AI SDR approval: 10 questions to ask a vendor before an AI sales agent sends for you

What an approval gate is

An approval gate is the point where an action an AI agent proposes stops and waits for a named person before it reaches a prospect or your records. It gives you two things: a person adds judgment the system cannot have, and a limit holds even on the day nobody is watching. The SAGARIS essay Approval is a boundary, not a checkbox puts the test in one line: ask what the system refuses to do when nobody is watching, and then ask which line of code refuses it. Human in the loop is the goal; the ten questions below are how a buyer checks it in a demo.

1. Which actions can the agent take on its own, and can I see the whole list?

Why it matters: words like autonomous, assisted and copilot mean something different at every vendor. A list of actions means the same thing everywhere.

A good answer: a table of every action the agent can take against every setting you can choose, showing which run alone, which wait for a person and which never run. The answer is the same every time you ask, because a rule decides it rather than the model. If autonomy can grow over time, it grows on results, not on a count of approvals.

How SAGARIS answers: the AI SDR page prints the full table, ten actions against four autonomy levels: manual, assisted, supervised (the default) and autonomous. Five actions work on your records: update a contact field, advance a deal stage, suppress a contact, create a task and pause a sequence. Five reach a person: send an email, send a text, launch a campaign and book a meeting, which are proposals at every level, and place a call, which needs a named person at every level. Under the table the page adds that today the agent also holds every record change for a person's approval before it runs. One function decides each verdict from three facts about the action (its risk tier, whether it can be undone, and whether it reaches outside SAGARIS) plus the level you set, and no model takes part. A ladder that would let a workspace earn autonomy from its track record is built and switched off. When it is on, a rung needs both people accepting the agent's proposals and the actions that ran landing well, a bad run drops it straight back to manual, and whatever level it earns, the same floor still applies (agents and autonomy docs, AI SDR page).

2. Can it run outbound sequences and still let me approve messages before they send?

Why it matters: "yes" can mean the agent writes and a person sends, or that a person approved a sequence once and every message after that goes out on schedule. Both are useful. You want to know which one you are buying.

A good answer: the vendor separates the two cases. When the agent itself wants to email, text or book a meeting, it produces a proposal, and a person confirms it where sending happens. When a person launches a sequence, the launch approves its schedule, and you can choose steps that wait for a person wherever you want to check each message.

How SAGARIS answers: the agent's tools that would email a contact, enroll one in a sequence or book a meeting are proposal-only, with no send path behind them, and no autonomy level changes that (when SAGARIS sends email). A reply the AI drafts in the inbox waits until a rep sends or schedules it. A running sequence sends its email and SMS steps on schedule without a click per message, including the steps personalized for each contact, because launching it was the approval. Call, manual and task steps give a rep the work and send nothing themselves, and a LinkedIn step is a task for your rep, so if you want a person to write or check a particular message, you use a manual or task step in place of an email step (when SAGARIS sends email, trust page).

3. What sends without a click per message?

Why it matters: the approval screen covers the agent. Sequences, automatic replies, confirmations and reminders reach contacts by other routes, and a complete answer names every one.

A good answer: a written list of every automatic path, who switches each one on, and the checks in front of it. Any automatic reply mode is off by default and armed by an admin.

How SAGARIS answers: its email approval page lists them. Running sequences send their email and SMS steps on schedule. Out-of-office follow-ups go out inside a running sequence on the contact's return date, with a second a week later if there is still no reply. Meeting confirmations and reminders (48 hours, 24 hours and 1 hour before) and a rescheduling email after a no-show are templates, not AI-written text. Once a number is routed to the AI receptionist, a confirmation for a caller it recognizes goes out without a rep, and for a caller it cannot identify a rep approves the request first. Inbox Auto-Mode, which would send low-risk replies on their own, is built but not offered to customers yet, so every drafted reply waits for a person. When it is offered, it will be off by default, only a workspace admin will be able to switch it on, and it would send only email or text replies that clear an 80 percent confidence floor, the workspace's own threshold and the quality check, and never a LinkedIn reply.

4. Does the gate sit under every route, or only on the screen?

Why it matters: an approval screen guards the actions that pass through it. Actions can also start from an API call, a webhook or a scheduled job.

A good answer: one check in the code that every sending path consults, whatever started the action, which stays shut when its setting is missing or cannot be read.

How SAGARIS answers: one switch in the code sits in front of every channel. Only an explicit "on" opens it; an absent, empty or unrecognized value keeps it shut, and email, SMS and voice each have their own override (channels docs). SAGARIS also publishes where it stands: open on the production service, because the product sends real email, so the per-path checks in questions 2, 3, 7 and 8 and the daily limits per sender do the day-to-day work (email approval page).

5. Who is allowed to approve?

Why it matters: an approval carries the most weight when it comes from the people who own the outreach.

A good answer: releasing a send is a named permission you give or withhold per role. The same check covers every way a send is released, including launching, resuming and bulk enrolling, and anyone can pause.

How SAGARIS answers: releasing or changing an outbound send needs the Approve AI outreach permission. By default it is held by Admin, Manager / Director, Sales, Director, RevOps admin and Sales ops; the SDR and Limited member roles do not hold it, and owning or creating the campaign is not enough on its own. One check covers deciding a drafted message, applying approved copy, editing a step that will send, changing the prompt of a running sequence, approving a campaign's launch previews, launching or resuming a campaign, activating a sequence, sending a test to a real recipient, returning a paused contact to live outreach, approving the day's LinkedIn plan and enrolling contacts one at a time or in bulk. Pausing and stopping are never held behind it. If the member or the role cannot be read, the send is refused with a retryable error, and a workspace can build custom roles with or without the permission (roles and access docs). Custom approval workflows are offered by agreement (pricing).

6. Is there a limit nobody can approve past?

Why it matters: the most permissive setting tells you more about a system than its default does.

A good answer: a short list of actions that never run unattended at any setting; a rule that an approval can release a held action but cannot override a refusal; and actions with missing or unknown risk details stopped before any setting is read.

How SAGARIS answers: an action that is critical, irreversible and visible outside SAGARIS can never run unattended at any autonomy level. Placing a call waits for a named person even at the highest setting, and sending an email, sending a text, launching a campaign and booking a meeting stay proposals. An approval can release an action the gate was holding for review, and it cannot push through one the gate refused outright, whatever the role. An action whose risk details the gate does not recognize is stopped before any level logic runs (AI SDR page, agents and autonomy docs).

7. Does opt-out run before the approval queue?

Why it matters: a reviewer's time is best spent on contacts who can be contacted.

A good answer: suppressed contacts never reach a reviewer. An opt-out is tied to the email address and phone number, so it survives edits and re-imports, and if the suppression list cannot be read, the contact counts as suppressed.

How SAGARIS answers: suppression is checked before the agent produces a proposal, so a suppressed contact is never proposed for outreach (agents and autonomy docs). Opt-out is keyed on the email address and the phone number, so it survives the contact being edited, deleted or re-imported. A reply or a STOP stops the channel it arrived on, while a Do Not Contact, a spam complaint, a hostile or legal cease, or a request to leave everything stops every channel. A read error counts as suppressed, and a text also needs the contact's affirmative opt-in, because the absence of an opt-out is not consent (channels docs).

8. Can I stop everything at once?

Why it matters: the moment you want to pause is usually a busy one, and one switch is quicker than five settings pages.

A good answer: one pause that holds every channel together, with a release you can predict, and an unreadable pause state treated as paused. Replies keep arriving while sending is held.

How SAGARIS answers: the workspace emergency pause holds sequence email, SMS, LinkedIn steps and scheduled calls together for twenty-four hours, then lifts on its own. An unreadable pause state counts as paused, and inbound replies keep flowing (channels docs).

9. Does the AI ever place a phone call or speak to a prospect in an AI voice?

Why it matters: an AI voice on a call falls under federal consent rules (see the FCC ruling below), so this answer belongs in writing.

A good answer: the vendor says which calls an AI voice places, if any, on whose consent record, and whether the AI says it is an AI.

How SAGARIS answers: placing a call waits for a named person at every autonomy level, and outbound calls are made by your reps through the parallel dialer, with the AI writing the brief before the call and the notes after it (AI SDR page). A sequence can also carry an AI call step: a call task worked by the outbound agent rather than by a rep, which runs its own consent, suppression and quiet-hours check, and stays shut if that check fails, before a call starts. A rep can complete the task by hand instead. Voice also keeps to calling windows in the called party's local time and a per-number daily dial ceiling (channels docs). On inbound calls, the AI receptionist tells every caller it is an AI.

10. What does the audit trail show about who approved what?

Why it matters: months from now, someone will ask how a message got sent. A clear record turns that into a two-minute answer.

A good answer: each decision names the person, the time, any reason given and what actually happened next. Changes to the autonomy setting are logged with before and after values. The vendor also lists what the trail does not cover.

How SAGARIS answers: each agent tool call is recorded at every stage, from planned and held for approval through completed, failed, refused or stopped by the outbound switch. A decision on an agent action stores who decided, when, any reason they gave and a receipt of the outcome, with a matching row in the activity trail under that person's name (audit trail page). A held action also keeps the inputs the gate used (risk tier, whether it can be undone, and the autonomy level), so the verdict can be recomputed later (AI SDR page). The configuration trail keeps before and after values for the workspace autonomy level. SAGARIS lists the edges beside that: the trail is not tamper-evident, has no retention setting, is read inside the product rather than through the public API, has no export today, and switching inbox Auto-Mode on or off is not written to the configuration trail (audit trail page, audit log docs).

What US rules already expect of you

An approval gate is your control as much as the vendor's, because the rules place responsibility with the business whose name is on the message.

• Email: the FTC's CAN-SPAM compliance guide says the law makes no exception for business-to-business email. It also says that hiring another company to handle your email marketing does not contract away your legal responsibility, and that both the company whose product is promoted and the company that sends the message may be held legally responsible. Opt-out requests must be honored within 10 business days. Questions 7 and 10 are where an AI agent meets those rules.
• AI voices on calls: in Declaratory Ruling FCC 24-17, released 8 February 2024, the FCC confirmed that the TCPA's restrictions on "artificial or prerecorded voice" cover current AI technologies that generate human voices, so such calls need the called party's prior express consent unless there is an emergency purpose or an exemption. For telemarketing calls that use an artificial or prerecorded voice, the FCC's rule at 47 CFR 64.1200 asks for prior express written consent. That is question 9.
• A framework to map the answers to: NIST's AI Risk Management Framework (AI RMF 1.0), which NIST describes as voluntary, asks organizations to define and differentiate roles and responsibilities for how people work with an AI system and oversee it (GOVERN 3.2), to define, assess and document their human oversight processes (MAP 3.5), and to have mechanisms to supersede, disengage or deactivate an AI system whose outcomes do not match its intended use (MANAGE 2.4). Questions 5, 1 and 8 give you the vendor's side of each.

Whether a rule governs your own campaigns is a question for your counsel; this guide is not legal advice.

The 10 questions in one list

• Which actions can the agent take on its own, and can I see the whole list?
• Can it run outbound sequences and still let me approve messages before they send?
• What sends without a click per message?
• Does the gate sit under every route, or only on the screen?
• Who is allowed to approve?
• Is there a limit nobody can approve past?
• Does opt-out run before the approval queue?
• Can I stop everything at once?
• Does the AI ever place a phone call or speak to a prospect in an AI voice?
• What does the audit trail show about who approved what?

For the vocabulary behind the labels, read what an AI SDR, an AI sales agent and an AI Sales Operator are.

Frequently asked questions

What is an approval gate for an AI sales agent?

It is the point where an action the AI proposes stops and waits for a named person before it reaches a prospect or your records. The strongest gates also have limits no approval can override, check opt-outs before anything is proposed, and leave a record of who decided.

Should an AI SDR need approval for every email?

It depends on your volume and your risk. Approving each message gives the closest control; approving a sequence once at launch scales further, and works best with firm limits underneath: opt-out checked first, one stop switch, and actions no approval can override. In SAGARIS, a manual or task step is how you keep a person on a particular message inside a running sequence.

Does CAN-SPAM apply to B2B cold email?

Yes. The FTC's compliance guide says the law makes no exception for business-to-business email, and that you cannot contract away your legal responsibility by having another company send it for you.

Can the SAGARIS AI agent send an email by itself?

No. Its email, enroll and booking tools are proposal-only, and a person confirms on the real send surface. A running sequence sends on schedule once a person launches it. Inbox Auto-Mode, which would send low-risk replies on their own, is built but not offered to customers yet, so every drafted reply waits for a person.

Who can approve AI outreach in SAGARIS?

Anyone whose role holds the Approve AI outreach permission. By default that is Admin, Manager / Director, Sales, Director, RevOps admin and Sales ops, and an Admin can build a custom role with or without it. Pausing and stopping never need it.

Bring the list to every demo, ours included

Ask every vendor these ten questions and ask to see the answers in the product, not in a slide. Bring the actions your team takes and we will walk the SAGARIS permission table with you: book a demo.