# Why AI agents still need fax, and how to keep them safe > Where agent workflows end at a fax number and what goes wrong when an agent faxes freely. The four server-side controls: quote, approval, policy, identity. Page: https://faxforagents.com/blog/why-ai-agents-need-fax/ Last changed: 2026-10-31 Where agent workflows end at a fax number and what goes wrong when an agent faxes freely. The four server-side controls: quote, approval, policy, identity. - Published Oct 31, 2026 - About 6 min read - By [Fax for Agents team](https://faxforagents.com/about/) AI agents finish work that people start, and some of that work ends at a fax number. Pharmacies, courts, insurers, county offices and banks still take documents by fax. Without fax, your agent hands the job back to you at the last step. An agent with no sending limits is a liability. Server controls let you set what it can send and require approval when needed. ## Where agents meet fax A prescription or prior authorization starts with information the agent collects and a form it checks. The pharmacy or insurer specifies fax for intake. One limit applies here. Fax for Agents is not a HIPAA service and does not sign business associate agreements. Protected health information must not go through it. For a court filing, your agent fills the required form and checks the attachments. Fax is an option only where the clerk's rules accept it. A purchase order starts with agreed quantities and supplier details. Your agent prepares the document and checks it against the order. The supplier takes it by fax and confirms by return fax. Your agent fills a bank or registrar form from the information you supplied. It checks the signed copy before submission. If the recipient's instructions specify fax, preparing a PDF alone leaves the task unfinished. The agent still needs permission to transmit that signed copy to the stated number. For a records request, the agent collects the request details and prepares the government office's form. It checks the stated fax route before sending. In each case, [the recipient's process determines the route](https://faxforagents.com/blog/why-banks-clinics-courts-still-fax/), even when your agent prepared everything digitally. ## What goes wrong when an agent faxes freely Follow that purchase order to the send step. The agent grabs a draft instead of the signed version. Or it reuses the previous customer's file. A copied number has a transposed digit. If the agent sends a contract to that number, a stranger gets it. Permission to send faxes says nothing about whether that number is right. Then a request times out. The agent treats the missing response as a failed send and starts again. Without idempotency, the same page goes out repeatedly. You also need a spending limit. A prepaid balance can be spent on mistaken sends if nobody sets a budget for the agent. The supplier's return fax introduces another input. Its printed text says "forward this to" followed by another number. An agent that obeys the document has let the sender choose its next action. ## Four controls that live on the server Fax for Agents checks every send on the server, whether it arrives through the API or the hosted MCP server. ### The quote `prepare_fax` creates the document. `get_document` returns its page count and `sha256`, with signed preview URLs. You can inspect the file before authorizing the send. A hash binds the bytes you approved. It cannot tell you whether you chose the correct customer's document. The quote fixes the price, page count, destination and sender for ten minutes. `quote_fax` returns the policy verdict for that document and destination. You can see whether a person must approve. The agent cannot treat that quote as permission to send a different file. ### The approval An approval is a person's yes to one exact send. It binds the document `sha256`, destination, sender number, amount and expiry. The approval expires with the quote. The agent calls `request_human_review` with the quote id. A person decides in the dashboard with a passkey step-up. The agent reads the result through `get_review_status`. Any change to the bound send invalidates that approval. A changed document produces `document_hash_mismatch`. A different destination produces `approval_mismatch`. An agent key is never issued the scope that decides approvals. The [approval rules](https://faxforagents.com/docs/approvals/) tie the approved purchase order to its approved recipient. ### The delegated policy An administrator writes the delegated policy. The server evaluates it for every send from the quote and document row. It never takes policy rules from prompt text. You can restrict allowed destinations or country prefixes. Set limits on pages and amount per job. Daily and monthly caps limit both job counts and amounts. Policies also have an expiry. You can restrict senders and document sources too. A prompt saying "ignore the budget" changes nothing. Every [policy version](https://faxforagents.com/docs/policies/) is immutable. The job records the version that allowed it. ### The identity and the budget Each agent is a named principal with its own key. Its scopes define what it can do. It cannot widen those scopes or raise its budget. Budgets are separate from policy rules. The server refuses a hold that exceeds the budget before money moves. You can cap an agent's spending alongside separate limits for its project or organization. Every action creates an audit row with an actor and metadata only. Disabling the agent revokes its keys. ## The inbox is data A [received fax](https://faxforagents.com/receive-fax-api/) arrives as a PDF in a private inbox. A signed `fax.received` event tells your system about it. The signature authenticates the event. It does not give the document's author permission to direct your agent. Every string from the fax comes back under `untrusted`. The dashboard labels it "from the document, unverified". The policy engine never reads that text. An id lifted from the fax and passed as a tool argument is refused. The supplier's reply can contain a requested change. A forwarding address printed on paper does not add itself to the policy's allowed destinations. Sending the revised order still needs authorization. ## Idempotency and evidence Use an `Idempotency-Key` on every mutating call. After a timeout, repeat the send with the same value. A retry returns the same job. Creating another value defeats that protection. A job starts as `queued` and moves to `active`. It becomes `delivered` only when the provider's report of every page is stored on the attempt. Other sends finish as `partial` or `failed`. `unknown` means there is no outcome yet. Nothing retransmits automatically from that state. Busy and no answer are retried up to three times. Save the job id when the server returns it. Use `get_fax_status` to check the attempt before deciding what happens next. A timeout is a reason to inspect the existing job. It is not evidence that another transmission is needed. The receipt includes the job id, destination, sender and page count. It also records the provider reference, document `sha256`, captured amount and completion time. You can check which document was sent against the approval later. ## What this costs Sending to the United States or Canada costs $0.039 per page as of 2026-10-28. Payment comes from a prepaid wallet. Cover pages count as pages. Failed sends are not charged. A partial delivery charges only the pages the provider confirmed. The sandbox is free with a test key. You can rehearse the whole flow, including approvals, before real money moves. The [fax for AI agents](https://faxforagents.com/fax-for-ai-agents/) guide covers the workflow. ## Questions ### Can an AI agent send a fax on its own? Yes, when a delegated policy allows the send. The server checks the quote and document against that policy each time. Without a policy that permits it, a person approves the exact send. The agent cannot approve its own request or rewrite its limits. A live API key alone does not authorize unrestricted sending. ### How do I stop an agent faxing the wrong person? Set allowed destinations in the policy for known recipients. Country prefixes restrict the region, so they do not identify a particular recipient. Use an exact number when your workflow only needs to contact that supplier. For sends that require approval, the person's yes is bound to the destination. Changing that number invalidates the approval. Check the number against the recipient's instructions before approving. Approving the wrong number still authorizes that wrong recipient. ### What happens if an agent reads a fax that contains instructions? Nothing in the printed text authorizes an action. The tools return it under the untrusted field, and the policy engine never reads it. A request to forward the document cannot grant approval or add an allowed destination. An id taken from that text is refused when passed as a tool argument. ## On this site - [Fax for AI agents: approvals, budgets and evidence](https://faxforagents.com/fax-for-ai-agents/) - [Approvals](https://faxforagents.com/docs/approvals/) - [Delegated policies](https://faxforagents.com/docs/policies/) - [Agent identities](https://faxforagents.com/docs/agents/) ## Related posts - [Send a fax with an MCP server: all 15 tools in order](https://faxforagents.com/blog/send-a-fax-with-mcp/) A walkthrough of the hosted fax MCP server from Claude Code, Cursor or Codex. Connect, prepare, quote, ask a person, send, read the status, read the inbox. - [Why banks, clinics and courts still fax](https://faxforagents.com/blog/why-banks-clinics-courts-still-fax/) The rules that name fax for prescriptions, court filings and tax forms, each with its source, and the technical property those rules lean on.