Every automatic email our software sends was built off-switch first. The feature came second.

The pitch for automation is always the same shape. Set it up once, and the reminder, the report or the follow-up goes out by itself while you get on with the work. It is a good pitch and it is mostly true. What it leaves out is that the moment something sends by itself, your business is talking to customers without anyone in the room, and a mistake made by a machine is made at machine speed.

So when we add an automatic send to Dispatch, the send is the last thing we write. The first thing is the off switch. Then the counter. Then the check that reads the facts again before it fires. This is a note on why we work in that order, and what it looks like from the outside.

The failure is the same wrong email, sent forty times.

A person in the office who sends a payment reminder to a customer who paid yesterday makes one awkward phone call and moves on. The same mistake inside a scheduled job doesn't happen once. It happens to every customer the job gets to that morning, before anyone has looked at their inbox. The thing that makes automation valuable, that it runs without you, is also what makes its mistakes expensive. There is no one standing between the error and the customer.

That is why the pieces that stop a send are part of the product for us, built in from the start. Nobody buys software for its off switch. They do stop using software that embarrassed them in front of a client.

What we build around every automatic send

The exact list varies by feature, but the same five things turn up every time, and we have come to treat a feature as unfinished until all of them are there.

• Off by default, per customer. An overdue reminder or a monthly report is not switched on for everyone the day the feature ships. The office turns it on for one customer at a time, where it makes sense for that customer. A new feature should change nothing until someone decides it should.
• Read the facts again, right before sending. The reminder doesn't trust what the schedule knew when it was planned. It looks the invoice up again at the moment of sending, including what the accounting system says is still owed. Paid, voided, or not actually overdue yet, and it stays quiet. Most embarrassing automated emails are correct about a world that changed an hour ago.
• One per thing, claimed. Each invoice gets one reminder per step, and the send is recorded before it goes, so a job that runs twice, or two jobs that overlap, cannot send the same email twice.
• A daily cap. There is a ceiling on how many of these go out in a day. If the cap is ever hit, treat it as a sign something upstream is wrong, and look at it before the rest go.
• One pause that covers everything. A single switch stops every customer-facing message in the business, not just the one feature you remembered to turn off. When something is going wrong you don't want to be hunting through six settings pages to find which automation is still running.

There is a sixth, which is less a control than a habit: a test mode that sends only to the owner, so a new automation can run for real, on real data, for a while, with the owner as the only recipient. You learn more from a week of reminders arriving in your own inbox than from any amount of reading the settings screen.

Why the order matters

It would be quicker to write the send first and add the controls later. We don't, for a plain reason: later arrives under pressure, after the first wrong email, and controls designed in that mood are patches. A cap added after a flood is set to whatever number would have stopped yesterday's flood. A pause added after an incident stops the one feature that misbehaved and leaves the rest running.

Built first, the controls shape the feature. If you know every send has to be claimed once, you design the job so it cannot run twice. If you know the office has to switch it on per customer, you build the switch where the office already works, on that customer's page, rather than in a settings area nobody visits. The feature ends up smaller and more honest, because every send has to justify itself to a check that was written before it existed.

An automation you can't stop in one move is borrowing your time, and the repayment comes due on the worst possible morning.

The questions to ask any tool that sends on your behalf

You don't need to know how a product is built to find out whether it was built this way. Ask these before you switch on any feature that emails, texts or messages your customers without you, and pay attention to how quickly the answers come.

• Is it off until I turn it on, and can I turn it on for one customer without turning it on for all of them?
• What does it check at the moment it sends, not the moment it was scheduled? If I mark an invoice paid an hour before the reminder is due, does the reminder still go?
• What stops it sending the same message twice?
• Is there a limit on how many it can send in a day, and what happens when it hits the limit?
• Where is the one switch that stops everything, and who in my business can reach it from a phone?
• Can I run it with myself as the only recipient first?

A vendor who has built these will answer in a sentence each. A vendor who hasn't will talk about how reliable the system is, which is not the same question. Reliable means it does what it was told. The question is what happens when what it was told is no longer true.

Where we land on it

We have written before about the difference between software that helps a person decide and software that decides for them. An automatic email sits right on that line. It is a decision, made by a system, about a customer, and the only thing that makes it acceptable is that a person chose to allow it, for that customer, and can take that permission back in one move. In Dispatch that is the standard every scheduled send is held to, and it is why a new one takes us longer to ship than the send itself would suggest.

If you run a service business, before you switch on anything that talks to your customers by itself, find the off switch, confirm it covers everything, and make sure two people know where it is. If you can't find it, that's your answer about the feature.