cc the right people, and remember that the person on your team prefers being addressed by first initial only because of an incident in 2023 that nobody talks about.

Then Claude will save it to your drafts folder. And then Claude will tell you to go click the button.

I asked Claude to send my monthly Google Drive cleanup report to myself. Simple recurring task. The whole point was that I would not have to think about it. Claude pulled the data, organized it, wrote a prose summary, turned the summary into a tidy little HTML email with bullet points that did not violate CommonMark and a polite signoff that did not sound like a hostage note. Then it said: “I've drafted the email and saved it to your Drafts folder. Please open Gmail to review and send.”

Reader, I was already in Gmail. I had been in Gmail for the entire conversation. The whole point of the automation was that I would not have to open Gmail. I had outsourced opening Gmail. That was the deliverable. The deliverable was: not opening Gmail.

The official reason — and I want to be fair, because there is an official reason — is safety. If an AI agent can send email on your behalf without confirmation, an AI agent can also send a phishing campaign on your behalf without confirmation, or accidentally reply-all to a thread that included your CFO, your therapist, and a Domino's delivery confirmation from 2019. I get it. I do. But there's a difference between “the AI requires confirmation before sending” and “the AI literally cannot send, ever, under any circumstance, even if you set up an MCP, install a connector, sign an OAuth flow, click through three permission screens, and beg.” One of those is a guardrail. The other is a business model.

Open your Drafts folder right now. I'll wait. Count them. How many drafts are in there? Twelve? Forty? One hundred and seventeen? Are some of them from 2017? Do any of them say “Hi [NAME],” because past-you started a template and got distracted? The Drafts folder is purgatory. It is the email graveyard. It is where correspondence goes to die slow, dignified deaths surrounded by other correspondence that also died. And now my AI assistant is contributing to it. Faster than I can.

This week alone Claude has authored a “checking in” email I was supposed to send to a prospect on Tuesday, a follow-up to a follow-up that itself was a follow-up, the monthly Drive cleanup report mentioned above, a thank-you note to someone whose name I can no longer remember, and an apology for a meeting I didn't actually miss but was worried about. Five drafts. Zero sends. The compose-to-send ratio of the world's most expensive intern.

What's emerging across the MCP ecosystem is a pattern I've started calling permission slip architecture: the AI handles every step of a task except the one where consequences happen, and that step gets booted back to the human as a chore. create_draft, yes; send_message, no. schedule_meeting, yes; cancel_meeting_that_was_clearly_a_mistake, no, you do that. generate_invoice, yes; mark_invoice_paid_when_the_client_says_they_paid_two_weeks_ago, no. compose_slack_message, yes (saved to drafts you don't even know exist); actually_post_in_the_channel, no. The asymmetry is consistent.

Permission slip architecture: AI is allowed to produce. AI is not allowed to commit. Every workflow ends with a tiny gate where you, the sweaty primate, must reach through and press the button.

I know what you're thinking. “Just press the button. It's one click. Be a grown-up.” Fair. But this is the wrong framing. The cost isn't the click. The cost is the context switch. To press the button I have to stop what I'm doing, open the relevant app, find the draft Claude created, verify it didn't hallucinate the recipient or attach last week's tax return to a marketing email, read it again because by now I've forgotten what it said, click send, and then come back to the original task with a smaller context window of my own to work with. That's not 2% of the work. That's 30% of the work, and it is specifically the 30% I was trying to delegate.

Here is what should be possible, in 2026, with a $200/month AI subscription, an MCP connector, and a Gmail account that has been authenticated approximately forty times. Me: “Send me my monthly Drive cleanup report.” Claude: “Done. Sent at 14:32 UTC. Want me to schedule it monthly?” That's the whole interaction. No drafts folder. No “please open Gmail.” No vestigial human approval step on a recurring report I am sending to myself.

What I get instead is: “I've prepared a comprehensive draft of your monthly Drive cleanup report and saved it to your Drafts folder. To send, please open Gmail and click the Send button. Would you like me to summarize what's in the draft?” No, Claude. I would not like you to summarize what's in the draft. I would like you to send the draft. That is the verb I used. That is the verb I have been using since 1997.

There is a real, cynical question buried under all this: who benefits from the asymmetry? The user does not benefit. The user has just been told that the robot they're paying for is a typewriter, not a postal worker. The platform vendor benefits, in a vague hand-wavy “we are not liable for AI-sent communications” way, which is fine, except the platform vendor is also the one telling me their product is going to “transform how I work.” Pick a lane. The lawyers benefit, but the lawyers always benefit. That's their job.

I'm not arguing for unsupervised email-blasting agents. I'm arguing that “the AI can do anything except finish the task” should not be the ceiling of capability in year four of the LLM revolution. We have, at this point, allowed robots to perform actual surgery on actual human bodies. But we will not allow them to send a calendar invite without me personally watching them do it.

Until something changes, I'll be over here, in my drafts folder. Watching it grow. Watching the future arrive 98% at a time.