The outbound agent mandate: what an AI SDR may send without a human

Operator Edition No. 01 asked every company to list the agents already acting in its name. No. 02 gave the one-page template for delegating authority to one. This edition applies the template to the agent that most revenue organizations switched on first and read about last: the outbound agent, the AI SDR, the thing that writes and sends email to strangers under your company’s name.

I am not against it. Run well, at the right tier, an outbound agent earns its place. But it is an agent with authority over three things that are expensive to repair — your reputation with the buyers you most want, your sending domain, and your legal exposure in every market you write to — and the argument of the Field Notes applies to it without exception: authority delegated to software has to be written down before the software acts. Here is what the writing looks like.

1. What goes wrong when the mandate is missing

1. 01
   Invented familiarityThe agent is asked to personalize, so it personalizes: a compliment on a post the buyer did not write, a mutual contact who does not exist, a “noticed you” about something the buyer cannot recognize. One of these to an infrastructure leader and your domain is marked, mentally and in their mail filter.
2. 02
   Claims driftA design target on the website becomes “customers see” in the agent’s third variant, and the technical buyer asks for the source in the reply nobody reads in time.
3. 03
   Volume without capsThe agent does what it was built to do and sends a hundred messages a day from the corporate domain. Deliverability collapses in three weeks and the company concludes outbound does not work.
4. 04
   No hand-offA buyer replies with an objection, a pricing question or a security question and the agent answers it. Sometimes well. The time it answers badly is the account you wanted most.
5. 05
   Consent by accidentThe list included addresses in a market whose rules nobody checked. The agent cannot tell.
6. 06
   Nobody accountableEvery message went out under the company’s name and no person’s. When the complaint arrives, the answer is “the tool did it,” which is not an answer any buyer or regulator accepts.

None of these is a failure of the model. Each is a failure to write down what the agent was and was not allowed to do, in the one market where the buyer runs the mail infrastructure and can see exactly what a careless vendor looks like from the inside.

2. The mandate

Ten questions, one page. If a question has no answer, the agent does not send. This is the version I use in The Seven C’s Outreach Program™; the brackets are the company’s to fill.

Read the Prohibited row twice. It is the row that protects the accounts that matter. The named accounts — the twenty-five to fifty a human researches, the hundred to two hundred worked with segment plays — are never the agent’s. They get a person, because the reply that matters most is the one the agent is least equipped to handle.

3. Earn the mandate with two waves of human data

The second most common mistake, after switching the agent on without a mandate, is switching it on first. An agent imitates. It needs something to imitate. The program’s rule is that no outbound agent sends anything until two waves of human-run outbound have produced the data it will learn from:

• Which signals convert — from the signal log: replies and meetings per signal type.
• Which hooks the committee answers — which first lines earned a human reply from an operator, a leader, a guardian.
• Which objections appear — so the hand-off rule covers the real ones, not the imagined ones.
• What the deliverability baseline is — bounces, complaints, placement, per domain, so a threshold means something.
• What a human-run conversion rate looks like — the baseline the agent is measured against.

Two waves is roughly six weeks. The companies that skip it buy an agent to find out what their market responds to, which is the most expensive research method available, and they find out on the accounts they cannot afford to burn.

4. The domain is a production system

The agent’s volume is the single largest threat to the asset outbound depends on, which is the sending domain. The mandate’s volume row sits on top of a deliverability standard that applies to humans and agents alike:

• Outbound is never sent from the corporate domain. Secondary domains, registered for the purpose, with a page that redirects to the main site and a visible owner.
• One to three inboxes per secondary domain, with real names, warmed for two to three weeks before the first wave.
• Authentication published for every sending domain and moving to an enforcing policy once reporting is clean.
• Under thirty new messages per inbox per day, spread across the block.
• Verified lists: bounces under two percent, complaints under one in a thousand; above either, the wave stops.
• A suppression list — opt-outs, bounces, customers, competitors, anyone who asked for silence — synchronized to every tool the agent can touch.
• Five numbers every Friday per domain: sent, bounces, complaints, replies, placement. A domain that crosses a threshold is rested and investigated before the next wave, and the agent’s mandate is suspended with it.

The consent position is part of the same standard. Business messages to people in their professional capacity are lawful in most markets under conditions that differ — and an agent cannot tell a corporate address in one market from a sole trader in another. The mandate names the markets the agent may write to; counsel confirms the position for each before the first wave; everywhere else is off limits.

5. What the agent is for

Having said all that: a well-mandated outbound agent earns its place. At the Tier 3 edge of a scored universe — the accounts that fit the profile but have not fired a signal strong enough to earn a person’s hour — an agent that sends a short, true, signal-led message on a verified trigger and hands the reply to a human inside an hour is doing exactly what the program would otherwise not do at all. It extends reach without extending risk, because the mandate has already decided every question the agent would otherwise answer for itself.

The same agents are useful upstream, and the mandate covers that too. The research brief for a named account — what they run, the last ninety days, the likely committee, the warm paths, the candidate signals with sources — is an agent’s job, verified by the sender. So is the first draft of a message on a library template, the triage of replies into their eight types, and the draft of the call notes. In every one of those the rule is the same: the agent drafts; a named human verifies the hook against its source and presses send.

6. The measures

The Three Measures apply to this agent as to any other. Inputs: sends, signals used, templates used — the diagnostics, never the result. Outcomes: human replies, discovery calls held, sales-accepted opportunities, and the cost per sales-accepted opportunity, against the human-run baseline. Organization: whether a named person can say, for any message the agent sent last week, why it was sent, on what signal, with what claim, and what happened next. An agent that cannot pass the third measure does not get to be judged on the second.

7. The one-page test

Before an outbound agent sends its first message, the program owner answers these on one page and signs it:

1. 01
   AccountsWhich accounts may it write to, and which may it never?
2. 02
   SignalsOn which verified signals, from which sources, within what age?
3. 03
   WordsWhich templates, and which claims, from which register?
4. 04
   VolumeHow many, from which domains, under what caps?
5. 05
   Hand-offWhat goes to a person, to whom, how fast?
6. 06
   ProhibitionsWhat must it never do?
7. 07
   EvidenceWhat is logged, and who samples it?
8. 08
   ReviewWhen is it measured, against what, and when is it rewritten?
9. 09
   StopWhat withdraws the mandate automatically?
10. 10
    OwnerWhose name is on every message?

If the page cannot be written, the agent is not ready, and neither is the company. If it can, switch it on — at the edge, on the evidence, under a name.

Questions this piece answers

Operator Edition No. 05 of Field Notes on the Agentic Enterprise. It also closes the outreach series for companies selling into AIOps and network operations: Signal-Based Outbound for Network Operations, Selling to the NOC, Close the Loop, Don’t Break Up, Infrastructure Buyers Have Heard “AIOps” Before and Proof of Value That Converts.