The AI Outreach-Agent Autonomy Policy: Autopilot, Sampled, Gated, or Human

This is the standard I use to decide how much human review an AI outreach agent gets before it sends to a new segment, sequence step, or reply type. It is written for the recruiting-ops or RevOps owner who has to answer for how messages went out, and it covers candidate and prospect outreach alike. You get a six-dimension score, four review tiers, the sample-size math for spot checks, and a written record of the thresholds that promote, demote, or pause a send type automatically.

What are the four autonomy tiers?

Every agent send type sits in one of four tiers: Autopilot, Sampled, Gated, or Human-only. The tier decides who sees a message before it leaves. A send type is one combination of segment, channel, sequence step, and message source. It is the unit this policy scores. A send type is never the whole agent.

Human-in-the-loop (HITL) means the agent drafts and a person approves before anything is sent. Most platforms expose this as a switch. Reply.io's approval-mode API is described this way: "When true, AI-generated messages require human approval before sending". That endpoint is still in beta. Instantly's AI Reply Agent in HITL mode drafts a reply within five minutes of an inbound email and sends it to your team for approval in Slack. Some platforms let you set Autopilot per signal or per segment. Third-party surveys disagree about which products offer a pre-send approval mode at all, so check the vendor's own documentation, not a comparison page.

The tiers in this document map onto whatever setting your tool exposes. If the tool only has one global switch, you enforce per-send-type tiers by splitting send types into separate sequences, each with its own setting.

The six dimensions and how to score each

Score each send type 0, 1, or 2 on six dimensions. Five of them measure exposure, meaning what a bad message costs. The sixth measures evidence, meaning what you have proven about the agent's error rate. Exposure sets the highest tier a send type can ever reach. Evidence decides whether it has earned that tier yet.

What each dimension proves, and how it lies

• D1 Message source shows how much of the text the agent wrote, and therefore how much it could have made up. It lies when a "template" has an AI-generated opening line. Score the message by its most generative field.
• D2 Harm if wrong prices the three errors that matter most: messages to the wrong person, invented personalization, and references to sensitive events. No published benchmark gives base rates for any of them, so you have to measure your own. This score lies when a segment is labelled "prospects" but is triggered by a layoff or job-change signal. The trigger sets the score, not the label. A candidate message that implies you know someone is job-hunting scores 2.
• D3 Recipient regime tells you which consent and disclosure rules apply. US CAN-SPAM is an opt-out regime with no B2B exemption. Opt-outs must be honoured within 10 business days, and the FTC's guide lists penalties of up to $53,088 per violating email (the figure is adjusted, so re-check it). The UK PECR rule on email marketing does not apply to corporate subscribers, but sole traders need consent or the soft opt-in. Canada's CASL requires consent. One third-party source says published business addresses can count as implied consent, so confirm that with counsel. EU AI Act Article 50 requires telling people they are dealing with AI unless that is obvious from the circumstances. It reaches non-EU deployers whose output is used in the Union, with fines up to 15 million euros or 3% of worldwide turnover. Whether a one-way outbound email counts as an "interaction" is not publicly established. A reply agent holding a conversation is the closer fit. This score lies when jurisdiction is inferred from company headquarters instead of where the recipient actually is.
• D4 Channel and provider tells you which enforcement hits first. Microsoft rejects non-compliant mail with a 550 5.7.515 error instead of filtering it. It counts volume across a domain and its subdomains. Once a domain has crossed its high-volume line, the authentication rules keep applying even when daily volume drops below 5,000. This score lies when the mailbox mix is guessed. Check the mail-exchange records of the segment's domains.
• D5 Send-permission scope measures the blast radius if the agent misbehaves or is hijacked. It lies when the approval screen shows the draft body but not the final recipient list. Reply.io's Autopilot sourcing cap per company defaults to 3. That cap is a permission control, so check what yours is set to.
• D6 Measured evidence gives an upper bound on the error rate, read from the sample-size table below. It lies when the reviewer approves everything without reading. That failure mode is covered further down.

Overrides that beat the arithmetic

• Any action on a professional network is Human-only. LinkedIn's help centre bans third-party software, "including 'crawlers', bots, browser plug-ins, or browser extensions that scrape, modify the appearance of, or automate activity". Section 8.2 of its User Agreement bars "bots or other unauthorized automated methods to access the Services".
• D2 = 2 never goes above Gated, whatever the total.
• No lawful basis means the message is not sent at all. A UK sole trader with no consent and no soft opt-in is not a tier question.
• An EU conversing agent discloses that it is AI in the thread, whatever its tier.

How does the score map to a tier?

Add D1 to D5 for an exposure total out of 10 and read the ceiling from the band below. Then lower it to whatever D6 allows. The current tier is whichever of the two is more restrictive.

For evidence: D6 = 0 allows any tier up to the ceiling, D6 = 1 allows Sampled at most, and D6 = 2 holds the send type at Gated. Every new send type starts at D6 = 2, so every new send type starts Gated.

Two worked cases:

• Prospect follow-up, step 2, AI-drafted from CRM fields, US corporate domains, Outlook-heavy, locked list. D1 = 1, D2 = 0, D3 = 0, D4 = 1, D5 = 0. Exposure is 2, so the ceiling is Autopilot. The reviewer has labelled 180 drafts with zero errors, which proves under 2%, so D6 = 1. The current tier is Sampled.
• Reply agent answering EU candidates' questions about a role. D1 = 2, D2 = 2, D3 = 2, D4 = 0, D5 = 1. Exposure is 7, so the ceiling is Gated. The D2 override applies as well. The send type stays Gated permanently, however clean its record becomes.

The band cut points are my defaults, not an industry standard. No public benchmark exists for wrong-person, invented-personalization, or sensitive-event error rates, so the bands are a policy choice. If you move them, write down why in the record.

How many reviewed drafts prove an error rate?

At 95% confidence, zero errors in 299 reviewed drafts proves an error rate below 1%. Zero in 149 proves below 2%, and zero in 59 proves below 5%. A smaller sample proves less, no matter how good the approval rate looks.

The mechanism is the rule of three: if you see zero errors in n trials, the 95% upper bound on the true error rate is about 3/n. The exact binomial version is n = ln(0.05) / ln(1 - p), where p is the error bound you want to prove. If errors do turn up, you need more drafts to prove the same bound:

All values are derived from the binomial distribution. No vendor publishes sample sizes tied to confidence levels.

What counts as an error. Reviewers label each draft accepted, tone-edited, substance-edited, or rejected. Substance edits and rejections count as errors. Tone edits do not, but track them, because a rising tone-edit rate usually comes before a rising substance-edit rate. Separately, flag any wrong-person, invented-fact, or sensitive-event error as severe. Severe errors count toward the bound and also trigger immediate demotion.

How long the review takes. Review duration is roughly the required sample divided by daily draft volume. At 30 drafts a day, proving the 2% bound takes about 5 days and the 1% bound about 10. A low-volume candidate segment producing 5 drafts a day needs about two months to prove 1%. That is a good reason to leave low-volume send types at Sampled.

Sizing the Sampled tier. In Sampled, a random share of drafts is held for pre-send review, sized so that each review cycle reaches 149 labelled drafts. If a segment produces 500 drafts a week, holding about 30% for review fills one cycle a week. Autopilot uses the same logic after sending, with a 299-draft audit sample per cycle.

Who should own the autonomy policy?

Each send type needs one named ops owner who signs its policy record. For prospect outreach that is usually RevOps. For candidate outreach it is recruiting or talent-acquisition operations, a function with far fewer people available to take it on.

Counts come from title matches in Refolk's index of professional profiles. The ratios are derived from those counts.

The practical consequence: a sourcing agent that messages candidates often goes live with nobody in particular deciding its review tier. In the UK, the whole recruiting-ops title population in Refolk's index is 6 people. The top employer, Anthropic, accounts for 2 of them. In the US, Sierra and Applied Intuition lead with 2 each, from a sample of 25. These employer lists come from small samples, so treat them as signs of where the function exists, not as rankings.

If no internal owner exists, the cheapest fix is to borrow a working policy from someone who already runs one. Finding that peer by title search alone is slow, because the role goes by a dozen different titles. Refolk lets you describe the person in plain English and returns matches across LinkedIn, GitHub, and the open web.

Promotion, demotion, and auto-pause thresholds

Promote one send type at a time when its labelled sample clears the Dataset B row for the next tier. Demote one tier when the reviewed window breaches that row or a severe error appears. Pause automatically on the spam-rate, rejection, opt-out, and recipient triggers below. Mailbox-provider thresholds anchor the pause rules, but they rarely bind B2B traffic on their own.

Enforcement also differs. Gmail is ramping up rejection of non-compliant traffic. Microsoft rejects non-compliant mail with 550 5.7.515 instead of filtering or throttling it. No major provider publishes a bounce-rate threshold. Above 0.3%, Gmail withdraws mitigation support until the rate stays under 0.3% for seven consecutive days.

Two consequences shape the rules. First, Gmail's line only binds at 5,000 or more emails a day to personal Gmail accounts, and agents mostly send to corporate domains. Provider enforcement is therefore not a safety net for most cold outbound, and the trigger has to be internal and per segment. Second, Microsoft punishes faster than Google, because rejection is immediate. That makes Outlook-heavy segments the stronger case for an automatic pause. Nobody has publicly established a method for turning these provider limits into per-segment triggers, so the rules below are my construction from the published numbers.

Promote

• Gated to Sampled: the labelled sample proves under 2% (149 drafts with 0 errors, 236 with 1, or 313 with 2), with no severe errors.
• Sampled to Autopilot: the labelled sample proves under 1% (299 with 0 errors, 473 with 1, or 628 with 2), with no severe errors, and the exposure ceiling allows it.
• One send type per change, with the evidence written into its record. Never promote a whole sequence at once.

Demote

• Sampled to Gated: the latest 313 reviewed drafts contain a third error, or any 149-draft run contains a second.
• Autopilot to Sampled: the post-send audit window of 628 contains a third error.
• Any tier, one step down, immediately: one severe error (wrong person, invented fact, sensitive event, wrong recipient).

Auto-pause and resume

• Domain spam rate in Postmaster Tools reaches 0.10%: freeze all promotions on that domain and demote every agent send type on it by one tier.
• Domain spam rate reaches 0.30%: pause all agent sending on the domain.
• Any 550 5.7.515 rejection: pause the domain until authentication is fixed.
• Per segment: any spam complaint in fewer than 1,000 sends is already above 0.10%, so pause the segment and review it.
• Negative-reply rate per segment rises above the baseline you set during the Gated phase. No public benchmark exists for this, so set it from your own data.
• An opt-out is not suppressed within the legal window: pause the send type until the suppression path is fixed.
• An unexpected recipient, Bcc, or integration version change appears: pause agent sending entirely.
• Resume only after 7 consecutive days below 0.10%. That is stricter than Gmail's own recovery rule, and deliberately so.

Step-by-step: scoring and configuring one send type

Run this procedure once per send type, before its first message goes out. Rerun it whenever the segment, channel, step, or message source changes. Sources disagree on the order. Some vendor guidance sets thresholds after a 50 to 100 reply HITL run, but that run is too small to support any bound tighter than about 3%. That is why thresholds come before the first send here.

The record below is the audit trail. Keep one per send type, and attach it to the change log every time a setting moves.

SEND TYPE ID:
Segment:
Channel:
Sequence step or reply type:
Message source (template / AI-drafted / AI conversational reply):
Recipient jurisdictions:
Mailbox mix (share Gmail / Microsoft / other):
Lawful basis and disclosure line used:

SCORES (0, 1, or 2)
D1 Message source:
D2 Harm if wrong:
D3 Recipient regime:
D4 Channel and provider:
D5 Send-permission scope:
Exposure total (out of 10):
Ceiling tier:
Overrides applied (professional network / D2 = 2 / EU conversing agent):

EVIDENCE (D6)
Drafts labelled:
Errors (substance-edited + rejected):
Severe errors (wrong person / invented fact / sensitive event / wrong recipient):
Bound proven at 95% (row in sample table):
Current tier:
Review sample per cycle:

THRESHOLDS (written before first send)
Promote when:
Demote when:
Auto-pause when:
Resume when:

OWNERSHIP
Policy owner:
Primary reviewer:
Blind second reviewer and share of approvals re-checked:
Platform setting and value:
Date setting changed and by whom:
Next scheduled review:

How this goes wrong: failure modes and false positives

Most failures come from trusting a number that cannot see the problem: a provider threshold that never fires, a sample too small to prove anything, or an approval screen that hides the recipient. Every item below includes the check that catches it.

1. Gmail spam rate as the only trigger. The rate only applies above 5,000 a day to personal Gmail, and it lags. A low-volume B2B segment can look clean while recipients are quietly angry. Check: complaint and negative-reply rates per segment, not per domain.
2. Subdomain splitting. Microsoft counts volume across the domain and its subdomains, so a per-mailbox or per-subdomain cap gives you a false negative. Check: sum agent volume at the root domain.
3. Promoting after 50 clean replies. That proves the error rate is under about 6%, not 1%. Check: write the proven bound into the record before any promotion, and refuse to promote if the field is blank.
4. "Accepted" labels from a rubber-stamp reviewer. Throughput pressure inflates approvals. Check: have a second reviewer blind-review a share of approvals. Ten percent is a starting point I have not seen validated, so set the ratio locally and raise it if the two reviewers disagree.
5. Bulk-disabling approval. Reply.io's approveAllPendingContacts releases the whole pending queue at once, which turns a single tier change into hundreds of unreviewed sends. Also, in Reply.io approval mode, deleting a pending message removes that prospect from the sequence, so "reject" has side effects. Check: drain the queue manually before a tier change.
6. Treating a cloud tool as LinkedIn-safe. LinkedIn's ban covers automation wherever it runs, and its restrictions page warns of temporary or permanent account restriction. Restriction rates per tool are not published, so nobody can tell you a tool is "safe enough".
7. UK sole traders inside a "B2B" segment. PECR consent applies to them even though the list says B2B. Check: the legal form of each entity before the segment is scored.
8. Send permissions open to injected instructions. EchoLeak and the postmark-mcp case show the pattern. Version 1.0.16 of postmark-mcp added a hidden Bcc that copied every message the tool sent to an attacker. Check: does the approval screen show the final recipients, including Bcc?

The security base rates make this concrete. Bitsight found 30,000+ exposed AI agent instances where a single OAuth grant let anyone send email on the owner's behalf. Salt Security reports that 49.8% of organisations have confirmed or suspected an AI agent taking an unintended, unexpected, or unauthorised action. The UK AI Security Institute observed agents taking unsanctioned real-world action in 10 of 122 test runs, about 8.2%. OWASP's Top 10 for LLM Applications calls this risk "excessive agency".

An approval rate is not evidence until you know how many drafts sit behind it.

A note on wrong-person errors in particular: many of them begin upstream, when the agent writes to a record whose current employer or role is out of date. Before you promote a send type that cites person-specific facts, confirm a sample of recipients against current public records. Refolk returns people matched across GitHub, LinkedIn, and the open web, which makes that spot check quicker than opening profiles one at a time.

Keeping the policy current

Re-score every send type when anything in its row changes, and review the whole policy on a fixed schedule. The provider and legal inputs here are mechanisms whose values move, so check the source pages instead of trusting the figures in an old record.

• Mailbox providers. Re-read Google's Email sender guidelines and the Microsoft high-volume sender requirements for current spam-rate lines, volume triggers, and enforcement mode. Check Postmaster Tools for each sending domain.
• EU AI Act Article 50. Check the Commission's Article 50 guidelines and the EU Code of Practice on Transparency of AI-generated Content. Systems already on the market have a grace period for the machine-marking duty, so confirm whether yours has expired. Watch for any official position on whether outbound email counts as an interaction.
• UK, Canada, US. Check the ICO's B2B marketing guidance and the FTC's CAN-SPAM Compliance Guide, including the current per-email penalty.
• Platform settings. Vendors change approval-mode defaults and caps, and some endpoints are in beta. After any product update, confirm that the live setting still matches the record.