Give Every Marketing And Sales Agent An Owner, Limits, And A Stop

Do not switch on a marketing or sales agent until three lines are written into its spec: the one person who answers for it, a limit on what it may spend and another on what it may send, and a stop that person can pull and watch take effect within minutes. A monthly budget reports on the account after the fact, and an agent does its damage one email at a time.

This page is for the marketing or sales leader asked to let an agent write to prospects or buy data about them. The limits that work sit inside the job, and the stop works only if someone is told to pull it. An agent that only drafts into a document a person reads needs an owner and nothing else. The three lines bound how much goes wrong, never whether the agent is right.

Empact Partners is a go-to-market consultancy. Software companies have brought us into their own marketing teams since 2020, and we now build the agents those teams run. The ones that route leads, report pipeline, and send outbound are our RevOps work, so read this knowing we sell it. A team whose agents only draft does not need us for any of it.

A Monthly Cap Stops The Account, Never The Job

Every example here comes from the agents we run on our own outreach, where we set these lines on ourselves first. In September we ran a job to qualify 11,558 software companies for that outreach.

The job searched the web for each one, ran as 3,037 separate jobs over two days, and carried no limit of its own. The only limit anywhere was the weekly allowance on the shared AI account it ran on, and the allowance did stop it.

The allowance also stopped everything else on that account until it reset six days later, and jobs built the same way had already emptied it twice in the eleven days before. A cap on the account is a real limit, but it belongs to the account: it fires last, and it fires for everyone.

What a builder said on Reddit

A September thread on runaway agent costs put the same lesson in one line:

“yep. i had a monthly openai cap and still woke up to a runaway loop. hard stop inside the job beats any billing dashboard.” — r/SaaS, Sep 2026

So the limit moved into the job, checked before each action. Every email any of our agents writes now passes through one send function. Before it sends, it checks the last 24 hours against two separate limits: twenty per inbox and three per company.

Vlad Shvets

Founder @ Empact Partners

Ask the builder of any agent one question before launch: if this job goes wrong at two in the morning, what stops it before the account’s limit does? If the honest answer is the account’s limit, the agent has no limit of its own, and everything else on that account shares its fate.

Spending gets its own limit inside the job too. We cost a research job on a small pilot first, and one that projects past half the weekly allowance waits for my yes before it launches.

Spend and send get separate limits because they fail differently. Money spent on the wrong searches is gone, and nobody outside the company saw it go. An email to a prospect cannot be taken back, so its limit is counted where the prospect would feel it, per inbox and per company, and never per month.

The Owner Is The Person Who Gets Told

On 26 October I stopped a research job that had been running for 22 hours. It searched Reddit for threads to personalize our outreach, about 45 calls a minute on an app other jobs shared, and I had no idea it was running. On paper it had an owner, and the owner was me. Nothing in it was telling me it ran.

We stopped it with a file it reads before each step, so a restart cannot bring it back. That mattered the next day.

After a reboot, the small process that restarts crashed jobs had brought back a second searcher, idle but running. We stopped it and gave it the same kind of stop file, and the restart process now checks that file before it restarts anything.

Vlad Shvets

Founder @ Empact Partners

An agent’s owner is the one person told when it runs, when it spends past its plan, and when it stops, and the only person who can let it do more. A job nobody hears from has no owner, whatever the spreadsheet says, and it runs until something outside it breaks.

The same day, a data collection for prospect reports started spending without my yes. Two pilot companies were done, with roughly a hundred dollars planned for the rest. The plan had a budget line in it, and the agent running it read the line as approval. A budget line is a ceiling. The owner’s yes, given with the total in front of them, is a separate act.

Letting it do more is the part we lock hardest. Our outreach runs on five levels of autonomy, and only I can move one, through a dialog on my own screen that defaults to Cancel. An agent can rewrite a setting in a file. It cannot click a button on my desk. The command refuses to run inside any automated job, and every change is logged and sent to me.

An owner who is told still needs the agent to stop when they say so. And an agent can stay inside every limit it has and still be wrong.

Limits Cap The Damage, And The Stop Ends It

On 2 November our follow-up batch began writing to prospects, every email reviewed and every inbox under the batch’s own cap of thirty a day. Fourteen went out in the first eight minutes. At 14:10 UTC one landed in a teammate’s inbox instead of the prospect’s, and the batch’s own check, which reads the sent folder, caught it and paused all sending by itself.

We fixed the route, and sending resumed at 15:02. Over the next twenty minutes 42 more went out. The check missed a second problem in both rounds: 48 of the 56 follow-ups carried broken thread headers, so they reached their recipients as new conversations instead of replies. Our own mailboxes showed them threaded, and the check read our mailboxes.

At 15:23 we paused the lane. The last email had left at 15:23:09, and the next attempt was refused at 15:23:19. The batch kept trying for another 85 minutes, and our send log shows all 322 attempts refused, holding back the follow-ups still due to 58 more people until the fix was in.

Read the three lines off that afternoon. The cap did its job, which was to bound the worst case at thirty emails per inbox, and it had no way of knowing the emails were wrong. The stop did its job in ten seconds. Neither could tell us the emails were broken. That was the owner’s reading, and it came late.

Vlad Shvets

Founder @ Empact Partners

Stopping took ten seconds. The first broken email had left 81 minutes earlier, because the check that should have warned us read our own mailbox instead of what the prospect received. Time a stop from the first bad email, never from the moment someone pulls it, and put the alarm where the prospect sits.

Since that afternoon a batch leaves five minutes between any two sends across all inboxes, and fifteen minutes between sends from the same inbox. A check refuses an email with wrong thread headers before it leaves. Whatever is left after a pause is spread across the hours remaining instead of going out the moment the pause lifts.

Watch the stop work before an agent sends its first email. The afternoon you need it is the wrong afternoon to find out whether it holds.

We now hold every agent to that rule before it writes to anyone. The fair objection, from a team that bought an agent to get hours back, is that every rule like it hands those hours straight back.

Governance Will Cost Us The Speed We Bought The Agent For

Most leaders who push back on rules like these have watched approval steps eat a pilot, and they are usually right about what they saw.

What a thread on AI SDRs said about review

“Reviewing every single draft is definitely not sustainable as volume grows.” — r/SaaS, Feb 2026

We pay that cost on purpose. Our reply drafter sends nothing on its own: it suggests every reply in Slack, a teammate answers go, edit, or hold, and the send function checks that answer against Slack before anything leaves. That is slower than an agent that sends, and on 4 November one of our limits made it slower still.

A prospect wrote back at 08:42 UTC that morning with a direct question, and our answer was refused. The follow-up batch had sent 25 emails from the same inbox the afternoon before, and they counted against its cap. That is governance standing between a buyer and an answer, and a team that has lived through one of those wants the cap gone.

We kept the cap and changed its shape. An answer to someone’s message no longer counts the batch’s emails, and an approved reply that meets a full cap now waits for room and goes by itself instead of being refused. The three lines were never the approval step. They are what lets a team stop approving one reply type at a time, decided in advance and never in a hurry:

Our outreach is still at level one, thirteen days after we set the levels. When a reply type clears its bar, moving it takes one person a minute, and nobody argues about whether the agent is ready, because the ledger already counts it.

Write The Three Lines Before The First Send

Write them where whoever builds the agent will read them, before it sends or spends anything. If you are buying an AI SDR rather than building one, ask the vendor three things: whose name on your side goes on it, what it may spend and send per day and per company, and how fast a pause stops a live run.

Here is how the three lines read on the agents we run on our own outreach today:

The same table is what a RevOps engagement with Empact Partners leaves behind. We audit the work your team repeats and agree the number the agent should move, then build one agent for one job, with a named consultant who answers for what it does. Its three lines go into the spec before it sends or spends, and before launch we pull its stop once while you watch.

An agent nobody has watched stop is not ready to write to a prospect, however good its drafts read. If you need one that writes to your prospects or buys data about them, built with an owner, limits, and a working stop from day one, book a call with me, and let’s find out whether we should build it together.