Outbound Agent is a B2B website-visitor de-anonymization and outbound engine that runs inside your CRM. It turns anonymous traffic into named companies, scores how well each fits your ICP, drafts a personalised outbound sequence, keeps your CRM the single source of truth, and reports the funnel every morning. Claude reads the data, scores the fit, and writes the copy; deterministic scripts do every side effect; a human approves anything that can't be undone. Unlike a rented tool, every part is there to see, swap and audit: your prospect data stays in your stack, and nothing leaves a draft without a person saying yes.
- Owned, not rented. A SaaS GTM tool hides its scoring and locks your prospect data in its tenant. Here the scoring is code you can read, and the data sits in a stack you control.
- The model never acts. Claude analyses, scores and drafts; it never sends an email, writes to the CRM, or activates a campaign.
- A human gates every irreversible action. Sending is the only step that can't be undone — and it happens exactly once, only after someone clicks Approve, only through a signed service that re-checks the draft hasn't changed.
- Two ways to drive it. The same pipeline runs from Claude conversationally and from a thin operator console — non-technical staff drive it without touching code.
01 · Why own your de-anon and outbound engine instead of renting SaaS
GTM automation — de-anon → enrich + ICP score → outreach → CRM sync → reporting — works, but bought as SaaS it's a rented control plane: you can't see how it decides, can't swap a weak data provider, and your prospect data lives in someone else's tool. Owned as code, which providers you use, how ICP is scored, what the copy may claim, and when a human must approve are yours to set and audit.
02 · Shape of the system
Everything specific to your go-to-market — the analytics property, the funnel, the CRM stages, the ICP rubric, the messaging, the outbound caps, the compliance rules — lives in configuration, not code. There are two windows onto one engine.
| Window | How it runs |
|---|---|
| Claude & cron | Invoke a loop conversationally in Claude, or let it run on a daily schedule under hard caps on spend and runtime. The scheduled pipeline is the on-demand one with a fixed prompt. |
| Operator console | A thin browser console shows the funnel, the drafted campaigns and the pending approvals, and lets a non-technical operator trigger a loop, approve a send, or edit configuration — with no write credentials of its own. |
03 · How it works — the outbound loop
The outbound loop turns a website visit into a reviewed, ready-to-send sequence — and stops at a human.
- Reveal & Enrich — scripts read the companies a de-anon provider wrote into your CRM and an enrichment provider fills in firmographics. Pure data movement; the model isn't involved.
- Score — Claude reads the firmographics and assigns an ICP fit tier against your rubric. Below the bar, the company is skipped — no draft, no spend.
- Draft — Claude finds the best-fit recipient and writes a personalised sequence, left as a draft in the sending platform — created, never sent.
- Approve & Send — a person reviews and approves; a signed service re-checks the draft against what was approved, confirms it's still a draft, then activates it exactly once. No model touches the send.
Two read-only loops run alongside it: a daily report that snapshots the funnel and pipeline to git every morning, and a conversion analyst that reads those snapshots and drafts at most one site-change proposal as a pull request — never an automatic change.
04 · Turning traffic into companies — and keeping it legal
De-anonymization is the core: most B2B traffic is anonymous, and the value is naming the company while interest is fresh. The layers that carry legal risk are off by default and enforced in code, not by policy memo.
| Layer | Status | How it works |
|---|---|---|
| Company-level | On | A provider reveals the visiting company and grades ICP fit; enrichment fills in firmographics. The loop works only the companies marked an ICP match — naming the account, not a person. |
| Person-level · US | Off by default | Can name individuals on US traffic. Stays off until its match rate is proven on your own traffic. |
| Person-level · EU | Blocked in code | Identifying individuals in the EU without consent is illegal. Hard-disabled as a setting that can't be flipped from the console — only a reviewed code change could touch it. |
Copy is governed too: every claim must ground in your published positioning or the company's own enrichment — the model cannot invent a customer, a metric, or a savings number.
| Claim | Allowed? |
|---|---|
| Cost / ROI vs competitors, grounded in your published proof points | Allowed |
| A specific savings promise to the prospect | Gated |
| An unshipped feature pitched as if available | Gated |
| Naming a customer not already public on your site | Gated |
05 · Approval — the gate
The send is the one irreversible action, so it is the most constrained. A small, always-on gate service is the approval authority and nothing more: it does not draft or score, holds no analytics or CRM credential, keeps the reviewed draft, confirms each approval is genuine and from an allowed approver, enforces single-use, and only then activates the campaign.
A human can approve from three places, two standard and one optional:
| Surface | Status | Notes |
|---|---|---|
| Operator console | Standard | Pending queue with Approve / Reject; the operator is identified by SSO, the button talks to the gate directly — the console holds no activation key. |
| Command line | Standard | A named approver behind a dedicated token, re-checking the draft and single-use rule, barred from any automated run. |
| Slack | Optional · off | Fully built but off by default; a cryptographically verified, single-use approval once a webhook is configured. Turning it on is config, not code. |
06 · Safe by construction
The non-negotiables — each enforced in code, not convention:
| Rule | What it guarantees |
|---|---|
| No model on the apply path | Reveal, enrich-read, report and send are deterministic scripts; the model only scores and drafts. |
| Sent equals approved | Each draft is fingerprinted at approval; the send re-checks it and refuses if a single byte changed — a late edit can't slip through. |
| Send happens exactly once | One activation is recorded per approval, so a double-click or a retried event can never send twice. |
| Injection containment | Untrusted text — company names, page copy, CRM fields — is normalised, scanned and fenced before the model sees it. |
| EU privacy enforced in code | Person-level identification in the EU is blocked at the data layer and can't be toggled on from the console. |
| Pinned, read-only connectors | Every data connector is version-pinned and limited to read access; no write tool is ever exposed to the model. |
| Capped spend & runtime | Every model step runs under a turn limit and a dollar ceiling, with a timeout as backstop. |
07 · Models
Pinned per loop, hardcoded — not configurable — so the system can't silently drift onto a model the guardrails weren't tuned for. Every model is from Anthropic.
| Model | Role | Default? |
|---|---|---|
| Claude Sonnet | Analysis, ICP scoring, draft copy and review | Yes |
| Claude Haiku | Optional one-line Slack / PR summaries | Opt-in |
| Claude Opus | The hardest reasoning only | Opt-in |
The daily report uses no model at all — it is pure arithmetic over the connectors.
08 · Integrations
gtm-agentic plugs into your analytics, CRM and outbound stack — swap any provider for the one you already run.
| Category | Examples |
|---|---|
| Analytics | Google Analytics (GA4) |
| CRM · source of truth | HubSpot, Salesforce, Pipedrive |
| Visitor de-anonymization | RB2B, Vector, Warmly |
| Enrichment | Clearbit, Apollo, ZoomInfo |
| Email finder | Hunter, Apollo |
| Outbound sending | Instantly, Smartlead |
| Notifications & approvals | Slack |
Already on a different de-anon vendor or CRM? We bind to whatever you run — adding a connector is a config change, not a new build.
What Outbound Agent is, in short
- An owned GTM engine. The full visitor-de-anon → enrich → ICP-score → outbound → CRM-sync → report loop, in versioned code, where the model does judgement and scripts do every side effect.
- Safe by construction. A human gates the one irreversible action; the send is fingerprint-checked, single-use and never touched by a model; EU privacy and brand-safe copy are enforced in code.
- Two windows, one engine. Drive it from Claude or from a thin operator console — with the gate, the audit trail and the guardrails the same no matter who pushes the button.
The same no-model-on-apply gate runs in Blogsmith and Marketing Ops.