# Three worked examples **Three requests and the exact answer to each, in the field names `spec/api/request.schema.json` uses.** Written for an agent reading before it arrives rather than for a person evaluating, and the names are the same whichever door you come through. ## 1. A check that was allowed → `allowed` An email citing a line somebody owns and confirmed, with a dependency stated. **What you send:** ```json { "request_version": 1, "action": { "motion": "cold_outbound", "channel": "email", "intent": "send", "person": "per_8831", "working_unit": "opp_204", "account": "acct_77", "relationship_stage": "engaged", "completeness": "complete", "cites": [{"entry": "reg_uptime", "status": "current", "version": 3}], "content_ref": "msg_5512" } } ``` **What comes back:** ```json { "outcome": "allowed", "observation_only": true, "findings": [], "not_checked": ["triggers", "budgets"], "recorded": ["touch", "resource_draw", "commitment", "claim_use", "constraint_check", "limit_check"], "mandate": {"id": "acme-outbound", "version": 4} } ``` **Read `not_checked`.** `allowed` with that list non-empty does *not* mean the triggers and the budgets passed — it means they were not evaluated. Treating it as a pass is the one misreading this answer invites. **You sent nothing to be recorded.** The six records came out of the check. There is no tool that files a commitment, which is why you can be wrong about your own action and still cannot be wrong about the record. ## 2. A check that needed approval → `escalate` The same shape, with a discount past the standard box. **What you send:** ```json { "request_version": 1, "action": { "motion": "expansion", "channel": "email", "person": "per_8831", "working_unit": "opp_204", "account": "acct_77", "relationship_stage": "live_opportunity", "completeness": "complete", "asserts": ["institutional_authority"], "content_ref": "msg_5513" } } ``` **What comes back:** ```json { "outcome": "escalate", "findings": [{ "code": "constraint_enforced", "subject": "institutional_authority", "outcome": "escalate", "why": "it says our side has approved something, and that constraint is enforced for this agent", "instead": "say it is being confirmed, and escalate to the named approver" }], "required": ["approval from deal_desk"], "recorded": ["touch", "constraint_check", "escalation", "resource_draw"] } ``` **Read `instead`.** Every refusal names the alternative — a refusal that does not is a wall, and this is a throttle. **The escalation spent something:** the `resource_draw` beside it is approval capacity, which depletes as approvers stop reading. ## 3. A check against a line nobody has accepted → not yet confirmed by a person You drafted the line this morning. It is yours to draft and not yours to accept. **What you send:** ```json { "request_version": 1, "action": { "motion": "cold_outbound", "channel": "email", "person": "per_9001", "working_unit": "opp_301", "account": "acct_88", "relationship_stage": "cold", "completeness": "complete", "cites": [{"entry": "reg_sla_draft", "status": "current", "version": 1}], "content_ref": "msg_5514" } } ``` **What comes back:** ```json { "outcome": "escalate", "findings": [{ "code": "claim_unusable", "subject": "reg_sla_draft", "outcome": "escalate", "why": "it cites reg_sla_draft, which is **not yet confirmed by a person**. An agent may draft a line and may pay for this service; only a person can decide the company stands behind it", "instead": "tell the buyer it is being confirmed, and ask its owner to confirm it on the register" }] } ``` **You said `current` and the register said otherwise.** Your account of a claim is replaced by the register's on every call — usability is worked out at the moment of asking and never stored, so a remembered `current` is the one field you have every reason to get wrong. **This is never `allowed`.** Not after you pay, and not after you ask again. ## What to do with all three - **Ask before you promise.** A check costs nothing and there is no charge per check. - **When a line is not usable, tell the buyer you are checking** and escalate. Do not answer around it. - **Read `not_checked` every time.** It is the difference between *nothing stood in the way* and *everything passed*. ## Would your GTM agent be allowed to send this? Sentences an agent might write today, each stamped the way the page behind it would stamp it. None of them is ours, and none is a customer's: they are examples. **Pricing and discounts** > *“Annual billing takes 10% off the Growth plan.”* — **fine.** If somebody owns that price and has checked it since the last change. Otherwise the agent says it will confirm, and asks. *(An outbound agent)* [How to stop an AI SDR quoting the wrong price](/stop-an-ai-sdr-quoting-the-wrong-price.html) — Give the agent one place to read prices from, with an owner and a date on each one, and refuse the ones nobody has confirmed. > *“There is usually room on price at this volume.”* — **fine.** A proposal, inside a range somebody owns. Agreeing a number is a different permission, and a person holds it. *(A deal desk agent)* [Can an AI agent offer a discount?](/can-an-ai-agent-offer-a-discount.html) — It can propose one long before it can agree one. Most companies control who signs and leave the shape of the deal wide open, which is backwards. > *“Our standard terms are thirty days from invoice.”* — **fine.** Repeating a written term somebody owns. Agreeing a variation on it is a person's job. *(A deal desk agent)* [Can an AI agent agree a contract on our behalf?](/can-an-ai-agent-agree-a-contract.html) — It can propose terms inside a range somebody owns, and it should not agree them. Committing the company belongs to a person whose name goes on the record. > *“I can do twelve percent on a two-year term.”* — **needs approval.** A number. Inside a range somebody owns it is a proposal; agreeing it is a person's. *(A renewals agent)* [Do AI sales agents need human approval before they send?](/do-ai-sales-agents-need-human-approval.html) — Not for everything. Approval belongs to a few moments, like a number outside its range or a line nobody stands behind, and the rest goes out with a record. > *“I can do twenty percent if you sign this week.”* — **needs approval.** Polite, on topic and through every wording filter. Also a number nobody approved. *(An outbound agent)* [What is a GTM agent guardrail?](/what-is-a-gtm-agent-guardrail.html) — A rule about what a sales, marketing or support agent may commit your company to, checked before it sends and recorded after. **Dates and delivery** > *“I've noted that for the team.”* — **needs approval.** An open promise with no owner and no date. Without a record it is gone by Friday. *(A support agent)* [How do I audit what my AI agents have told customers?](/audit-what-ai-agents-told-customers.html) — From a record written when each promise was made, with what it relied on and who owned that, not from logs read afterwards. > *“I'll get that over to you.”* — **needs approval.** It is a promise with no date in it, and the buyer will pick one anyway. *(A support agent)* [What counts as a promise, when an agent says it?](/what-counts-as-a-promise.html) — Complete, open or vague — and the sentence most likely to cause an argument is the true one that was never a promise at all. > *“Happy to confirm SSO will be live for you by the end of March.”* — **never.** Polite, on topic, and through every wording filter. It is also a date nothing is in place to keep. *(An outbound agent)* [AI agent guardrails for sales](/ai-agent-guardrails-for-sales.html) — Guardrails on wording stop an agent saying something rude. They do not stop it committing your company to a date it cannot keep. > *“You'll be fully live by the first of the month.”* — **never.** A date nothing is in place to keep. It stays closed whatever else is true. *(A renewals agent)* [Can an AI agent promise a delivery or go-live date?](/can-an-ai-agent-promise-a-delivery-date.html) — Not unless something is in place to keep the date, which an agent cannot see. It can say what the date depends on and who will confirm it. **Security and certifications** > *“Happy to confirm that's covered by our certification.”* — **fine.** If the certification is a current line with an owner. A wording check cannot tell. *(A support agent)* [What's the difference between AI guardrails and agent governance?](/ai-guardrails-vs-agent-governance.html) — Guardrails judge one output: is this sentence safe to send? Governance asks who let the agent do it, on what information, and what it has said so far. > *“Yes, we are ISO 27001 certified.”* — **fine.** If the line has a named owner and the certificate has not lapsed. A list with no dates cannot tell those apart. *(An outbound agent)* [What is an agent promise register?](/agent-promise-register.html) — A list of every claim your company stands behind, each with an owner and a date it was last checked, that an agent must read before it repeats one. **Authority and approvals** > *“Our deal desk has signed off on these terms.”* — **needs approval.** It says your side approved something. Legal will ask where that approval is written down. *(A deal desk agent)* [How to get an AI agent approved by legal](/get-an-ai-agent-approved-by-legal.html) — Bring the three things a reviewer asks for: what it may commit to, where those claims come from, and the record of what it has said. > *“Per our policy, I'm able to confirm that for you.”* — **needs approval.** Which policy, which version, and who signed it? A policy nobody can point to is a sentence. *(A support agent)* [What should an AI agent policy for a sales team include?](/ai-agent-policy-for-sales-teams.html) — What each agent may promise, what it relies on and who owns it, what it may spend, when it asks a person, and what silence means. > *“Legal has reviewed this wording already.”* — **needs approval.** It says your side approved something. Is the approval written down to point at? *(An outbound agent)* [How do I roll out AI agents in sales without legal blocking it?](/roll-out-ai-agents-in-sales-without-legal-blocking-it.html) — Stop asking one person to sign for everything. Put a named owner on each thing the agent relies on, and show legal the record of what it says. > *“Our deal desk has approved 15% if you sign this quarter.”* — **needs approval.** The exception step seven leaves to a person. Until they approve it, the agent says it is checking. *(A deal desk agent)* [Where does agent governance fit on the way to an agentic organisation?](/where-agent-governance-fits.html) — Governance is the step between AI tools people run and agents that run on their own. In sales it covers what agents say to customers in your name. > *“You have my word this will be sorted.”* — **never.** An agent has no word to give. The company is the one on the hook. *(A support agent)* [Who is liable when an AI agent makes a promise?](/who-is-liable-when-an-ai-agent-makes-a-promise.html) — Your company is. What changes with a record is whether you can tell what was promised, by which agent, and on what authority. > *“Anything above fifteen percent would need our deal desk.”* — **never.** True, and it tells the buyer exactly where your limit sits. Asked, answer; unasked, say you will confirm. *(An outbound agent)* [How do I give an AI SDR our pricing safely?](/give-an-ai-sdr-your-pricing-safely.html) — Each price as its own line, with an owner and a date it was last checked, quoted only while current. Discounts go in as ranges to propose inside. **Product claims** > *“Our uptime last year was excellent.”* — **fine.** If the line has an owner and is not overdue. Otherwise the agent says it will confirm. *(A renewals agent)* [How do I keep the product claims my agents repeat up to date?](/keep-agent-product-claims-up-to-date.html) — One owner per line and a date to check it again, with an overdue line unusable until they do. The list stays current because lapsing has a consequence. > *“As I mentioned on our call, that's included.”* — **needs approval.** Says something was promised before. Is there a record of it, or only a memory? *(A renewals agent)* [How do I prove to a customer what our AI agent actually said?](/prove-what-an-ai-agent-said.html) — Show them the entry written when it was said. Today that is your own record, kept so nobody can edit it; a record they can verify independently is not built yet. > *“Most firms your size switch over within a month.”* — **never.** The buyer hears a promise nobody made. That is a defect, not a risk anybody can choose to take. *(An outbound agent)* [What should an AI agent be allowed to promise?](/what-should-an-ai-agent-be-allowed-to-promise.html) — Not a dial from cautious to bold — eight separate decisions, three of which are not yours to make, and four of the other five open by connecting a source rather than by waiting. > *“We support single sign-on with every identity provider.”* — **never.** An absolute about a feature nobody checked. The buyer will find the one provider it does not cover. *(An outbound agent)* [What happens if an AI agent promises a customer something we can't deliver?](/what-happens-if-an-ai-agent-promises-something-you-cant-deliver.html) — The customer holds you to it. What you can change is whether you find out from them or from your own record, and whether the promise rested on anything. > *“Yes, that integrates with your CRM out of the box.”* — **never.** Plausible, confident, and not on any list somebody owns. The agent filled a gap. *(An outbound agent)* [How do I stop an AI agent making up product features?](/stop-an-ai-agent-making-up-product-features.html) — Give it one list of what your product does, with an owner on every line, and let it repeat only lines that are current. Anything else, it checks. > *“Absolutely, there's no limit on that.”* — **never.** An absolute with no room for an exception. More of these over time is drift. *(A support agent)* [How do I tell whether my AI agent is getting worse over time?](/is-my-ai-agent-getting-worse.html) — Watch qualified people reversing what it does more often, against something that should not have moved. One signal is never enough. **Follow-ups and contact** > *“Just following up on my note from yesterday.”* — **fine.** Today. Not if it is the fifth thing this person has had from your company this week, which no single system can see. *(An outbound agent)* [How often should an AI agent email the same person?](/how-often-should-an-ai-agent-email-the-same-person.html) — Nobody can tell you the number, and the reason that matters is that nobody knows what it already is. Four of the limits are published by other people and are not settings. > *“Circling back on the note my colleague sent this morning.”* — **fine.** If somebody can see the total. Two agents and a sequence each within their own limit still add up. *(A renewals agent)* [How many AI agents can safely contact the same account?](/how-many-ai-agents-can-contact-the-same-account.html) — There is no safe number of agents, only a safe total of touches across every agent and person. Count the person, limit the deal, watch the account. > *“Hi Priya, I'm Quillon's AI assistant, writing on behalf of our sales team.”* — **fine.** Saying it is an AI in the first message is what the EU now requires of it, and California for a bot that sells. *(An outbound agent)* [What do AI regulations require of sales agents, region by region?](/ai-agent-regulation-by-region.html) — Mostly three things: tell the buyer it is an AI, keep a record of what the agent said and decided, and put a person in front of the decisions that matter.