Five Questions to Ask Before You Let an AI SDR Talk to Your Customers

An AI agent just emailed a prospect your sales team never approved, in language your marketing team never wrote, referencing a deal stage nobody had reached. That is not a hypothetical. That is what happens when the governance layer arrives after the agent does.

MIT found that 95 percent of enterprise GenAI pilots never reach production. If you are a CIO, a sales leader, or a GCC head evaluating these tools, the vendor demo will pass every test you throw at it. The outputs are clean. The personalisation is real. The pipeline updates look correct. And that is exactly the problem: a demo is designed to show you the happy path. Production is where the agent does something you did not expect, to a customer you did not target, in language you did not approve.

Five questions that separate production from pilot

I run an AI SDR in production daily. It watches my market, reads my inbox, drafts my outreach, and recommends my next move. It has a constitution, budgets enforced in code, and a human veto on every send. I built it because the vendor demos I evaluated had the same gap: they showed capability but not constraint. These are the five questions I ask before letting any agent touch a customer relationship.

1. What may this agent never do?

Every vendor will tell you what the agent can do: research, draft, schedule, update the pipeline. Some vendors publish guardrail docs. Almost none will show you the enforcement evidence unless you demand it. Can it send an email without human approval? Can it post on a prospect's LinkedIn? Can it modify a deal stage without a rep confirming? If the answer to any of these is yes and the vendor can't show you the enforcement evidence, the sandbox test results, and the immutable audit log, you're not buying a tool. You're buying a liability with a demo badge.

2. What are the hard daily caps, and what happens when they are hit?

Budgets should be enforced in code, not in policy documents. My system has hard daily ceilings on every action type: outreach drafts, messages, searches, spend. When a budget is exhausted, the system doesn't warn me. It stops. An exhausted budget that produces a warning is a suggestion. A budget that produces a shutdown is a control. Ask the vendor: show me the policy-as-code export, the sandbox test results, and the audit log from the last time the ceiling fired.

3. Can the agent learn new rules, and who ratifies them?

Agents that learn from experience are more useful than agents with fixed rules. But learning without ratification is drift. My agent proposes standing rules, an independent judge model scores each one, adopted rules are disclosed in my morning brief, and I can revoke any rule with a single line. Ask the vendor: how does the agent learn, where are the learned rules disclosed, and how do I undo one?

4. Is there a drift tripwire that auto-reverts?

Agent behavior changes over time as the model updates, the data shifts, and the learned rules accumulate. A scheduled self-audit that compares current behavior against the constitution catches drift before your customers do. If the drift exceeds tolerance, the system should auto-revert to the last good state. Ask the vendor: when was the last time your agent drifted, how did you detect it, and what happened?

5. Where is the emergency stop, and has it been tested?

One switch, always available, always wins. Not a setting buried in a configuration panel. A stop that outranks every other instruction, including the agent's own reasoning. My stop is a popup in my browser that I can hit in one click. It has been tested. Ask the vendor: show me the emergency stop, the audit log from the last trigger, and their data governance policy: where does customer data go, is it used for model training, and what permissions does the agent's identity hold?

What to do Monday morning

• Pick one vendor agent and run it in shadow mode beside your human workflow for two weeks. Do not let it touch a real customer.
• Write the five questions above into your vendor evaluation template. If the vendor can't answer all five with code, not policy documents, they aren't ready for your pipeline.
• Budget the governance layer as a line item, not an afterthought. The agent is the cheap part; the governance is what makes it production-ready.
• Assign an owner with a name, a pager, and authority over the prompt, the data, and the budget. If you can't name the owner, you have a science project.
• Take the results to your board in one language: what ran in production, what it returned, what it cost.

The vendors are right: AI SDR agents are the future. But the future arrives safely only when the governance arrives first. Which of the five would your current vendor fail today?

Go deeper: Alfred case study