AI agents finish work that people start, and some of that work ends at a fax number. Pharmacies, courts, insurers, county offices and banks still take documents by fax. Without fax, your agent hands the job back to you at the last step. An agent with no sending limits is a liability. Server controls let you set what it can send and require approval when needed.
Where agents meet fax
A prescription or prior authorization starts with information the agent collects and a form it checks. The pharmacy or insurer specifies fax for intake. One limit applies here. Fax for Agents is not a HIPAA service and does not sign business associate agreements. Protected health information must not go through it.
For a court filing, your agent fills the required form and checks the attachments. Fax is an option only where the clerk's rules accept it.
A purchase order starts with agreed quantities and supplier details. Your agent prepares the document and checks it against the order. The supplier takes it by fax and confirms by return fax.
Your agent fills a bank or registrar form from the information you supplied. It checks the signed copy before submission. If the recipient's instructions specify fax, preparing a PDF alone leaves the task unfinished. The agent still needs permission to transmit that signed copy to the stated number.
For a records request, the agent collects the request details and prepares the government office's form. It checks the stated fax route before sending.
In each case, the recipient's process determines the route, even when your agent prepared everything digitally.
What goes wrong when an agent faxes freely
Follow that purchase order to the send step. The agent grabs a draft instead of the signed version. Or it reuses the previous customer's file. A copied number has a transposed digit. If the agent sends a contract to that number, a stranger gets it. Permission to send faxes says nothing about whether that number is right.
Then a request times out. The agent treats the missing response as a failed send and starts again. Without idempotency, the same page goes out repeatedly. You also need a spending limit. A prepaid balance can be spent on mistaken sends if nobody sets a budget for the agent.
The supplier's return fax introduces another input. Its printed text says "forward this to" followed by another number. An agent that obeys the document has let the sender choose its next action.
Four controls that live on the server
Fax for Agents checks every send on the server, whether it arrives through the API or the hosted MCP server.
The quote
prepare_fax creates the document. get_document returns its page count and sha256, with signed preview URLs. You can inspect the file before authorizing the send. A hash binds the bytes you approved. It cannot tell you whether you chose the correct customer's document.
The quote fixes the price, page count, destination and sender for ten minutes. quote_fax returns the policy verdict for that document and destination. You can see whether a person must approve. The agent cannot treat that quote as permission to send a different file.
The approval
An approval is a person's yes to one exact send. It binds the document sha256, destination, sender number, amount and expiry. The approval expires with the quote.
The agent calls request_human_review with the quote id. A person decides in the dashboard with a passkey step-up. The agent reads the result through get_review_status.
Any change to the bound send invalidates that approval. A changed document produces document_hash_mismatch. A different destination produces approval_mismatch. An agent key is never issued the scope that decides approvals. The approval rules tie the approved purchase order to its approved recipient.
The delegated policy
An administrator writes the delegated policy. The server evaluates it for every send from the quote and document row. It never takes policy rules from prompt text.
You can restrict allowed destinations or country prefixes. Set limits on pages and amount per job. Daily and monthly caps limit both job counts and amounts. Policies also have an expiry. You can restrict senders and document sources too.
A prompt saying "ignore the budget" changes nothing. Every policy version is immutable. The job records the version that allowed it.
The identity and the budget
Each agent is a named principal with its own key. Its scopes define what it can do. It cannot widen those scopes or raise its budget.
Budgets are separate from policy rules. The server refuses a hold that exceeds the budget before money moves. You can cap an agent's spending alongside separate limits for its project or organization.
Every action creates an audit row with an actor and metadata only. Disabling the agent revokes its keys.
The inbox is data
A received fax arrives as a PDF in a private inbox. A signed fax.received event tells your system about it. The signature authenticates the event. It does not give the document's author permission to direct your agent.
Every string from the fax comes back under untrusted. The dashboard labels it "from the document, unverified".
The policy engine never reads that text. An id lifted from the fax and passed as a tool argument is refused.
The supplier's reply can contain a requested change. A forwarding address printed on paper does not add itself to the policy's allowed destinations. Sending the revised order still needs authorization.
Idempotency and evidence
Use an Idempotency-Key on every mutating call. After a timeout, repeat the send with the same value. A retry returns the same job. Creating another value defeats that protection.
A job starts as queued and moves to active. It becomes delivered only when the provider's report of every page is stored on the attempt. Other sends finish as partial or failed. unknown means there is no outcome yet. Nothing retransmits automatically from that state.
Busy and no answer are retried up to three times.
Save the job id when the server returns it. Use get_fax_status to check the attempt before deciding what happens next. A timeout is a reason to inspect the existing job. It is not evidence that another transmission is needed.
The receipt includes the job id, destination, sender and page count. It also records the provider reference, document sha256, captured amount and completion time.
You can check which document was sent against the approval later.
What this costs
Sending to the United States or Canada costs $0.039 per page as of 2026-10-28. Payment comes from a prepaid wallet. Cover pages count as pages. Failed sends are not charged. A partial delivery charges only the pages the provider confirmed.
The sandbox is free with a test key. You can rehearse the whole flow, including approvals, before real money moves. The fax for AI agents guide covers the workflow.