Most agent demos show the happy path. This is the other thing: an autonomous outreach loop whose limits live in code rather than in a prompt, and what happened on the first night it ran against the real internet.
An agent that can send email is only as safe as its honesty about what it sent. Prompts are the wrong place to keep that.
A rule written into a system prompt is a suggestion the model weighs against everything else it is trying to accomplish. Under pressure to finish a task, that is exactly the wrong shape. So in this system none of the operating limits are prompt text. They are a Python module the agent has to call, and it raises rather than complies.
Authority is granted once, by class, in a file. A row names the channel, the boundary, a daily cap, the receipt format, and how it gets revoked in under a minute. Miss any one of those five and the row is not a grant. Inside a granted row, the agent fires without asking. Outside one, it stops.
The cap is re-checked at the moment of writing, not at the start of the run, so a long job cannot drift past a limit it read ten minutes earlier. A send with no message id from the server is recorded as a failure, never as a success. That single rule removes the most common way an autonomous system lies to its owner.
The interesting guard is not the cap. It is the one that decides whether two messages are really two messages.
A mail merge differs from its siblings only where the merge fields were. So the system strips each recipient's identity out of the body, the company name, the email domain, the numbers, the URLs, and hashes what is left. Two genuinely personal messages still differ. A merge collapses to one hash and the second send is refused.
The first version of this was a heuristic that dropped the greeting line. It was wrong, and the tests caught it: the code normalised whitespace before it tried to split on newlines, so the check never ran at all. Using the company name from the lead record instead of guessing which words were variable turned a fragile rule into a precise one.
Tests that pass on broken code are worse than no tests, so each critical guard was disabled on purpose to confirm the right tests failed for the right reason, then the file was restored and checksummed to prove nothing was left behind.
Eighty six companies screened. Ten survived. The interesting number is the second one.
Three lanes ran in parallel. One returned a three percent hit rate, and the reason was structural rather than fixable: of eight maintainers checked closely, none published a way to contact them. The absence of commercial intent that made them a target was the same absence that removed the contact surface. That lane was killed the same night it launched.
Then the verification pass ran against the live web, and it disqualified the system's own best work. Four leads had already decayed between discovery and check: a careers page with no roles left on it, a role deleted, a job title that did not match the forum post it came from.
Half the strongest lane had a false premise, and the system found it before a single message went out.
The lane in question was built on companies with no product video. A text scraper cannot see one. Opened in a real browser, two of the four had video the whole time: eight files on one, at the thirteenth revision, in light and dark and mobile variants; on another, a player sitting inside the exact section the scraper had reported as empty.
Both messages would have opened by telling a founder something about their own homepage that was not true. Nothing was sent, because the premise is graded, and a premise that only a scraper believes is not graded as verified.
The habit above came from getting it wrong at higher stakes.
I built a tool that mines a developer's real sessions into a working profile, on the belief that giving an agent that context would make it work better. Then I tested it properly: the same tasks, the same agent, context against no context, in a controlled harness.
It lost. The behavioural rules tied. The project map, the part I was most confident about, lost twice. The harness voided three of its own runs on contamination checks, and I threw out the clean-looking halves too, because keeping those is how a comparison starts flattering itself.
The finding was that a map of things already discoverable in the repository stops the agent from reading the repository. That result cost a product I had spent months on. What survived was the evaluation method, and the habit of building the disqualifier before the demo.