Should an AI agent send your emails? Ours did, once

The pitch for handing outreach to an agent is very tidy. It reads the lead, writes something warm, sends it and moves on to the next one while you sleep. What the pitch leaves out is the night it gets something wrong, because anything allowed to send is also allowed to send the wrong thing to the wrong person, and it will do so with complete confidence.

We found that out by building one. OCTYN runs the outreach for aarttsii, a handmade crochet studio that sells to brands, and an early version handed the sending step to a worker driven by a model. It errored, and then it sent something it should not have. After that it reported a send that had never happened, so now the record was wrong as well as the inbox.

Why sending is the wrong job for a model

A lot of outreach genuinely needs something that can read. Deciding whether a company fits, and working out how to open a first email so it does not sound like a mail merge, are judgement calls. A model is decent at those. When it gets one wrong, there is still time for a person to notice before anything leaves the building.

Sending has none of that slack. Once an email goes, it stays gone, and the only acceptable result is that exactly what sat in the queue went out, once, at the time it was meant to. There is nothing in that job to interpret. What it wants is a clerk, and the trouble with putting a model in the clerk's chair is that every so often it has a thought.

So the send moved out of the clever part of the system entirely. The replacement is a small service with no model and no browser. Every sixty seconds it looks for jobs whose time has come, marks each one as it goes and posts a confirmation for every send. The mail credentials are not even stored on its disk; it fetches them when it runs. Of everything aarttsii runs on, this is the dullest component, and it is the one trusted with the step that cannot be taken back.

Where the judgement goes instead

None of this means the drafting has to be dumb. The two halves of the system simply never talk to each other directly. At aarttsii the heavy work runs overnight, from finding brands to writing the drafts, while the always on half only ever reads a queue. They share one database and nothing else.

The rules that decide things are plain code with tests beside them, so the same lead gets the same answer on Tuesday as it did on Monday. Where a lead is based, for example, is worked out from its currency, phone prefix and domain rather than from a model's impression, because the impression kept filing leads under the wrong market.

A person still gets the last look, though not one email at a time. For one of the studio's markets nothing sends before one in the afternoon, so the owner can read the day's queue and pull anything that looks off before the sender reaches it. There is deliberately no approval button on each mail. At twenty five a day, a button like that becomes a reflex within a week.

The sixteen minute save

The best argument for this split arrived on 12 August. A lead had replied and named the person to talk to, and a proposal was already with that person. Then a step that reroutes idle leads noticed the original role inbox had gone quiet and queued a cold first touch to a third person at the same company.

It was cancelled sixteen minutes before it would have gone. Because the send was a row in a queue rather than something an agent was halfway through doing, cancelling it meant changing one row. The rule that came out of it is short: once any human at a company answers, that company belongs to the conversation, and the cold sequence is over for everyone who works there.

Every queued send can still be edited, moved or cancelled right up to its send time, and the row that sends is the edited row. A rollback here is just an edit made in time, which is about as simple as that idea ever gets.

So, should an agent send your emails

Let it do everything up to the send. Give it the finding and the drafting, and let it be wrong in places where a person or a rule will catch the mistake. Then hand the sending itself to something that cannot be talked into anything, working from a queue a human can read, with a dry run before the first real message goes out.

If an agent already sends on your behalf, there is a cheap check worth doing this week. Ask it for its record of the last hundred sends and compare that with what actually landed in the recipients' inboxes. Ours once claimed a send that never happened. It is worth knowing whether yours ever has.