Quick answer: An AI sales agent should not, on its own, send first messages you have not seen, reply to sensitive or ambiguous messages, send email replies, contact people who opted out, exceed safe sending volume, make promises about price or results, or keep going when you press stop. Anything that speaks in your name should start in draft mode, with approval, an undo window, and a one-click way to halt everything.
Why does the question matter?
An AI sales agent writes and sends messages that people read as coming from you. A bad one does not just waste time. It can embarrass you in front of a prospect, break rules about consent, or put your LinkedIn account at risk. The aim is not to avoid automation but to be clear about which actions you trust it with, and to widen that trust step by step.
What are the seven things to keep out of its hands?
| Action | Why it should not run unsupervised | A safeguard to look for |
|---|---|---|
| Sending messages you have not approved | You are accountable for every word | Approval by default, opt in per action |
| Replying to sensitive replies | Tone, complaints, legal or personal topics need judgment | Flag-and-draft, never auto-send |
| Sending email replies | A wrong email is hard to retract and may reach the wrong person | Drafts only, reviewed by a person |
| Contacting someone who opted out | It breaks consent rules and trust | A suppression list checked before every send |
| Exceeding safe volume | It is how LinkedIn accounts get restricted | Daily caps, warm-up, send windows |
| Promising price, discounts, or results | The agent cannot know what you can deliver | Prohibited topics; human handles terms |
| Continuing after you say stop | You need a way to halt it instantly | A killswitch that stops all sending |
1. Sending first messages you never saw
You might trust the agent's style after a while. At the start, you should not. Check a sample of the messages it writes for your audience before it sends any. If they read like templates, your prospects will notice too. A good setup lets you approve each message, then approve by category, and only later let routine ones go on their own. Some products call this a trust ladder.
2. Replying to anything sensitive
If someone replies with a complaint, a legal question, a personal circumstance, or an angry message, a person should read and answer it. An agent can flag the reply and draft a suggestion. It should not send it.
3. Sending email replies
Email is harder to take back than a LinkedIn message and often carries more formal weight. A reasonable rule is that email replies are drafted for your review and never sent automatically. FollowArc follows this rule: email replies are always drafted for you.
4. Contacting people who asked not to be contacted
An agent must check a suppression list before every send, and it should add anyone who says stop. This is not a nice-to-have. See cold outreach compliance basics for the wider picture, and take legal advice for your own jurisdiction.
5. Exceeding safe sending volume
More volume does not mean more customers; it means more risk. A new LinkedIn account starts at about 5 invites a day, ramps toward 20, and should never go above 30. Look for daily caps, warm-up ramps, and send windows that are enforced by the system and cannot be overridden by an eager setting. See how to automate LinkedIn outreach without getting restricted. No tool can guarantee an account will never be restricted, and any that claims to deserves suspicion.
6. Making promises on your behalf
Price, discounts, delivery dates, and results are your decisions. An agent that agrees to a discount or promises an outcome in a chat can create a commitment you did not make. It should answer factual questions from your own material and hand terms to you.
7. Ignoring a stop request from you
The last safeguard is your own. You should be able to pause everything with one action, and any automatic send should have an undo window so you can catch a mistake. FollowArc offers a one-click killswitch and a 30-second default undo window on automatic LinkedIn replies.
How do you widen trust safely?
Start with everything in draft. Approve what you see for a couple of weeks. Then turn on one automatic action at a time, such as a routine acknowledgment, and watch the results before turning on another. If something looks wrong, turn that one off and go back a step. That is slower than switching it all on, and much safer.
You also need an audit trail: a record of what the agent did and why. If you cannot see the reasoning behind a message, you cannot fix it when it goes wrong. For where humans and software each do better, read AI SDR vs human SDR, and for questions to ask a vendor, see red flags when buying an AI SDR.
Limits and honest caveats
- Approval is a cost. If you approve every message, you give up some of the time savings. That is the right trade at the start.
- Rules reduce risk but cannot remove it. LinkedIn restricts automation, and no safeguard makes that go away.
- An agent can still be wrong inside the rules. A well-formed message can still misjudge a person. Read replies yourself.
- Different businesses need different lines. A regulated industry may want approval on everything permanently.
Frequently asked questions
Should an AI agent ever send messages without approval?
Possibly, once you trust it for a specific, low-risk kind of message and can undo it quickly. Opt in one action at a time, and keep email replies in draft.
What is an undo window?
A short delay after an automatic send during which you can cancel it. FollowArc uses 30 seconds by default for automatic LinkedIn replies.
What is a killswitch?
A single control that stops all outgoing activity at once. You want it to be one click, and to apply wherever the agent can act, not just in one screen.
How do I know an agent respected my rules?
Look for an audit trail that records each action and the reasoning behind it, and check a sample regularly.
Where FollowArc fits
In FollowArc, LinkedIn actions need your approval by default, every automatic skill starts switched off, email replies are never sent automatically, and every send passes a guard stack of account isolation, a suppression list, send windows, warm-up, deal state, a cross-channel cooldown, and daily caps. See the AI SDR with human approval page, or try the demo.