How Should an AI Agent Safely Generate Leads? What a $12K Automation Disaster Taught Me

At 9:14 a.m. on a Tuesday, a prospect cc’d my CEO on an email chain I wasn’t part of. Her message was short: “Please remove me from this list. And please tell me where you got my information, because I left this role in August.”

That part, honestly, was fair. What made my stomach drop was the thread above her message. Our AI outbound agent had interpreted her original reply as a positive signal — increased engagement, apparently — and answered her with product details. Then it scheduled another follow-up for Thursday and labeled her account “high intent.” No human had reviewed any of it.

“Please stop contacting me and my team. Where did you get this data?” — the prospect, sent at 9:17 a.m.

I canceled the tool that week. Counting the subscription, the burned parallel dialer credits, and the three weeks our SDRs spent cleaning up bad records, that experiment cost us just over $12,000. It also forced me to answer an uncomfortable question: how should an AI agent safely generate leads at all?

For context: I’ve run revenue operations at a B2B software company for about five years. In that time, I’ve personally made and documented five significant data mistakes, totaling roughly $27,000 in wasted budget. I keep a checklist now so our team doesn’t repeat them. This latest mistake is at the top of the list.

Why I said yes to AI outbound automation

In October 2024, our CEO asked me to evaluate AI SDR tools. The pitch was easy. Our SDRs were spending something like 40% of their week on manual list-building and account research. That’s not a good use of smart people. I believed automation was the answer, and I still believe it can be — when it has the right boundaries.

The problem was my evaluation criteria. I asked “how many leads can this thing generate?” instead of “how safely does this thing generate leads?” Classic mistake.

In November, I picked a tool — I’ll leave the name out — and connected it to our CRM. I gave it three inputs: our ICP, our ideal buyer titles, and a total addressable market list. Setup took about twenty minutes. That should have been a red flag, but I was already sold. I remember telling my CEO this was a no-brainer.

What went wrong, in one uncomfortable paragraph

By the end of the first week, the agent had produced 1,240 contacts. The dashboard looked amazing: roles matched, company sizes matched, and every row had a “Decision-Maker Score.” It looked like a list we used to pay a research agency for. What I didn’t check was where the email addresses came from. I approved the list and pushed it into our outreach sequence.

Then I made it worse. I uploaded a copy of that same list to our parallel dialer for the call-heavy segment — roughly 300 numbers. Every number had been “enriched” by the same single API that produced the emails. We did not verify a single one before it went into the dialer.

The first week looked fine on the surface. A few replies. Two meetings booked. I was already planning next quarter’s campaigns. Then the deliverability report came in, and the tone changed.

Of the 1,240 email addresses we contacted, 147 hard-bounced. These weren’t spam-folder soft bounces. They were hard bounces — addresses that didn’t exist. That’s nearly 12% of the list, straight into the trash.

Our domain reputation took a hit. The follow-up campaign, scheduled one week later, landed in promotions tabs more often than primary inboxes. SDRs started complaining that CRM records were duplicated: the agent had created multiple contacts at the same company with conflicting titles and phone numbers. We had a data-quality infection, and it spread everywhere.

The most frustrating part was that the agent wasn’t glitching. It was doing exactly what I told it to do: find as many leads as possible and enrich them. I never gave it a stopping rule. No verification minimum. No duplicate check. No human approval gate before a message could leave our domain.

The surprise wasn’t the bounce rate. The surprise was how fast the damage compounded. One bad enrichment source + one agent with send access + one parallel dialer export = a mess that took three weeks and several thousand dollars to untangle.

The decision: build our own pipeline or buy something with guardrails

For two weeks in January 2025, I went back and forth between building our own enrichment pipeline and buying a more safety-focused agent. Building it ourselves meant total control over the output. On paper, it made sense. But my gut said we would never maintain it — our backend engineer was already drowning in a migration, and sales tooling was not where our CEO wanted engineering hours spent.

That’s when I found okkigo. What caught my attention wasn’t the UI. It was the phrase “agent-native prospecting.” In practice, that meant the okki go ai agent inside okkigo was designed to run prospecting as a defined process with checkpoints — not as an open-ended scraping task with a confidence score attached to each row.

Two features changed the conversation for us:

• Human-in-the-loop outreach. The agent can research, enrich, score, and draft. But it can’t send anything until a human approves it. That alone would have prevented the Tuesday morning disaster.
• Waterfall enrichment plus intent. Rather than doing one lookup per lead, okkigo runs an API data enrichment waterfall across multiple providers. If one provider has a weak phone number and another doesn’t have a record at all, the data is either merged or dropped. Then intent signals are layered on top.

Our engineer also appreciated the okki-go npm package. It let us script an audit log for every research query the agent ran and dump the output into a review queue. For us, auditability was the missing piece. I’m a big believer in “trust, but verify” — especially when the thing doing the work is an autonomous agent.

Rebuilding the workflow the right way

In February 2025, we rebuilt the workflow. We didn’t stop using AI. We stopped letting AI make the final decision.

The new process looked like this:

Step one: The okkigo agent builds a candidate list inside our ICP — no email sending permissions, no dialer export permissions, no CRM write access beyond a staging area.

Step two: The agent runs enrichment through its waterfall and drops records that don’t survive more than one source. Every surviving contact gets an intent score, but no score is treated as gospel.

Step three: A human reviews the queue. SDRs see the agent’s reasoning in plain language: why this account, why this contact, which sources confirmed the email, which signals triggered intent. If it doesn’t make sense, they reject it. No guilt, no questioning.

Step four: Only after approval does the list move to our outreach sequence or parallel dialer. We also re-ran the old 1,240-contact list through the same process. Okkigo dropped 413 contacts entirely because they didn’t meet the verification bar. Another 88 records were merged because they were duplicates of the same person.

Our first properly gated pilot ran in March 2025 on 400 accounts. I’ll give you our observed numbers, not a promise: the hard bounce rate dropped from the previous 11.8% to about 1.4%. The reply rate roughly tripled compared to the disaster campaign. We also stopped embarrassing ourselves in front of prospects, which is harder to measure but probably worth more.

No tool, including okkigo, can promise 100% accuracy on every field. I don’t trust that claim from anyone. What changed was that our process added redundancy and a human checkpoint before anything could damage our domain or our reputation.

So, how should an AI agent safely generate leads?

Here is the checklist I now use before any automated prospecting touches our CRM or sends a single email:

• The agent should not have send access. Research, draft, score, recommend — fine. The final send decision belongs to a person. If a tool can’t support that, don’t buy it.
• Use more than one enrichment source. A single API lookup is a guess with good formatting. A waterfall that compares multiple providers at least catches the most obvious hallucinations and stale records.
• Verify before you schedule. Email verification before a campaign is not optional. Neither is a minimum data-quality threshold for a parallel dialer. A verified list protects your sender reputation and your dialer credits.
• Build an audit trail. If you can’t answer “where did this lead come from and why are we contacting them?”, you have a compliance problem, not a data problem. On the EU side, GDPR Article 5(1)(d) requires personal data to be accurate. On the US side, CAN-SPAM requires a clear opt-out path. Both are much easier when decisions are logged and reviewable.
• Treat “intent” as context, not permission. An account that downloaded a whitepaper is not automatically asking for a demo. Intent data helps you prioritize. It does not replace consent or common sense.
• Scope the agent tightly. “Find every company that could buy from us” is a recipe for garbage. “Find companies with 200+ employees, in this industry, with a recent signal and a verified contact” is a much better instruction.

Bottom line

I’m not anti-manual prospecting. Some of our best deals still came from an SDR who found a tiny detail that no algorithm would have put in a spreadsheet — a mention in a niche podcast, a mutual connection, a company event. I’m not saying that doesn’t matter.

I’m saying the messy, boring parts — database hygiene, enrichment fallbacks, human approval queues — are exactly where automation earns its keep. Efficiency is a real advantage, but only when the process underneath is safe.

These days, when someone asks me how should an AI agent safely generate leads, I don’t give them a lecture about prompt engineering. I tell them about a Tuesday morning in November, a prospect who cc’d my CEO, and a $12,000 lesson that could have been avoided with a single approval gate.

Trust the agent to do the work. Just don’t trust it to know when to stop.