How Should an AI Agent Safely Generate Leads? A 6-Step Checklist from an okki-go Deployment Lead

If you're about to let an AI SDR build and contact leads without much supervision, read this first. This is the checklist I run before I let an okki go AI agent create a list for a new outbound segment. Yes, okki-go is the tool we use internally, but these mistakes apply to any agentic lead-gen setup.

I'm a RevOps implementation lead. For the past four years, I've handled AI sales-prospecting deployments for B2B outbound teams. I've personally made—and documented—9 significant mistakes, totaling roughly $11,400 in wasted tool spend and lost sender reputation. The March 2023 incident pushed me to write this checklist down. Since then it has caught 31 potential disasters in our workflow (as of early 2026, at least).

If your outbound program is 30 accounts that you know by name, some of these steps are overkill. But the moment you want an AI agent to find people you didn't already know, use the full list.

Step 1: Define "safe to contact" before the agent scores anything

An AI agent will happily generate leads. The problem is how it decides who qualifies. If you only give it "title contains director" and "company industry is SaaS," you'll get a list that looks fine in the dashboard and collapses on the phone.

Write the rule explicitly. For our mid-market outbound work, a lead only becomes contactable if:

• The person's role is tied to sales, revenue, or operations—not just any director title.
• The company has a recent trigger (funding, headcount, active intent on a relevant topic) within the last 90 days.
• The lead source has a documented, auditable origin.

That 30-minute exercise prevents most of the cleanup later. If a lead doesn't meet the rule, the AI agent should wait and re-score it next week, not send it today.

Checkpoint: before any query runs, ask: "What would make a prospect feel this outreach is relevant?" If you can't answer that, the agent shouldn't be generating leads yet.

Step 2: Use an enrichment waterfall, not a single-vendor blob

Most people default to one enrichment vendor because it's easy. Easy is fragile. In September 2022, I enriched 1,500 contacts through a single API and later found 28% of the titles were stale. It didn't look stale because the source was confidently wrong.

In API data enrichment, the goal isn't to fill every field. It's to validate the fields that matter and stop when confidence is high enough. That's what a waterfall does: call the primary data source; if it returns something missing or contradictory, call the next source; and repeat until a threshold is met. Don't merge every source at once unless you want to reconcile conflicting truth.

This is one of the reasons I deploy okki-go for agent-native prospecting. The okki-go AI agent runs waterfall enrichment before creating a lead record. If you're building a custom workflow, the okki go npm package can trigger a similar order from your own backend. Whatever you use, the principle is the same: define source order before you start, and decide what to do when sources disagree.

I'll be honest: this step feels counterintuitive. More data feels safer. In practice, extra fields often make stale data look authoritative.

Step 3: Verify email and phone numbers after enrichment, not before

Enrichment is the best guess. Verification is checking whether the guess is real. They are different steps.

Syntax-only verification isn't verification. I once sent 4,000 emails that all had "valid" syntax. 684 bounced. That's a 17% bounce rate, and it got our sending domain blocked for almost a week. The problem wasn't the subject line or the copy; it was the contact data.

Run mailbox-level verification (or as close as your provider can get), check for role accounts like info@ and sales@, and flag disposable domains. If you're using phone numbers in a parallel dialer, verify those too. Phone data decays faster than email in my experience.

Step 4: Cap your parallel dialer before you turn it on

Parallel dialers are not bad. They're dangerous when you use them to amplify unverified data. In a 2023 campaign, our team set 150 parallel call lines and got 3 conversations. The dialer worked perfectly. The list didn't. High volume just burned phone numbers and made our response rates look terrible.

Set a maximum number of active lines, time-of-day windows, and a daily cap per agent. If pickup rates drop after the first day, pause and refresh the phone data. Don't let the agent raise its own limits.

The myth: parallel dialing causes poor reply rates. The reality: poor contact data causes poor reply rates. A dialer only makes the problem go faster.

Step 5: Put a human in the loop for pattern review, not approval theater

"Human-in-the-loop" doesn't mean manually approving every row. It means reviewing samples early and periodically. I recommend the first 50 generated contacts per new segment before the first send, and the first 50 replies every week after that.

In Q1 2024, an agent started generating "new" leads from an old target list because someone had re-uploaded it with a new label. The pattern review caught it before it went out. If you rely only on automated scoring, you'll miss those moments.

At okki-go, we call this human-in-the-loop outreach. It isn't a check-box feature. It's a process you have to staff.

Step 6: Keep an audit trail for every generated lead

When something goes wrong—and it will—you need to explain why a contact was chosen. For okki-go, agent-native prospecting means each lead record comes with a mini trace: where the contact was found, which enrichment call returned what, the verification result, and the stated reason for outreach.

If you build your own stack, keep the same logs. Save the query criteria, vendor response IDs, timestamps, and reviewer notes. "I don't know" is no longer acceptable for an AI-generated lead decision.

An audit trail isn't just compliance theatre. It's how you debug performance. When results are bad, you can check whether the problem was the copy, the data source, or the threshold. Without logs, you're guessing.

Additional rules I now enforce

• No purchased list with a vague origin. If you can't document where a record came from, don't let an AI agent use it.
• No fabricated references or fake personalization. Per FTC guidance (ftc.gov), claims still have to be truthful and substantiated—even if an AI wrote them.
• No single-source enrichment for high-value contacts. Waterfall, or skip.
• No scaling without re-running the checklist for a new segment. Each segment creates new data risks.

To be fair, if your entire outbound motion is a handful of named accounts, this is overkill. But the moment you want an AI agent to generate leads beyond your own knowledge, this is the difference between a process that scales and a process that explodes.