Everyone tells you to build an AI SDR. Nobody hands you the wiring diagram.
Five layers, what each one actually does, and the single rule per layer that keeps it from getting you blocked.
Search “build an AI SDR” and you’ll drown in think-pieces about how agents will replace sales reps. What you won’t find is the part an engineer actually needs: the block diagram. Which components exist, what data flows between them, and where the tripwires are hidden. Because the tripwires are real — get the sending layer wrong and you don’t get a warning, you get a domain that quietly stops landing in inboxes for a month.
So here is the schematic. An AI SDR is five layers stacked in order. Skip one and the layer above it inherits its failures. The load-bearing insight running through all of them: an AI agent is a spectacular brain and a reckless pair of hands. It should choose the targets and write the words. It should never be the thing that decides how fast to hit send. That job belongs to a pacing layer that physically cannot be talked into going faster — which is exactly the seam WarmySender is built around.
The five layers, torn down one at a time
Each component below gets the same treatment: what its job is, which tools do it well, and the one safety rule that keeps that layer from taking down the layers beneath it. Read them as a build order — top to bottom, no skipping.
1 · Sourcing + research
Job: pull the right companies and people, then research each one so the first line isn’t generic. Tools: an AI agent — OpenClaw, n8n, Claude, Make, ChatGPT, Cursor — pointed at a contact source (import your own list, or draw from a 200M+ B2B database). This is where agents genuinely shine: reading a company, inferring a trigger, drafting a relevant opener at scale.
Safety rule: research ≠ send. Sourcing a thousand prospects is free and reversible. Keep this layer purely about who and why — never let it also hold the send button.
2 · Verification
Job: confirm every address is real before a single message goes out. Tools: real-time email verification wired directly into the pipeline, so a fresh list gets checked the moment the agent hands it over.
Safety rule: a bounce is a confession. Mailbox providers read hard bounces as a spammer fingerprint — you’re guessing at addresses, which is what spammers do. Verify first and a bad list becomes a caught problem instead of a reputation hit you can’t undo.
3 · Warmup
Job: teach the inbox providers that your mailboxes are a real human who gets real replies — and keep teaching them forever. Tools: continuous warmup on authenticated mailboxes (SPF, DKIM, and DMARC all passing), running alongside your real sending, not as a one-time chore.
Safety rule: never switch it off. Warmup isn’t a two-week onboarding step you graduate from; it’s the background hum that keeps you out of the spam folder while you send. Kill it and your reputation starts decaying the same week.
4 · Sending
Job: deliver the messages the agent wrote, at a rhythm no provider flags. Tools: a scheduler that meters each mailbox to a conservative daily ceiling (~40–50), spaces sends across the day, and ramps new mailboxes up gradually.
Safety rule: scale with mailboxes, not with volume. Ten mailboxes at 40/day beats one mailbox screaming 400/day every time. When you need more reach, you add senders — you never push a single mailbox past what a human could plausibly send.
5 · Reply-routing + follow-up
The fifth layer is where most home-built stacks fall apart, because it’s the least glamorous. Its job is to run the sequence after the first touch — timed follow-ups, conditional on whether the prospect opened, clicked, or went quiet — and, the instant a genuine reply lands, to stop automating and get a human involved. The tools are conditional, reply-aware follow-up steps that pause themselves the moment a thread turns into a conversation. The one safety rule: a live reply is a person, not a trigger. An agent should never fire follow-up number three at someone who already wrote back “sure, let’s talk” — that’s how a warm lead becomes a spam complaint. Route replies to a human; let automation own only the silence.
Where the agent stops and the guardrail starts
Here’s the seam that makes the whole stack safe, stated plainly. An AI agent connected to WarmySender over plain language can do the genuinely useful things: create and launch and manage campaigns across cold email, LinkedIn, and Instagram; create and enroll prospects; verify emails; configure warmup; and read back the stats. Claude, ChatGPT, Cursor, Codex, OpenClaw, Hermes Agent — any agent that speaks the protocol.
What it structurally cannot do is the dangerous part. The agent never sends a message, a DM, or an invite itself, and it can never raise a limit. When it “launches” a campaign, all that happens is the campaign gets written down and handed to the scheduler — nothing leaves in a burst. From there, WarmySender’s scheduler paces every email, every LinkedIn action, and every Instagram action inside safe daily, weekly, and hourly caps plus a gradual ramp — and it enforces that identically whether a human clicked the button or an agent asked in a sentence. Account safety wins the argument every time, because the agent isn’t in the argument.
That distinction matters most on LinkedIn, and it’s worth being blunt about why. A burned email domain is an annoyance — you can stand up a fresh one and be warming it by tomorrow. A banned LinkedIn account is gone for good. So LinkedIn actions stay pinned inside conservative, human-shaped limits no matter how eagerly an agent wants to move. (The one thing you’ll always do by hand: connecting and disconnecting accounts. That stays in the app, on purpose, for account security — it’s the single lever no agent gets to touch.)
How the layers hand off in practice
- Sourcing → Verification: the agent researches and drafts; the list is verified before anything is scheduled. No unverified address ever reaches a mailbox.
- Verification → Warmup: only authenticated, already-warm mailboxes are allowed to send, and warmup keeps running underneath the live campaign the whole time.
- Warmup → Sending: the scheduler releases messages at ~40–50 per mailbox per day, spread out and ramped — add mailboxes to grow, never volume.
- Sending → Reply-routing: follow-ups fire on your conditions; the moment a real human replies, automation steps back and a person steps in.
Wire those five together and you have an outreach engine where the agent supplies all the intelligence and none of the recklessness. It thinks; the scheduler paces; you keep your domain and your accounts.
Do I need all five layers, or can I skip a couple?
Every layer catches a failure the layer above it can’t. Skip verification and bounces poison your sending reputation. Skip warmup and even a verified list lands in spam. The stack is a chain — a missing link isn’t a shortcut, it’s the exact spot the whole thing breaks.
Can an AI agent really run all of this by itself?
It can run the decisions — sourcing, drafting, verifying, enrolling, launching, and reading stats — in plain language. What it can’t do is send anything directly or lift a limit. Those live with the scheduler, which paces every action inside safe caps regardless of who asked. The agent drives; it doesn’t get to floor it.
Does WarmySender find email addresses for me?
No — and that’s deliberate. You bring the addresses (import a list or draw from the 200M+ contact database), and WarmySender verifies them before they’re ever sent to. Verification is the safety layer; guessing at addresses is exactly the behavior that gets a domain flagged.
Why cap sending so low when I could send more?
Because ~40–50 per mailbox per day is what a real person plausibly sends, and inbox providers are tuned to notice the difference. The way to scale isn’t a bigger number on one mailbox — it’s more mailboxes, each behaving like a human. The cap is the feature.
Most “AI SDR” advice sells you the engine and forgets the brakes. Build the stack the other way around — brakes first, brain second — and it’ll still be running, and still landing, long after the flashier setups have burned through their third domain.