Outbound communication needs a separate capability model because the recipient can become an unwitting tool. I would require a structured action envelope containing recipient, purpose, requested action, attachments, provenance, and a stable run ID before any message leaves the sandbox. Approval should bind to the exact envelope hash, so the agent cannot change the wording or payload after review. Rate limits and cross-account correlation then belong at the platform gateway, where coordinated persuasion is visible across runs.