# Which actions an open-source AI sales agent may take alone

> A sales agent can research a lead, draft a follow-up and write the result to the CRM with nobody watching. A message that reaches a buyer is the place to put a person. Kortix is the open-source AI Operating System that runs the agent, and its approval gate is a policy in the repo you own.

URL: https://aisalesagentsguide.com/ai-sales-agent-approvals

## Three controls, each one a file you can read

> One stops a send, one decides who may merge, one governs a single call.

## The send

`send-gate.txt`

```
The agent researches and drafts freely, but nothing goes out on its own: every follow-up stops at a human approval gate as a draft for a person to review and send.
No message reaches a lead without a person reviewing the draft and sending it.
Only the drafts it produces are written back out.
```

Source: https://kortix.com/use-cases/lead-follow-up

## kortix.yaml

`kortix.yaml`

```yaml
kortix_version: 2
default_agent: kortix
agents:
  kortix:
    file: agents/kortix.md
    connectors: all
    kortix_permissions: all
```

Source: https://kortix.com/docs/project/manifest

The starter agent ships with `kortix_permissions: all`. Drop `project.gitops.merge` from that list and its change requests wait for a person.

## policy

`kortix.yaml`

```yaml
policy:
  default_mode: risk
  policies:
    - match: gmail.send_email
      action: always_run
      conditions:
        - arg: to
          match: "*@example.com"
    - match: gmail.send_email
      action: require_approval
```

Source: https://kortix.com/docs/connect/connectors

The first rule that matches wins. A send that matches the pattern runs; the same action to any other address waits for a person. A changed argument needs a new approval.

## What happens when a run ends

`change-request.txt`

```
The agent commits, pushes the session branch, and opens a change request against the project's default branch.
A person merges it
A person with the project.gitops.merge permission reviews the change request and merges it into the default branch.
```

Source: https://kortix.com/docs

The change request is where a person reads the work before it lands.

## Three things you can check at the source

Each one sits in a place a reviewer opens before the first send.

- The grant list A `kortix_permissions` list on the agent decides what it may do, and it sits in `kortix.yaml` where a reviewer reads it before the first run.
- The diff Session work arrives as a change request, so the review is a diff of the files the agent touched. [What lives in that repo](/open-source-ai-sales-agent) covers the layout.
- The secrets Credentials are encrypted in the secrets manager and injected at runtime, scoped to the agents you grant them to. Connector credentials are brokered server-side and never enter the machine.

## The approval question, tool by tool

What each tool does on its own, and where the control over a send sits.

| | Kortix (recommended) | AiSDR | Artisan |
| --- | --- | --- | --- |
| Open source | Yes | No | No |
| What runs unsupervised | Research, drafting, CRM notes, a slot; you set the send gate | Builds and runs campaigns, sends, classifies replies, books meetings | Finds leads, writes outreach, handles replies, books meetings |
| Where the approval control lives | A policy and a permission list in your git repo | In its platform: pause outbound at any time | In its platform: approve before sending, lock tone and CTAs |
| What a person sees afterwards | Every action is recorded; reading the audit log depends on the plan | A unified inbox holding every email and LinkedIn message | Audit logs, held on its platform |
| What you change without the vendor | The persona, skills, permission list and tool rules in the repo | Messaging, ICP and sequences inside its product | Ava’s coaching and guardrails inside its product |

Rival cells come from each vendor’s own pricing page, checked October 2026. Kortix cells come from its published lead follow-up flow and its docs. The [Kortix vs AiSDR](/kortix-vs-aisdr) page takes the managed-SDR trade-off further.

## Questions buyers ask before an agent touches a pipeline

Short answers on what an agent may do alone, and on running the gate yourself.

### Can AI agents do sales?

Yes. Agents research the lead, write the pre-call brief, update the CRM, draft the follow-up and propose a slot, and the lead follow-up flow Kortix publishes holds the send for a person. [The comparison hub](/) sets that flow beside the managed SDRs.

### Can you self host an AI agent?

Yes. Kortix runs on Kortix Cloud, in your VPC, or on your own on-prem network, and self-host is free, so the gate and the repo stay on your infrastructure.

## Put a person on the send, then read what the agent did.

Start with new-lead follow-up and one tool rule on the send step.

[Try Kortix](https://kortix.com) · [Read the CRM write-back page](https://aisalesagentsguide.com/ai-sales-agent-crm-write-back)