Skip to main content
The phone agent can draft and send messages in the apps you actually use - WhatsApp, SMS, email - because it operates the real UI. The pattern that makes this safe is the confirmation gate: instruct the agent to show you the message and wait for your OK before sending.

​
The basic pattern

What happens:
  1. The assistant starts a phone_run_task and waits on the monitor.
  2. The agent drafts the message and pauses for your approval - either in your AI client’s conversation, or as a needs_user_control handoff if the phone itself needs confirmation.
  3. Only after your OK does the message go out.
Always include the confirmation gate for anything that sends. Without it, you are trusting the agent’s first draft with your name on it. Make “show me first” part of the prompt, not an afterthought.

​
Prompt patterns that work

Be explicit about recipient, content, and the gate:
Disambiguate up front. Contact pickers, group chats with similar names, and multiple messaging apps are where messaging errands go wrong. Tell the agent what to do when it is unsure - ask, never guess. Reading is simpler than sending. No gate needed for read-only errands:

​
When the phone hands control back

If the messaging app throws something sensitive - a login screen, a verification prompt - the task completes with terminal: "needs_user_control" rather than the agent pushing through. Your assistant relays what is needed; you complete the step on the device or answer in chat, and the workflow continues as a continuation task. The full loop is in Task lifecycle.

​
Multi-message workflows

Keep related sends in one session so the workflow stays on one device:
The assistant runs this as sequential tasks in one session - calendar read, then message draft - reusing the session_id. See Session management.

Task design

Confirmation gates, disambiguation, output contracts

Security

Why sends should always be supervised