diff --git a/config.example.yml b/config.example.yml
index c5a1c7d..8bdb708 100644
--- a/config.example.yml
+++ b/config.example.yml
@@ -21,7 +21,7 @@ accounts:
     watch_folders:
       - INBOX
 
-  # Full — separate SMTP settings (only if different from IMAP)
+  # Full — separate SMTP settings, send restrictions
   # - id: work
   #   imap_host: imap.example.com
   #   imap_port: 993
@@ -31,5 +31,9 @@ accounts:
   #   smtp_port: 587
   #   smtp_username: "you@example.com"
   #   smtp_password: "smtp-password"
+  #   allow_send: true
+  #   blocked_recipients:          # agent cannot send to these addresses
+  #     - "ceo@company.com"
+  #     - "all-staff@company.com"
   #   watch_folders:
   #     - INBOX
diff --git a/src/server.py b/src/server.py
index 3aa66a4..eed8b47 100755
--- a/src/server.py
+++ b/src/server.py
@@ -608,6 +608,19 @@ async def send_email(
             "error": f"Sending is disabled for account '{acc['id']}'. Use create_draft instead."
         }
 
+    blocked = {addr.lower() for addr in acc.get("blocked_recipients", [])}
+    if blocked:
+        all_recipients = [a.strip().lower() for a in to.split(",")]
+        if cc:
+            all_recipients.extend(a.strip().lower() for a in cc.split(","))
+        if bcc:
+            all_recipients.extend(a.strip().lower() for a in bcc.split(","))
+        denied = [r for r in all_recipients if r in blocked]
+        if denied:
+            return {
+                "error": f"Sending to {', '.join(denied)} is blocked. Use create_draft instead."
+            }
+
     def _send():
         msg = MIMEMultipart("alternative") if html else MIMEText(body)
         if html: