The mayor’s office wants an agent to draft replies to batches of constituent email but not send them unsupervised. Which control is required?

A mayor's office agent that drafts replies to batches of constituent email but must not send them unsupervised requires an approval flow with staff sign-off before constituent replies are sent. Draft generation is a productivity win; unsupervised send turns speculative text into official mayoral communication. Approval flows are the standard control for semiautonomous civic correspondence: humans authorize release, tone, and policy alignment. A content filter that screens draft language for policy issues before replies are sent flags language but does not authorize release, so it cannot replace the required staff sign-off gate. A version history log that tracks draft edit history before replies are sent records changes but still does not provide the required pre-send approval checkpoint. An audit export that compiles draft replies for staff review before replies are sent organizes drafts for visibility but does not block unsupervised sending, so it provides review without the required pre-send staff sign-off. On the exam, approval-before-send is the required control for constituent reply agents; distractors include content screening, version history logging, or audit export of draft replies for review without formal sign-off. Caveat: batch approval UIs should still allow per-message reject/edit—rubber-stamping large batches recreates unsupervised risk under time pressure. Operational check: draft a batch of constituent replies, verify send and public publish are blocked, require staff sign-off, retain draft history for review, and confirm only formally approved messages leave the system.