{
  "schema": "aaes/capability-pack/1",
  "provider": "smtp",
  "version": "1.0.0",
  "description": "Outbound email through the deployment's own SMTP relay: send mail as the relay's configured identity.",
  "notes": "NOT USABLE: AAES ships no SMTP rail adapter. The only email provider the platform wires is the Resend HTTPS API (native_executors.email), and that provider refuses every endpoint except https://api.resend.com/emails, so an smtp:// registration from this pack is refused before any connection is made and no message is sent. The pack stays a draft until a reviewed SMTP adapter exists and the platform can select it. A test pins the refusal (aaes/internal/catalogcli/pack_smtp_test.go).\n\nAn SMTP relay does one governed thing — accept a message for delivery — so this pack registers one capability. A delivered message cannot be recalled after delivery, so it carries the send action at the minimum R3 tier, and send is one of the designated actions requiring human approval. The sender identity belongs to the relay, not the caller: the email connector's payload has no From field and the rail stamps the identity it is configured with, so a caller cannot spoof one.\n\nRecipients come from the caller at request time. The email connector checks each To and Cc address for shape, bounds the recipient count per message, and refuses any recipient that is not in the capability's egress allowlist: an entry is either one exact address (ops@example.com) or a whole domain written with a leading at sign (@example.com), which matches that domain only and never a subdomain, and the relay entry SMTP_HOST:587 never matches a recipient. As shipped the allowlist names only the relay, so the connector refuses every message until the deployment adds the permitted recipients beside it. The destination the message leaves through is the registered endpoint, and nothing else. Outbound mail routinely carries personal data in addresses and bodies, so the capability registers at the pii class — an internal label on client emails requires review. SMTP_HOST is a placeholder to replace in both the endpoint and the egress allowlist.\n\nThis pack covers submission only: it says nothing about inbound mail, mailbox access, bounce processing or DKIM signing, which belong to the relay's own configuration. The pack names no vendor; any relay the deployment's email rail adapter can speak SMTP to serves it.",
  "credential": {
    "secret_ref_id": "secret-ref-smtp-relay-credential",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "Authorization",
    "note": "The SMTP AUTH credential for the relay, held in the client's own secret manager. No shipped email rail speaks SMTP, so nothing presents this material to a relay today; a future SMTP adapter would have to present it as the relay's AUTH mechanism requires, never interpolate it into a message and never log it. The account should be a least-privilege submission identity that can send only as the addresses the deployment means agents to use."
  },
  "capabilities": [
    {
      "capability_id": "smtp.mail.send",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "SMTP_HOST:587"
      ],
      "endpoint": "smtp://SMTP_HOST:587",
      "method": "send",
      "connector": "email",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-smtp-relay-credential",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "send"
      ],
      "resource_id": "smtp-relay",
      "description": "Send one message through the relay as its configured identity. A delivered message cannot be recalled after delivery, and send is one of the designated actions requiring human approval, which is why it carries the minimum R3 tier. SMTP_HOST is a placeholder to replace in both the endpoint and the egress allowlist before enabling.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "smtp-relay",
      "kind": "mailbox",
      "locator": "smtp://SMTP_HOST:587",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "draft",
    "date": "2026-10-29",
    "sources": [
      "https://www.rfc-editor.org/rfc/rfc5321 (retrieved 2026-09-20)",
      "https://www.rfc-editor.org/rfc/rfc6409 (retrieved 2026-09-20)"
    ],
    "reviewer_id": "aaes-eng"
  }
}