Writing cold email sequences with AI: what the model drafts and what people lock down

Divide the work before the first draft

An AI cold email writer is good at structure, tone, compression, and variation. It is bad at knowing which facts about your company are true, which customers agreed to be named, and what a recipient would find misleading. Decide up front which parts of a sequence the model drafts and which parts it may only copy from an approved source.

What the model should write

Short, plain-text emails with one idea each. The first message explains why someone in this role at this kind of company might care, in the words a peer would use. Later steps add one new angle, such as a different problem, a concrete example the company can support, or a simple question, rather than repeating “just following up.” Beyond a handful of steps, each additional message asks more of someone who has not replied.

Actually Agentic’s discovery prompt asks for one to six plain-text emails, each with a delay in days, subject variants, and a rationale, and it forbids inventing customers, metrics, integrations, urgency, or personal facts. The server accepts one to five subject variants per step and delays of up to 60 days, and it requires steps numbered contiguously from one. [1]

• One idea per email, stated in the first two sentences.
• Relevance to the role, not flattery of the person.
• A low-friction ask: a question, a reply, or permission to send detail.
• No fake “Re:” or “Fwd:” prefixes and no manufactured deadlines.
• A rationale for each step so a reviewer knows what it is for.

Subject lines and headers must be honest

The U.S. CAN-SPAM Act makes no exception for business-to-business email. It prohibits deceptive subject lines, because the subject must accurately reflect the content, and false or misleading header information, including the From, To, and Reply-To fields. It requires a valid physical postal address and a clear way to opt out, and opt-outs must be honored within 10 business days. Hiring a vendor does not transfer that responsibility. [2]

Those rules translate directly into prompt instructions: no subject line that implies an existing conversation, no sender name the recipient would not recognize as the real person, and no claim the body cannot back up. Canadian recipients raise separate consent questions, including whether a conspicuously published business address supports implied consent, so review each jurisdiction you target with counsel. [3]

Personalize only from recorded evidence

The riskiest line in an AI-written email is the personal one. “Loved your talk last week” is either true and sourced or a fabrication the recipient will spot. Allow personalization only from evidence the system has recorded, such as the role, the company’s published focus, or a page the sourcing step actually visited, with its URL kept for review.

Actually Agentic’s discovery stores provenance for each lead, including the source URL, extraction method, confidence, and a SHA-256 evidence hash, rather than page bodies. That supports relevance at the level of role and company. It does not support intimate personal detail, and the prompt tells the agent not to invent personal facts at all. [3]

A useful test: could you show the recipient where each personalized sentence came from without embarrassment? If not, delete it.

Plain text, and a footer the service controls

Write the body as plain text. It renders the same everywhere, reads as though a person wrote it, and leaves no room for hidden content. Actually Agentic accepts sequence bodies as plain-text message content only. The service appends the approved postal address, opt-out text, and unsubscribe URL, and it submits messages with plaintext alternatives, List-Unsubscribe headers, and one-click unsubscribe support. [1][4]

Keeping the footer out of the model’s hands is deliberate. A model asked to “include an unsubscribe line” will paraphrase it, forget it on step four, or bury it. Compliance text belongs to deterministic code and the approved campaign record, not to a generation step. Google’s sender guidelines also require bulk senders to Gmail to support one-click unsubscribe. [5]

Review the rendered template, then measure replies

Approve what recipients will see: each step rendered with the real sender, the footer, and a representative merge, not a summary of the sequence. Approval should bind to that version. If the agent later changes a claim, a subject line, or the call to action, that is a new version and needs a new review.

Then measure conversations. Opens are an unreliable signal, because mail clients can load or block tracking images whether or not anyone read the message, and clicks are rare by design in plain-text outreach. Count positive replies, total replies, opt-outs, complaints, and hard bounces against messages delivered. In Actually Agentic, replies, permanent bounces, complaints, and unsubscribes stop future steps for that recipient automatically; nobody has to classify the reply first. [1]