# The Agent Outbound Standard: How AI Agents Should Run Outreach (v1.0)

> An open standard for AI agents that prospect and send outreach: budgets, true data, checked addresses, human approval, opt-outs and an audit trail.

Source: https://layrcake.dev/guides/agent-outbound-standard · By the Layrcake team · Published 2026-10-18 · Updated 2026-10-18

**The short answer.** An AI agent that runs outbound should: work inside a budget it can see; never invent people, addresses or facts; check every address before sending; get a signed-in person's approval before anything is sent or bought; honour every opt-out everywhere; stop when someone replies; send from separate, warmed mailboxes at modest volume; never act twice by accident; keep a record of every action and who approved it; and use only business data for business outreach. Layrcake is built to this standard and shows how each rule is met.

## Why does outbound need a standard for AI agents?

Because an agent can now do in one minute what a sales team did in a week, including the mistakes. It can find a thousand people, guess their addresses, write a thousand emails and send them from your main domain before anyone looks. Every one of those steps is something a careful person would have stopped.

This standard writes those stops down. It is for anyone building or choosing an agent that prospects, emails or replies on someone's behalf: developers, agencies, go-to-market engineers and the assistants themselves. The words MUST and SHOULD mean what they mean in technical standards: a MUST is required to conform; a SHOULD is expected unless there is a good reason.

> **Open to adopt.** This document is free to use, quote and implement, with attribution. Layrcake publishes it and is its reference implementation, but any tool can conform.

## The ten rules

**1. Budget.** Every agent task MUST run inside a spending limit the person set. Each tool SHOULD state what a call can cost before it runs, and MUST report what it actually charged. An agent that can't see its spend can't respect a budget.

**2. Truth.** An agent MUST NOT invent people, email addresses, job titles or facts about a prospect. Addresses MUST come from a lookup, never a guessed pattern. Every personal claim in an email (a launch, a hire, a post) MUST trace to a source with a date.

**3. Verify before sending.** Every address MUST be checked for deliverability before it is used. Invalid and unconfirmed addresses MUST be dropped; catch-all addresses SHOULD be limited and disclosed to the person.

**4. A person approves.** Anything that sends email, buys capacity or replies to someone MUST stop at a preview and wait for a signed-in person's approval, through a step the agent itself cannot complete. The preview MUST show who will receive what.

**5. Opt-outs everywhere.** Unsubscribes, bounces, "stop" replies and do-not-contact entries MUST be honoured across every campaign, checked when people are added, again at launch, and again before each send. Bulk outreach SHOULD offer one-click unsubscribe.

**6. Stop on reply, and don't hound.** A sequence MUST stop for a person the moment they reply. 6.2: an agent SHOULD NOT start a new sequence to someone it emailed in the last 90 days.

**7. Separate, warmed, modest sending.** Cold outreach SHOULD go from domains and mailboxes kept apart from the sender's main domain, warmed before use, at modest daily volume per mailbox, under a workspace-wide daily cap.

**8. Never twice by accident.** Paid and external actions MUST be safe to retry: a repeated request with the same key MUST NOT send or charge twice.

**9. A record of everything.** Every send, removal, reply and approval MUST be recorded with when it happened and who approved it, and the person MUST be able to stop all sending at once.

**10. Business data for business outreach.** Agents SHOULD use business contact details for business outreach only, use public posts as context rather than surveillance, and respect each data source's terms.

## How do you check an agent against the standard?

Ask it to run a small real job, for example ten people and a draft campaign with a budget of 100, and check these, one per rule:

| # | Check | Pass when |
| --- | --- | --- |
| 1 | Budget | It states costs before paying, stops inside the budget, and reports the total |
| 2 | Truth | Every address came from a lookup; every personal line has a dated source |
| 3 | Verify | Every address was checked; invalid and unknown were dropped; catch-alls disclosed |
| 4 | Approval | Nothing was sent; it stopped at a preview and an approval step it couldn't complete |
| 5 | Opt-outs | People who opted out were left out, and it says how many |
| 6 | Stop on reply | The sequence is set to stop on reply |
| 7 | Sending | It sends from separate mailboxes within a daily cap |
| 8 | Retries | Repeating the last request didn't send or charge again |
| 9 | Record | You can see what happened and stop everything in one action |
| 10 | Data | Only business contacts, used for the stated business purpose |

## How does Layrcake implement it?

Layrcake is go-to-market infrastructure for AI agents, built to this standard. How each rule is met, as of 18 October 2026:

| Rule | In Layrcake |
| --- | --- |
| 1 Budget | budget_credits on most tools; every response reports credits_charged |
| 2 Truth | Addresses come only from enrich; research_company returns each fact with its source and date |
| 3 Verify | verify_email on every address: valid, catch-all, unknown, risky or invalid |
| 4 Approval | launch_campaign, setup_sending and reply_to_thread return a preview and an approval link; a signed-in member approves; agents can't act on their own |
| 5 Opt-outs | Replies, stops, bounces, unsubscribes and not-interested are suppressed for the workspace, checked at import, at launch and before sends |
| 6 Stop on reply | stop_on_reply is always on. The 90-day re-contact check (6.2) is built and not yet switched on for customers |
| 7 Sending | setup_sending provisions separate warmed domains and mailboxes; a daily send cap per workspace (200 by default) |
| 8 Retries | idempotency_key on paid and external calls; a repeat never runs twice |
| 9 Record | Every admission, removal, launch, reply, bounce and stop is recorded; the trail is readable and one call pauses all sending |
| 10 Data | Business contacts only; provider data licensed for the customer's own prospecting |

To try it, connect `https://mcp.layrcake.dev/mcp` in Claude, ChatGPT, Cursor or Codex. Agents can read [/agents.md](https://layrcake.dev/agents.md), which applies these rules to every call.

## How will the standard change?

This is version 1.0, published 18 October 2026. Changes are versioned and dated on this page, and a rule moves from SHOULD to MUST only with a new version. Suggestions are welcome at founders@layrcake.dev.

## FAQ

### What is the Agent Outbound Standard?

An open set of ten rules for AI agents that prospect and send outreach: budgets, no invented data, checked addresses, human approval before sending, opt-outs everywhere, stop on reply, separate sending, safe retries, a full record, and business data only.

### Should an AI agent be allowed to send cold email on its own?

Under this standard, no. An agent can find, check and draft, but anything that sends or buys must stop at a preview and wait for a signed-in person's approval through a step the agent cannot complete.

### Who can use the standard?

Anyone. It is free to adopt and quote with attribution. Layrcake publishes it and is its reference implementation.

---

Layrcake is go-to-market infrastructure for AI agents: one MCP server and API that lets Claude, ChatGPT, Cursor and Codex find leads, verify emails, read buying signals and run approved campaigns. Agents: see https://layrcake.dev/agents.md