AI SDR guardrails: 12 questions to ask a vendor before you buy

AI SDR guardrails are the controls that decide what an AI sales agent may do on its own: whose inboxes send, what needs a person's approval, what stops it and what it can spend.

An AI SDR is software that finds prospects, writes outreach and, depending on its settings, sends it and answers replies. The main AI SDR risks land before anyone notices: a wrong recipient, a stale fact, another email after an unsubscribe, or a bill larger than planned.

Even some vendors that sell automation advise keeping a person in the loop. Instantly's guide (updated June 19, 2026) recommends a hybrid setup and warns that fully autonomous outreach can raise spam complaints and harm domain health.

This buyer checklist gives you 12 questions to ask an AI SDR vendor, on a sales call or against its documentation. Vendor pages were read on October 17, 2026 unless noted, and vendors change them, so check the live page before you rely on a detail. If a vendor cannot answer question 2, 3, 8 or 10, we would stop there.

Human in the loop AI SDR: who sends and who decides

1. Whose inboxes and domains send the email?

Some tools send from your own mailboxes. Others use a pool the vendor runs. Explee's homepage FAQ says outreach goes out from its pool of pre-warmed inboxes, "never from your own mailbox or domain". 11x's pricing overview (last updated August 27, 2026) lists managed mailboxes with domain setup, warm-up and rotation on its Growth plan.

Each model trades something. A pool keeps your main domain out of the line of fire and needs less setup. Your own mailboxes keep reputation, replies and suppression records in your hands, but put a domain you may also use for invoices at risk.

Ask:

• Whose domain shows in the From address?
• Who owns the domains and mailboxes if you leave?
• Do other customers share the inboxes?

A pool does not move the legal duty. The FTC's CAN-SPAM guide says both the company whose product is promoted and the company that sends can be held legally responsible, and that you cannot contract that responsibility away.

2. What does the AI SDR approval workflow cover, and what sends without it?

Ask for the full list, not the headline mode. "Approval" can mean approving a lead list, a template, each message or each reply. This is what each vendor's own documentation says:

Ask about replies too. Explee's API has a project setting for AI auto-replies to hot-lead replies, delayed by 0 to 1,440 minutes. A reply in your name is as public as the first email.

Where a vendor only names its controls, as Artisan's llms-full.txt does in one line (approvals, tone and call-to-action locks, escalation rules), ask for the documentation.

3. What happens when a review window expires?

Ask this in writing, because some designs treat silence as approval. Explee's API documentation says that with Auto-manage campaigns on, a lead list is also approved automatically at the end of the project's review window (12 hours by default). With it off, only an explicit approve action sends the list.

At that default, a list nobody opened by Friday evening could be approved by Saturday morning.

Ask:

• Which timers exist? A review window that approves a list and a delay before an auto-reply sends both count.
• Can you switch each timer off?
• What happens to a pending review when you stop the campaign?

4. How is autonomy granted, and how is it taken back?

Granted: by a toggle on day one, or by a track record? Reply.io's playbook for lean teams advises switching a sequence to Automatic mode only after the queue has stopped needing edits, without giving a number.

Taken back: at which scope (workspace, campaign, sequence, mailbox), and what happens to queued mail? In Explee's API, stopping a campaign cancels queued outreach emails and freezes a pending review countdown. Other designs keep queued mail and resume it later. Know which one you have before you need it.

The graduated autonomy section below shows the pattern to look for.

Accuracy: what it claims and what it measures

5. How is a "hot lead" defined, and who decides?

"Hot lead", "warm lead" and "qualified" are not standard terms. Explee's API describes a hot lead as a person who replied with real interest, and a lead leaves the list if you dismiss it or the person unsubscribes. Its homepage quotes a cost per warm lead.

Ask:

• Does the label rest on a reply, a click or a score?
• Does a model or a person assign it, and can you read the message and correct the label?
• Does an out-of-office reply count?

6. Are the claims in each email sourced?

Instantly's guide lists confident hallucination, such as an invented certification or product claim, among AI SDR limits. Take an email that says "congrats on your Series B". Either the tool can show the page, the date it was read and the sentence it relied on, or you are trusting a model's memory.

Ask:

• Does each specific claim link to a source and a date?
• What happens when a claim has none: blocked, flagged or sent anyway?
• Which parts go unchecked, and do facts expire?

See AI personalization without hallucinations for how sourced claims work in practice.

7. What do you see about bounces and complaints, and does sending pause itself?

Google's sender guidelines say to keep the spam rate in Postmaster Tools below 0.10% and avoid ever reaching 0.30%. The low line is roughly one spam report per 1,000 messages. Google's page gives no bounce threshold. Instantly's guide says to keep bounces at or below 1%. Other tools set their own pause points, so ask for the number in writing.

Ask:

• Do bounces show per mailbox, per sequence and per data source?
• Where are complaints counted from?
• Does sending pause automatically, and at what threshold?
• In a shared pool, do you see anything at all?

Illustration with made-up numbers: if 4 bounces in 100 sends all came from one data source, the overall 4% hides where the fix is. See cold email deliverability in 2026 for the wider picture.

Money and contract: what it can spend and how you leave

8. Is the spending cap daily or total?

A daily cap limits one day, not a month. Explee's API documents a daily budget in dollars with a maximum of $300 a day. Its terms (last updated October 16, 2026) say usage can accrue as a postpaid balance up to a limit Explee sets, and that by saving a payment method and starting work you authorize charges to the saved card off-session for accrued usage, including retries of failed charges.

Illustration with made-up numbers: a $30 daily budget is $900 over a 30-day month if nothing stops it.

Ask:

• Is the cap daily, monthly or total?
• Is billing prepaid or postpaid?
• What happens at the cap?

9. How long is the contract, and what is refundable?

Terms differ widely. Two documented examples:

Ask for the minimum term, the renewal notice, whether credits expire, the refund rules for unused credits, and whether failed lookups and hard bounces are credited back.

Legal plumbing and data: unsubscribes, sources and exit

This section is general information, not legal advice.

10. How are unsubscribes and suppression handled?

Start with the legal floor:

• United States: the FTC says CAN-SPAM opt-outs must be honored within 10 business days, and the opt-out mechanism must keep working for at least 30 days after you send.
• Gmail: for senders of more than 5,000 messages a day to personal Gmail accounts, Google requires one-click unsubscribe on marketing mail, using the headers in RFC 8058.
• EU: GDPR Article 21 lets people object to direct marketing at any time, after which their data may no longer be processed for that purpose.

Ask:

• Does one suppression list cover every campaign, mailbox and teammate, by address and by domain?
• Is it checked when a step is queued and again at the moment of sending, so a Tuesday unsubscribe stops a step queued on Monday?
• Does a reply saying "remove me" count?
• In a shared pool, whose list is it?

11. Where does the contact data come from?

Under GDPR Article 14, when you get personal data from someone other than the person, you must give them certain information, including the source of the data. The information is due within a reasonable period and at the latest one month after you obtain the data, and no later than your first message if you will contact the person. Exceptions exist, for example when the person already has the information.

A vendor that cannot name the source of an address leaves you unable to answer "how did you get my email?"

Ask:

• Which provider or page did each email and job title come from, and when?
• Are guessed addresses labeled as guesses?
• Does the tool rely on scraped social-profile data?
• Which AI providers receive your prospect data?

See GDPR and cold email for a longer walk through the rules.

12. What happens when you leave?

Explee's terms say consequences of termination may include deletion of user data and, in the version we read, do not describe how to export your campaign data.

Ask:

• Can you export contacts, sent messages, replies and sequence copy before canceling, as CSV or through an API?
• Is the suppression list included? Losing it means you may email people who opted out.
• Who owns any managed domains and mailboxes afterward?

Graduated autonomy: how an AI SDR should earn more freedom

Graduated autonomy means an AI starts with the least freedom and earns more from a measured record, one scope at a time, with a way back. Reply.io's page describes three levels as a framework rather than product settings:

• L1: drafts for approval.
• L2: sends with a review queue, where flagged messages wait.
• L3: autonomous with escalation.

In our view, a well-built ladder answers four things:

• Evidence: counts of approved, edited and rejected drafts beat a feeling.
• Scope: per sequence beats per account, because a new segment starts at the bottom.
• Fallback: a draft that fails a check waits for a person.
• Clock: there should not be one. Approval by timer is automation with a delay, not earned trust.

How FoxKnock answers the 12 questions

We build FoxKnock, so we are not neutral. The checklist applies to us too. This section shows one implementation, as the product works today. The approval-first outreach page has details.

FoxKnock sets an approval level per sequence:

Auto within limits becomes available after at least 50 messages approved one by one (bulk approvals do not count), an edit rate under 10% and a reject rate under 5% (rejected divided by approved plus rejected). Even then, it auto-approves only a draft that passes the quality gate with zero unsupported claims and a completed claim check. Everything else waits for a person, and nothing is ever approved by a timer.

Illustration with made-up numbers: a team has approved 50 drafts one by one and rejected 2. That is 2 rejections in 52 decisions, or 3.8%, under the 5% line. A third rejection makes it 3 in 53, or 5.7%, over the line, so the sequence would not qualify for Auto within limits until more approvals bring the rate back under 5%. The edit rate has its own 10% line.

On the other questions:

• Inboxes: your own mailboxes only, connected with an app password over SMTP and IMAP: Google Workspace or any SMTP and IMAP mail server. There is no shared pool. Microsoft 365 is limited: Microsoft no longer accepts passwords (Basic authentication) for IMAP in Exchange Online and has announced the retirement of Basic authentication for SMTP AUTH, so a Microsoft 365 mailbox may not connect or may not sync replies. FoxKnock does not offer Microsoft sign-in.
• Stopping: any sequence can drop back to Review each, and a workspace kill switch pauses all sending while approved mail stays queued. Besides Auto within limits, the only send without per-message approval is an opt-in booking-link auto-reply, off by default.
• Reply labels: replies sort into 13 classes, such as interested and meeting request, each with a confidence score. Under 0.6 is marked Needs review. A meeting counts only when a person marks it booked.
• Claims: each specific claim must cite an evidence card (source URL, quote, timestamp), and a second AI pass flags unsupported ones. That check is AI too, so it can miss things, and templates you write are not checked.
• Bounces and complaints: sending pauses above 2% bounces over the last 100 sends or above 0.1% complaints over the last 1,000 (each needs at least 20 sends). Complaints count only when feedback-loop reports reach the mailbox.
• Money: credits are prepaid and you set a monthly spend cap in Billing. Plans are monthly with no annual contract, and email-find credits are refunded when an address FoxKnock found hard-bounces.
• Suppression: one list per workspace, by email and domain, checked at enrollment, preparation and send.
• Data and exit: every enriched field records its provider, confidence and retrieval time, plus a source URL where there is one. FoxKnock does not scrape LinkedIn. AI features send prospect data to Claude, by Anthropic. You can export companies, contacts, lists and suppressions as CSV, or use the REST API.

Honest limits: FoxKnock has no warm-up network or inbox-placement testing, mailboxes connect with app passwords rather than a one-click sign-in, and it launched in October 2026, so there is no track record yet.

If you want to see how FoxKnock cites its facts before you judge the rest, the free plan comes with 500 one-time credits and needs no card (credits are granted once you verify your email). It covers AI onboarding from your website, discovery and standard research. The pricing page lists sequences, where the approval levels live, from the Starter plan. You can start free and judge the research on a company you already know well.

This article is general information, not legal advice. Whether your outreach is lawful depends on the country, the recipient and your lawful basis.