The NORA Field Manual

Part one

Outbound breaks at research, not at volume

The standard diagnosis of a failing outbound programme is that it is not sending enough. The prescription follows automatically: more contacts, more sequences, more sending domains, another two reps on the floor, a tool that makes each rep faster at the part they already do. That diagnosis has been acted on for the better part of a decade, in thousands of companies, with more budget behind it every year. Reply rates have moved in one direction throughout, and it has not been up.

The constraint sits earlier in the motion than anyone likes to admit, because it sits in the part that does not look like work. Before a message can be worth reading, somebody has to have read the account. Not skimmed the website. Read it: what the company actually sells, how it goes to market, who owns the number, what changed in the last month, what the public record says about its funding and its hiring and its tooling, and which of those facts a specific person on a specific committee would recognise as true about their own week.

That reading takes something like thirty minutes to do honestly. It is unglamorous, it produces no visible output, and it is the first thing cut when the quarter tightens. A sales development representative with a daily activity target of fifty touches has, arithmetically, about seven minutes per account for everything: research, writing, sending, logging. Seven minutes is enough to find a name and a job title. It is not enough to find a reason.

So the reason gets invented. Every outbound team knows the shape of the invented reason, because everyone has written it. I saw you are growing quickly. Congratulations on the recent momentum. I imagine scaling is a priority right now. These are not lies exactly. They are statements engineered to be true of any company of that size, which is another way of saying they carry no information. A buyer reading one of them learns precisely one fact: that nobody looked.

1.1 Sequencers moved the bottleneck downstream

The tooling generation that dominated the last decade solved the wrong half of the problem, and solved it very well. Sequencers made sending cheap, scheduling reliable, and reporting granular. They industrialised the second half of a motion whose first half was still being done by hand, badly, under time pressure.

The predictable thing happened. When sending gets cheaper and research does not, the ratio between them shifts, and it shifts in the direction of more sends against thinner reading. Volume rose. The reading per account fell. Buyers, who are not stupid, calibrated accordingly: the base rate of a cold email being worth opening dropped, so the rational response was to stop opening them. Deliverability infrastructure then became a discipline of its own, which is a strange thing to notice about an industry. An enormous amount of engineering now exists to make sure that messages nobody wanted arrive reliably in inboxes where they will not be read.

None of this is an argument against sending, or against sequencing, or against measuring activity. It is an argument that adding capacity to the half of the motion that was never the constraint produces exactly what it produced.

1.2 Timing is public, and nobody owns it

The second failure is quieter and more expensive. Almost everything that makes an account worth contacting this week rather than never is published, dated, and free to read.

A company that has just posted three sales development roles has, in public, announced that its pipeline number went up before the team to hit it existed. A company that announced a funding round last month has committed to a growth figure in front of investors, and is writing the plan to reach it right now. A company running a sequencer and an enrichment tool has already decided outbound is worth funding and has a person who owns it, which changes the conversation from whether to how well.

Each of those is a dated, sourced, checkable fact about a specific account. Each one has a half life. And nobody with a quota has the hours to watch several hundred accounts for them, week after week, and act within the window while the fact is still fresh. So the timing signal goes unwatched, and outreach fires on the calendar instead: on the first of the month, on the day the list was imported, on whichever day the campaign was scheduled. The buyer receives a message whose timing is about the sender's month rather than the buyer's.

1.3 The autonomous sender answers the wrong question

The current generation of AI sales tooling has largely proposed to solve this by removing the human from the sending decision. Point the system at a market, let it write, let it send, review the results afterwards. The pitch is a headcount replacement, and it lands well in a quarter where headcount is frozen.

It answers the wrong question. The bottleneck was never the physical act of sending, which was already automated and already cheap. Automating the send again, with a language model in place of a template, mostly increases the rate at which unreviewed claims reach real buyers under a real company's name. When a model writes that an account raised a round it did not raise, the cost is not a bounced email. It is a named person at a named company learning that this sender does not check things, and that lesson does not expire.

There is also a governance problem that sales leaders tend to notice about six weeks in, usually when someone forwards them a message. Outbound email is the highest risk surface a young autonomous system can be pointed at, because it is external, attributable, permanent and unrecallable. A system with full send authority on day one has been given the maximum blast radius available in the entire go to market function before anyone has seen what it writes.

The premise of this manual is the opposite one. The research is the scarce thing, so automate the research completely. The send is the risky thing, so gate it until the record earns otherwise. What follows is a description of a teammate built on that arrangement.

Part two

NORA is hired as a teammate, and owns one number

NORA is an outbound research and activation agent on Nagent's sales team. She reports to SERA, the sales chief of staff, and works alongside DEXA on deal execution and RIVA on revenue operations. She is not a feature inside a platform and is not sold as seats. She is hired, given a cohort, held to a number, and governed like anyone else who can send email under the company's name.

That framing is not a marketing device. It reflects how the work is actually divided. A feature is switched on and configured. A teammate is briefed, watched for a fortnight, corrected, trusted with a little more, and eventually left alone with the parts that have earned it. The second arrangement is the one that matches what a sales leader actually needs from anything touching the top of the funnel.

2.1 The job description

NORA finds companies that match a written cohort definition, researches them properly, identifies and verifies the people who make the decision, watches for the signal that makes the account worth contacting now, writes the outreach against the evidence she gathered, and books the meeting. Sending is a human decision. Closing belongs to other people.

2.2 The number she owns

NORA's north star is qualified outbound meetings booked. Not emails sent, not accounts touched, not open rate, not a composite engagement score. One number, of the kind a sales leader already reports upward, and the same number a human sales development representative would be held to.

This matters more than it sounds. An agent measured on activity will produce activity, and will produce it faster than any human could, which is the failure mode that turns a promising pilot into a deliverability incident. An agent measured on booked meetings has to care about the reading, because the reading is what converts. The metric choice is doing governance work before a single guardrail is written.

Underneath the north star sits a funnel that a sales leader can inspect at any hour: accounts in the cohort, accounts qualified against it, decision makers identified, accounts activated, positive conversations opened, meetings booked, and the pipeline value attached. Each stage has a target. Mission control shows what NORA did today, what it cost, and what is currently waiting on a human. Those three questions are, in practice, the entire management interface.

2.3 Where NORA sits in the sales org

Nagent's sales team is four agents and the humans they work with. SERA is the chief of staff and owns the sales number. NORA runs outbound research and activation. DEXA handles deal execution. RIVA handles revenue operations. Human account executives and a sales head sit alongside them rather than underneath, and the whole team shares one workspace, one memory layer and one control plane.

The division of labour is worth stating plainly, because the most common misunderstanding about sales agents is that one of them is supposed to do everything. NORA's work ends when a qualified meeting is on the calendar and the context behind it has been handed over. What happens in that meeting, what happens to the opportunity afterwards, and what the forecast says about it are three other jobs owned by three other parties.

2.4 What is deliberately outside the remit

A remit is defined as much by its exclusions, and these are enforced in configuration rather than left to good intentions.

Part five

Messages are written from evidence and sent from a real mailbox

Two decisions determine whether outbound built this way survives contact with real buyers. The first is where the message is sent from. The second is what has to be true of a sentence before it is allowed into a draft.

5.1 The mailbox decision

Tenants connect their own Gmail or Microsoft Outlook mailboxes, and outreach sends from those. NORA does not send from Nagent's shared infrastructure on a customer's behalf. This was a deliberate architectural choice, made against the easier alternative, and it is worth explaining because it costs something.

The easier alternative is a managed sending pool: the vendor owns the domains, the warmup and the deliverability engineering, and the customer plugs in. It is simpler to onboard and it makes a demo look effortless. It also means the reputation being built belongs to the vendor and is shared with every other tenant on the pool, and the message arrives from a domain the recipient has no relationship with. When a neighbour on that pool behaves badly, the cost is socialised.

Sending from a team's own mailbox reverses each of those. Reputation accrues to the domain that will still be selling in three years. The message comes from a named person at a company the recipient can look up. Replies land where replies are supposed to land, in a thread a human can pick up mid conversation without an export. And the account genuinely belongs to the customer, which means leaving is possible, which is a fact worth being relaxed about.

5.2 The composer and the validator

Drafting runs in two separate steps with different jobs. The composer writes from the account brief, the committee map and the signal. The validator then checks the result: every factual claim against a retrievable source, plus the guardrails that apply to external communication.

The validator is the reason this motion can be trusted at volume. A language model asked to write persuasively will, if unchecked, produce a sentence that sounds like the research even when the research does not support it. A round that was a rumour becomes a round. A team of forty becomes a team of two hundred. Each of those is a small error that costs one relationship permanently, and a sales leader typically finds out about it from the recipient.

Requiring a source for every claim removes the entire class of error rather than reducing its frequency. It also has a second effect that shows up in the writing itself: a message that can only say things it can prove ends up shorter, more specific and considerably less like every other cold email in the inbox.

5.3 An example draft, annotated

The following is an illustrative draft composed against a fictional account, shown at the point where it would be queued for approval.

Example draft, composed against a fictional account for illustration

Three properties of that draft are worth naming. It contains exactly one factual claim about the recipient's company, and that claim is dated and sourced. It offers a diagnosis rather than a description, which is the only reason a busy person reads past the first line. And it asks for twenty minutes rather than a demo, because the ask should be proportionate to what has been earned by three sentences.

5.4 The cadence, and why it stops

Follow ups run at five days and twelve days, and then stop. Two follow ups, maximum, on a stage machine that only runs forward.

Most sequences do not stop, and the reason is arithmetic rather than conviction: the seventh touch has a non zero response rate, so removing it reduces a number that someone reports. What that arithmetic omits is the cost carried by every account that did not respond, which is a durable negative impression of the sender, and the cost carried by the team, which is a queue that never empties and a set of accounts that can never be approached again with a genuinely better reason.

A hard cap converts a permanent low grade campaign into a bounded, honest attempt. The account remains in the cohort. If a new dated signal appears in six months, it becomes a new attempt with a new reason, which is a materially different thing from touch number eight.

5.5 Reply handling

Every reply is classified into one of five intents on a small fast model, and routed accordingly. The economics of that choice are straightforward: classification is a narrow task that a small model does accurately and cheaply, and the alternative of paying a frontier model to read every out of office notice is how research budgets disappear into nothing.

What matters more than the classifier is the routing. Positive intent reaches a human the same working day. Everything gained in the previous nine steps is spent if a warm reply sits in a queue over a weekend, and this is the most common way that a technically successful outbound programme fails to produce meetings.

Part six

Autonomy is earned, and it starts switched off

NORA is classified as a high risk agent and joins on the first rung of a five rung autonomy ladder. Drafts are visible, nothing external leaves without a human decision, and the level moves up only when the record supports it. The control plane can also move it back down on drift, without waiting for anyone to notice.

Each agent carries a trust score alongside its level, and the two move together. Trust is not a sentiment. It is computed from the record: how often output was accepted without edit, how often a guardrail fired, how often a human reversed a decision, and whether behaviour has drifted from its own recent baseline. Warnings surface when trust moves more than ten points, and levels can be downgraded automatically.

6.1 Guardrails, blocking and advisory

Guardrails are per agent and carry three parts: a severity, a category, and an enforcement action. Blocking guardrails stop the action. Advisory guardrails let it proceed and record that it happened, which is the right treatment for rules that are usually correct but occasionally wrong for a defensible reason.

6.2 Approval authority and budgets

Approval authority is configured rather than assumed. Named approvers are set by address, with a fallback to anyone holding the relevant permission, and a service level in hours so that approval queues do not become a second bottleneck replacing the one this motion was built to remove.

Budgets are set per agent with daily and monthly caps and a fourteen day spend trend. When a cap is exceeded the behaviour is to queue actions for approval rather than to stop the agent, which is the difference between a cost control and an outage in the middle of a cohort.

6.3 Memory, and what learning actually means

NORA runs in continuous learning mode, adapting as outcomes arrive, with the alternative being a training window in which every action is queued for human approval while behaviour is being established. Memory is layered. A creator layer holds operator authored hard rules and brand voice, which the agent does not get to revise. A user layer holds observed tendencies, recent successes and recent failures, which is where genuine adaptation happens.

The separation is the whole design. Rules the business set stay where the business set them. Patterns the agent noticed stay clearly marked as things the agent noticed. Every turn persists the context it was assembled from, so a decision made three weeks ago can be replayed and inspected rather than reconstructed from memory by whoever was watching.

6.4 Why suggest only is a feature

The obvious objection to all of this is that a human approving every send caps the throughput, and that a competitor promising full autonomy will therefore send more.

That is correct, and it is the trade being made deliberately. The number NORA owns is qualified meetings booked, and meetings are not produced by send volume. They are produced by the reading, which is the part fully automated here. Approval costs seconds per draft against thirty minutes of research saved per account, so the ratio favours the arrangement heavily.

There is a second reason that becomes obvious in month two. The approval queue is the highest quality training signal available anywhere in the motion. A human accepting, editing or rejecting a draft, hundreds of times, against real accounts, is a stream of judgment that no amount of autonomous sending would generate. An agent that sends without review learns only from replies, which are sparse, noisy and slow. An agent that is reviewed learns from every single draft.

Autonomy then rises where it has been earned, which is rarely uniform. Research and enrichment can run unattended long before composition should. Follow ups within an established thread carry less risk than a first approach to a new account. The ladder is set per agent and per risk level for exactly this reason.

Part eight

Hiring NORA, and what the first month looks like

NORA is hired rather than licensed by seat. Three arrangements exist: a month of trial work, part time on a single cohort, or full time across a whole market with the research budget to match.