AI & agentic workflows

SaaStr surveyed AI SDR outcomes and the split was brutal: 83% of teams got nothing, 3% got real revenue (SaaStr/Lemkin, 2025). Same models, same vendors, same year. The gap was not the model. The 3% fed their agents proprietary context and constrained what they could say. The 83% pointed a general model at a generic list and let it write whatever it wanted. The training is the product. An LLM with a good prompt and no proprietary data still writes commodity messaging, because outbound is a reasoning problem, not a routing problem.

An LLM that hallucinates a funding round or reads “not interested” as “book a meeting” does damage quietly and at scale. One bad prompt does not send one bad email. It sends ten thousand. So the discipline is three questions asked in order: when to reach for a model at all, how to fence it once you do, and where a human or a rule stays in the loop so the blast radius stays small. This guide ships all three: the routing rule, the guardrail schema, the shadow-mode loop that proves the model before it touches a prospect, and the confidence gate that keeps the irreversible actions human.

Use a model for judgment, a rule for facts

Reach for an LLM when the task is reading unstructured text and returning a judgment or a short generation: scoring ICP fit from a website, pulling a title’s seniority, classifying an inbound reply, drafting one contextual line. Do not reach for one when a join or a comparison already gives the answer. Whether a company has more than 200 employees is arithmetic, not a prompt. Whether a domain matches a target account list is a lookup. Every field a rule can fill, fill that way. It is cheaper, faster, and cannot invent a value that was never in the data.

This matters more than it looks. A model asked to decide headcount >= 200 will be right most of the time and wrong on the rows where the website says “hundreds of employees” and the model rounds up. A rule reading a structured field is right every time or it is null, and null is honest. Push facts to rules, reserve the model for the reads that genuinely require reading.

Model choice is empirical, not tribal. Test 10 rows across models before you commit. For copy that has to sound human and for long-context account research, Claude earns it: Haiku for volume classification, Sonnet as the default, Opus for the hardest reasoning and writing. For agentic web research and cheap high-volume transforms, GPT and open-weight models (Kimi, GLM, DeepSeek at TAM scale) hold up. The task picks the model, and the cost delta between tiers is large enough that picking wrong at volume is a budget line, not a rounding error.

Relative cost per callReasoning score (rel.)

View as table

Stage	Value
Small / fast	1
Mid / default	6
Frontier / hardest	18

The read from the toggle: quality climbs, but the cost curve is steeper than the quality curve. Frontier models are three times the reasoning-adjusted price of the mid tier for a fraction more capability on a classification task. Reserve them for the rows that need it, which for most GTM work is the copy generation and the borderline judgment, not the volume classification underneath.

Task	Tier	Why	Rough $/1k rows
Reply classification into fixed labels	Small / fast	Bounded output, high volume, tuned prompt hits 90%+	$0.30 to $1
Title to seniority band	Small / fast	Pattern match, no reasoning	$0.30 to $1
ICP-fit score from a website	Mid	Reads unstructured text, needs judgment	$3 to $8
One grounded first line	Mid to frontier	Has to sound human; this is the read customers see	$8 to $20
Account research summary (10-K, docs)	Frontier long-context	Long input, synthesis, one-shot per account	$15 to $40

Numbers are order-of-magnitude and move with provider pricing; the ratios between rows are the point. Run the classifier on the cheap tier and the first-line generation on the tier that sounds human, and you spend the budget where a prospect can tell the difference.

The shape of a safe AI workflow

Before the components, the shape. A GTM AI workflow that does not burn you has four fixed parts: an input that is grounded (facts fed in, not invented), a model doing one narrow job, a confidence gate that splits high-confidence from low, and a logging tap that records every decision. Shadow mode wraps the whole thing while you build trust: the model runs and scores, but its output is compared against a human decision instead of acting. Only after the agreement rate clears your bar does the auto-action path open.

A worked reply classifier

The prompt is the artifact. Here is the shape that produces auditable output instead of prose you have to parse:

System: You classify sales email replies. Return ONLY JSON.
Labels (choose exactly one): interested | not_now | not_interested
  | referral | ooo | unsubscribe
Rules:
- "take me off your list" / "stop emailing" => unsubscribe
- "reach out in Q3" / "not right now" => not_now
- "talk to my colleague" + a name/email => referral
- If ambiguous, lower the confidence; do not guess a strong label.
Output schema: {"label": <one of the labels>, "confidence": 0.0-1.0,
  "reason": "<12 words max>"}

User: <raw reply text>

Force JSON, enumerate the labels, give the model an explicit instruction to lower confidence rather than guess, and cap the reason so the log stays readable. The reason field is not decoration; it is what you read when you audit a bad call. Never let a model return free text you then regex for a label. That path fails silently on the day the model phrases it a new way.

Constrained creativity beats an open prompt

The failure mode for AI copy is the slop cannon: a model handed a blank field and told to “personalize.” What works is a static template with AI-written sections only, grounded in data you fed it and fenced by guardrails. The model fills a first line and a proof point; it does not invent the offer or the CTA. The eng brief calls this constrained creativity, and it is the single technique that separates the copy prospects reply to from the copy that trains them to filter your domain.

Woodpecker’s read across 26,000 campaigns puts a number on the payoff for getting this right, and on the cost of getting it wrong:

Approach	Reply rate	What it means for AI
Spray-and-pray	1-3%	A model told to “personalize” a generic list lands here
Segmented bulk	3-7%	Cosmetic personalization (first name, company name)
Signal-triggered	10-20%	Grounded first line off a real signal, constrained template
Fully personalized	20-40%	Human-level context; the ceiling AI helps you approach at scale

Source: Woodpecker, 26,000 cold-email campaigns, 2024-2025. The jump from spray to signal-triggered is a 3 to 10x lift, and it is entirely a function of grounding and restraint, not model size. A frontier model on a generic list still lands in the 1-3% band.

1. 1

   1. Write one narrow job

   A fixed output schema, second person, with fallback logic for a missing field. Not an open instruction. The model fills sections; it does not decide the offer.

2. 2

   2. Ground every factual claim

   Feed in funding and headcount; never let the model assert a firmographic it was not given. A fact absent from the input stays absent from the output.

3. 3

   3. Force and validate structured output

   Enumerated labels or booleans, checked against the schema before anything downstream reads it. Reject and retry on malformed JSON, never pass it on.

4. 4

   4. Cap length

   50 to 125 words beat 200-plus by 2.3x on reply rate. Put the cap in the prompt and validate it after.

5. 5

   5. Attach a confidence signal

   A threshold that routes low-confidence rows to a human instead of acting on a shaky read.

6. 6

   6. Log input, output, model, cost

   So you can audit a bad decision and prove an unsubscribe was honored inside the two-day window.

7. 7

   7. Sample against a gold set weekly

   A tweak that helps one case breaks ten. Catch drift before it compounds across a full send.

Shadow mode: earn the auto-action before you take it

The mistake teams make is flipping an AI decision to auto-action on day one because the demo looked good. Shadow mode is the fix, and it costs nothing but patience. Run the model live against real data, log its decision, but do not act on it. Instead, let the human make the call as they always did, and compare. After a week you have a labeled sample: where the model agreed with the human, where it did not, and which labels it gets wrong. Only when agreement clears your bar (I use 95% on reversible actions, higher on anything I cannot undo) does the auto-action path open.

This is a report, not a vibe. Log both decisions to a table and query the confusion directly:

-- Model vs human agreement over the shadow window, by label
SELECT s.model_label,
       s.human_label,
       COUNT(*)                                    AS n,
       ROUND(AVG(s.model_confidence), 2)           AS avg_conf
FROM ai_shadow_log s
WHERE s.logged_at >= DATEADD('day', -7, CURRENT_DATE)
GROUP BY s.model_label, s.human_label
ORDER BY n DESC;

-- Roll it up to one agreement rate per label to set the gate
SELECT model_label,
       ROUND(SUM(CASE WHEN model_label = human_label THEN 1 ELSE 0 END)
             / COUNT(*), 3)                        AS agreement
FROM ai_shadow_log
WHERE logged_at >= DATEADD('day', -7, CURRENT_DATE)
GROUP BY model_label
ORDER BY agreement ASC;

The bottom of that second result is where you look. If not_interested agrees 98% but referral agrees 71%, you auto-action the first and keep the second human until the prompt improves. You do not flip the whole classifier on one blended number, because a blended 92% can hide one label at 71% that is quietly misrouting your warmest replies. This is the same distribution discipline that scoring models need: a single average is a label, not a score. If you are building the routing layer underneath this, scoring and routing covers the fit-versus-intent split that keeps the inputs clean.

Clay column, n8n node, or a real agent

	Clay AI column	n8n + LLM node
Best for	One prompt per row, enrichment-style	Multi-step flows where output feeds branching and API calls
Infra	None; Claygent built in (1B+ runs, web research)	You run n8n; more control, per-execution cost
Debuggability	Row-level, easy	Node-level, still deterministic
When to skip	When the step needs to branch on its own output	A true multi-turn agent is rarely needed; reserve it for when the action sequence is unknown up front

The word “agent” is doing a lot of unearned work in GTM tooling right now. Most of what gets sold as an agent is a fixed pipeline with a model at three named steps, and that is the right architecture for almost everything. A true multi-turn agent, where the model decides its own next action from a tool set, earns its complexity only when the action sequence genuinely cannot be known in advance. Account research that might need to read a website, then a 10-K, then a news search depending on what it finds is a real agent case. Classifying a reply is not. Reach for the agent last, after the fixed pipeline with logging works, because an agent multiplies both the capability and the ways it can go wrong.

ICP-fit scoring from a website disagrees with a human on 10 to 20% of borderline accounts, so use it to rank and filter, not as the sole gate on a high-value account. The 11x exposé (fake logos, 70 to 80% churn, CEO out in May 2025) is the cautionary tale for what happens when you skip this and ship an autonomous agent before a human motion works: the agent scales the mistakes as fast as it scales the sends.

Where I would start

Before you buy an autonomous SDR, get one AI step working end to end: a reply classifier or a grounded first line, with structured output, a confidence gate, logging, and a week of shadow-mode agreement data behind it. That single loop teaches you everything the agent needs and nothing the demo showed you. If you cannot audit one classifier, you cannot audit an agent, and an agent you cannot audit is a liability that ships at machine speed.

The 3% who got revenue did not have a better model. They had proprietary context feeding a constrained prompt, a gate that kept the risky calls human, and a log they could read when something went wrong. Build that loop on one step this week, prove the agreement rate in shadow, then open the auto-action path one label at a time.