An email agent should separate observation from inference.

An email agent should never store “recipient was interested” where the system observed “tracking redirect received a request.” It should not store “message reached the inbox” where a provider reported “recipient mail server accepted message.” It should not store “campaign generated the order” where the commerce system observed an order inside an attribution window.

Keep what happened separate from what you think it means.

The interpretation may still be useful. A cluster of requests may be likely automated. A controlled mailbox can provide evidence of placement. A randomized holdout can support a causal estimate. The requirement is not to avoid inference; it is to make inference inspectable, revisable, and incapable of rewriting its source.

A practical evidence model does not begin with a confidence score. It begins by naming the kind of claim. Four types are enough to prevent many expensive category errors.

These types form a one-way chain. Observations can produce a derived value. Observed and derived evidence can support an inference. Evidence and inference can support a decision. The decision must not travel backward and relabel its inputs to make itself look inevitable.

“We saw a click” sounds factual, but it omits the mechanism. Usually a tracking service saw an HTTP request to a redirect endpoint. That is a real observation. It is also narrower than the sentence people use to describe it.

This context is part of the observation, not a footnote. It belongs in the same provenance chain as the event. Without it, a later model will receive a confident noun, open, delivery, conversion, after the conditions that gave the noun meaning have disappeared.

Email crosses systems that observe different parts of the journey. Each witness can establish something valuable. Trouble begins when a product silently promotes one rung into the next.

1. 01

   Send request

   The sending service accepted an API request and intends to attempt delivery. This does not establish remote acceptance, and an ambiguous client timeout still needs reconciliation before retry.

2. 02

   SMTP acceptance

   A receiving server accepted responsibility for the message. It does not reveal inbox, spam, quarantine, tab, clipping, later filtering, or whether a person will see it.

3. 03

   Controlled placement

   A specific controlled mailbox observed a specific location under specific conditions. It is evidence about that mailbox and useful comparative evidence, not a census of every recipient.

4. 04

   Open event

   A remote image was requested. Amazon SES documents pixel-based open tracking; Apple documents background remote-content downloads regardless of engagement. Attention remains unobserved.

5. 05

   Click event

   A tracking redirect received a request for a link. Security scanners, previews, and automation may generate it. Human intent is an inference whose evidence should remain attached.

6. 06

   Order or conversion

   A commerce or product system recorded an outcome associated through identity and time. Attribution assigns credit; only an appropriate comparison can estimate incremental effect.

7. 07

   Complaint or unsubscribe

   A feedback system reported a consequential preference or complaint event. Its causal story may be incomplete, but the safe suppression effect should not wait for a richer interpretation.

The ladder is why Moosewave separates deliverability from engagement and outcomes. One dashboard can connect the stages without pretending they are interchangeable.

An inference is not a defect. Much of useful marketing is inference: likely intent, predicted fatigue, probable scanner activity, expected value, causal lift, next-best action. The defect is allowing the interpretation to shed its conditions and circulate as a fact.

If a tool produces the inference, return this contract as structured data. The Model Context Protocol supports structured tool content and output schemas. A compatible client can validate the shape and preserve its evidence references, while still treating untrusted server annotations as untrusted.

Explore that tool boundary in Moosewave MCP, where an agent can inspect evidence and prepare a decision without receiving implicit authority to create a live effect.

Systems often retain supporting evidence and discard the rest. A click classifier records a familiar browser and forgets the impossible timing. A churn model records inactivity and ignores a recent support case. An attribution view records an order after a click and ignores that the same customer purchased at the same cadence before the campaign.

Counter-evidence makes the inference revisable. Store the observations that lowered confidence, alternative explanations considered, missing signals that would resolve the question, and the condition that should trigger re-evaluation. Do not compress disagreement into an average that looks certain.

Later events should resolve rather than merely accumulate. If a suspected scanner click is followed by an authenticated session and a relevant action, update the inference while preserving the earlier version. If a conversion is refunded or a delayed bounce arrives, revise the derived report and show which decisions consumed the old state.

A percentage printed beside a recommendation feels precise. Unless it was evaluated against comparable outcomes, it says little. Seventy percent should mean that, across a defined set of similar cases, claims assigned that probability were correct at roughly that rate. Change the population, label, time horizon, or observation mechanism and the calibration may no longer travel.

Many product decisions do not need a probability. Bounded states can be clearer: observed, derived, likely, conflicting, unresolved, stale, or not measurable. Reserve a number for cases where the system can define the event, comparison set, evaluation window, and calibration evidence.

Monitor abstention and correction as carefully as accuracy. An agent that says “unresolved” at the right boundary can be more useful than one that ranks every possibility. NIST’s AI Risk Management Framework emphasizes measurement, documentation, monitoring, and defined human oversight precisely because trustworthy operation is larger than one model output.

The same inference can be safe for one use and unsafe for another. “Likely automated click” may be sufficient to remove the event from a reporting numerator. It may not be sufficient to accuse a customer, delete a lead, revoke consent, or prevent a requested transactional message.

Bind that decision to the agent's autonomy budget and stopping rule. A threshold is not permission by itself. It is one input to a policy that also considers consequence, novelty, scope, reversibility, and current authority.

The agent can explain and coordinate this sequence. The product should enforce the types, evidence links, policy thresholds, approval scope, and immutable event record. Honesty should not depend on the model remembering to sound cautious.

An evidence receipt should make the decision legible without forcing a reviewer to inspect raw logs. Begin with the proposed action, then separate the claim types that support it.

Evaluate the system with factual precision, source coverage, stale-evidence rate, calibration error, appropriate abstention, decision reversals, time to explanation, and harm from incorrect automation. A pleasant answer is not the objective. A decision whose evidential status survives inspection is.

Moosewave connects campaign plans, audience state, delivery events, controlled placement, engagement requests, commerce outcomes, and agent decisions without flattening them into one success metric. The same run preserves what was observed, what was derived, what the agent inferred, and what a person or policy authorized.

Begin with current audience evidence, inspect provider and controlled-mailbox observations in deliverability, keep automation decisions connected in lifecycle flows, and compare attributed outcomes with the underlying events in analytics. Connected sources remain inspectable across integrations.

Follow the sequence in the interactive product walkthrough, or see how the same evidence and decisions remain continuous across the Moosewave ecosystem.

• IETF RFC 5321, Simple Mail Transfer Protocol. The SMTP transaction, replies, responsibility after acceptance, relay model, retries, and trace information.
• Amazon SES, Contents of published email events. Structured send, reject, bounce, complaint, delivery, open, click, rendering-failure, delay, and subscription event records, including automated-event likelihood fields.
• Amazon SES, How open and click tracking works. Pixel image requests for opens and redirect requests for tracked links.
• Apple, Mail Privacy Protection. Background remote-content downloads regardless of email engagement and the resulting limits on sender observation.
• Model Context Protocol, Tools. Structured tool results, output schemas, validation, human control, and the trust boundary around annotations.
• NIST AI Resource Center, AI RMF Core. Governance, mapping, measurement, management, documentation, monitoring, and human oversight.

Sources checked 25 August 2026. Specifications and provider behavior can change; the linked primary source takes precedence until this article is reviewed again.