User-context sending is valuable only when the connected identity, allowed From address, consent, review policy, and submission result are visible and auditable.
Obtain the provider's send permission for the user or an approved enterprise access model. The sender must be the mailbox or an alias the provider permits; an API must not turn a supplied From string into impersonation.
Validate recipients, subject, text and HTML alternatives, attachments, and reply headers. Respect provider size limits and encode MIME correctly before using Gmail, Graph, or SMTP submission.
Store who requested the send, which policy allowed it, the final content version, and whether a human approved it. An idempotency key must prevent queue retries from sending the same message twice.
Return the provider's accepted message ID and timestamp. Mailbox APIs generally do not prove an open or final delivery at send time, so later engagement or delivery claims require separate, provider-supported evidence.
No. The provider and mailbox configuration determine valid sender identities and aliases. Reject any address the authenticated account cannot use.
Default to a draft or explicit approval. Customers can define narrower automated cases, but the connector should preserve the decision and approval evidence for every send.
Not yet. Gmail, Microsoft Graph, and IMAP/SMTP connectors are planned. This guide documents the intended architecture and the provider requirements a production release must satisfy.
DewEngine is in development. Real use cases decide what ships first.