Outbound policy review checklist for approvers

An outbound policy is a short document that decides who gets contacted, how, and how often. The person who approves it is the last human check before messages go out. This guide gives that person a checklist: what to read, what to ask for, and what should send the policy back for edits.

Who this is for

This is for whoever puts their name on the approval: a founder, a head of sales, a RevOps lead or a marketing approver. You may not have written the policy, and you may not write the copy. Your job is to decide whether it is safe and accurate enough to run.

In Outlevo, several approvals sit with specific roles. An owner or marketing approver sets the daily and monthly caps before ad spend starts [[1]](#sources). An owner or admin approves the CRM field mapping before anything is written to HubSpot [[2]](#sources). An owner or admin connects Smartlead [[3]](#sources). Know which of these approvals are yours.

Why the policy is the control point

Nothing is sent outside a policy that a person approved [[4]](#sources). Policies set who can be contacted, on which channels, how often and with what budget [[4]](#sources). Every external action is checked against the approved policy before it runs, and recorded in a ledger [[4]](#sources).

That makes your review the gate. A vague line you approve today is applied to every action that follows. Review the policy as if you had to defend each message it allows.

Other tools offer an approval switch too. Reply.io's Jason AI page describes approving each message before it goes out, or letting it run on autopilot [[5]](#sources). Artisan describes an approval mode, or letting its agent send on its own [[6]](#sources). gojiberry.ai describes full auto, or approve before it sends [[7]](#sources). These descriptions were checked on 2026-10-22. A switch on individual messages is a different control from approving the rules that govern all messages. The comparison of autonomous and approval-first outbound goes into that difference.

Steps

Work through these eight checks in order. Each one has a question to ask, evidence to ask for, and a reason to send the policy back.

1. Target accounts

Question: Who exactly will be contacted, and why those accounts?

Ask to see the segment definition in plain words. Then ask to see a few sample accounts and the evidence behind them.

Readiness Cards. Each qualified account gets a Readiness Card with fit, intent and data quality scores [[8]](#sources). A card needs at least three observations, each with a source and a date [[8]](#sources). Open a few cards. If an account has no card, or the observations have no dates, the targeting is not ready.
Hypotheses. Guesses are labelled as hypotheses, never presented as findings [[8]](#sources). Check that the policy does not treat a hypothesis as a fact about the account.
Experimental segments. AI-proposed ICP segments are labelled experimental until a person approves them [[9]](#sources). If the segment in the policy still carries that label, your approval is what changes it. Be sure you mean to.
Sample size. Win/loss analysis counts companies, not deals, and fewer than 10 won companies is labelled very low confidence [[9]](#sources). If the segment rests on a handful of wins, say so in your approval note and keep the first run narrow.

Send back if: the segment cannot be described in a sentence, the sample accounts lack dated evidence, or the segment rests on very low confidence analysis with no note acknowledging it.

2. Countries and markets

Question: Did a person on your side choose the countries?

Outlevo asks which countries a customer sells into and never proposes markets [[9]](#sources). So the country list in the policy should be your team's own answer. Check it against what your team actually decided. Do not accept a list because it was already filled in. This guide will not tell you which markets to pick. That decision is yours.

Send back if: nobody on your side can say where the country list came from.

3. Exclusions

Question: Who must never be contacted, and is that written down?

Read the exclusions line by line. Check each of these:

Existing customers and open deals. If you connect a CRM, the policy should reflect what the CRM knows. Outlevo reads HubSpot companies, deals and owners [[2]](#sources), and Salesforce accounts, opportunities and users [[10]](#sources).
Opt-outs. HubSpot contacts, including the email opt-out, are imported only after an admin turns contact import on with a stated purpose [[2]](#sources). Check that someone turned it on, and read the stated purpose. Unsubscribes from sending arrive back as events [[3]](#sources). Ask where those events are recorded and how a person on the suppression list is kept out of later campaigns. The public API lists a suppressions resource [[11]](#sources).
Competitors, partners and press. The policy should name them, or say why it does not.
Individual replies. The Gmail extension's recipient guard warns before you email a contact Outlevo should not reach [[12]](#sources). Ask whether your reps use it, since it covers manual email as well.
Ad audiences. Google allows targeting only for accounts at least 90 days old with $50,000 lifetime spend; below that, the list can still keep those accounts out of your campaigns [[13]](#sources). Check which case applies to your ad account, and whether you want the list used to exclude.

Business email is not exempt from the rules. The FTC says of CAN-SPAM: "The law makes no exception for business-to-business email." [[14]](#sources) That quote was checked on 2026-10-22. Do not accept "it's B2B" as a reason to skip an exclusion.

Send back if: exclusions are described as "handled elsewhere" with no pointer to where, or opt-outs have no path back into the policy.

4. Claims and proof

Question: Can every factual statement in the messages be traced to something?

Read the claims, not the style. For each number, customer name, result or comparison in a draft, ask for the source. If there is no source, the claim comes out.

Some of this is enforced for ads. A test set holds up to 8 ads, every number in an ad comes from your own facts, and the landing page is on your domain [[1]](#sources). Apply the same rule to email and LinkedIn copy yourself, even where no tool enforces it.

For facts about the prospect, ask where they came from. Facts read from a website are kept only when their quote is found on the page [[8]](#sources). A line like "I saw you recently changed your pricing page" should map to a dated observation on that account's card.

Ads also have outside rules. Google's Misrepresentation policy "strives to ensure that ads are clear, honest, and provide information that users need to make informed decisions." [[15]](#sources) That quote was checked on 2026-10-22. Use it as a plain test for any ad copy: is it clear, honest, and does it give the reader what they need?

Send back if: any claim has no source, any customer reference cannot be verified by you, or a prospect-specific line has no observation behind it.

5. Tone

Question: Would you be comfortable if the recipient forwarded this to a colleague?

Tone is a judgment call, so write down what you accept. Read three sample messages out loud. Check these:

The message says who is writing and why this person, in the first lines.
It asks for one thing.
It does not pretend a prior relationship, urgency or personal knowledge that does not exist.
It does not imply a human wrote it by hand if that is not the case. Decide what your team's position is and make sure the copy matches it.
The follow-ups add something. A sequence of reminders with no new information is a reason to send it back.

Send back if: a draft would embarrass you if forwarded, or the follow-ups only repeat the first message.

6. Channels and sending setup

Question: Is each channel switched on deliberately, and is the setup ready?

Policies set channels [[4]](#sources), so approve each channel on its own.

Email. Before a Smartlead campaign sends, every mailbox must be connected and warmed up, and its domain must have SPF, DKIM and DMARC checked in the last 7 days [[3]](#sources). Ask to see that status. A new managed mailbox sends nothing until it is warm: at least 14 days, usually about 3 weeks [[16]](#sources). If the plan is to start sending this week from new mailboxes, expect a delay.

Two outside rules are worth knowing when you review sender setup. RFC 7208 says: "SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation" [[17]](#sources). In plain words, an SPF record may trigger at most 10 DNS lookups. RFC 7489 describes DMARC as a way a "mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting" [[18]](#sources). Both quotes were checked on 2026-10-22. You do not need to configure DNS yourself, but you should ask whoever does whether the records are checked.

LinkedIn. Outlevo sends a connection invitation with a note of at most 300 characters, then one message after the person accepts, within daily limits [[19]](#sources). A reply stops that lead's emails [[19]](#sources). Each person connects their own account and the messages go out as that person [[19]](#sources). LinkedIn's User Agreement lists as a don't: "Use bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages" [[20]](#sources). That was checked on 2026-10-22. Read it before you approve automatic LinkedIn sending. Whether the account holder accepts that risk is a decision for you and them, not a detail to wave through. Automatic sending comes with Growth and Managed, or with a LinkedIn seat on Builder. Otherwise the invitations and messages are drafted for you to send by hand [[19]](#sources).

Ads. Nothing spends until an owner or marketing approver sets the caps [[1]](#sources). Several ad integrations are listed as coming soon, built but waiting for platform access with no date promised: Meta Ads, LinkedIn ad campaigns and LinkedIn Ads audiences [[21]](#sources) [[22]](#sources) [[23]](#sources). For LinkedIn Ads audiences, the push is switched off and only the CSV export works today [[23]](#sources). Do not approve a policy that depends on a channel that is not live.

Send back if: a channel is on without a named owner, mailbox or domain checks are missing or older than 7 days, or the policy depends on a channel that is not yet available.

7. Volume caps and budget

Question: What is the most this policy can do in a day and in a month?

Policies set how often and with what budget [[4]](#sources). Make sure there is a stated limit for each channel, and that you wrote it or agreed with it. This guide gives no daily send number, because the right figure depends on your mailboxes, your list and your tolerance. What matters is that a number exists, that a person chose it, and that it can be lowered.

Know which limits are money and which are not. Sending, follow-ups and the mailboxes your plan includes use no credits [[3]](#sources). So a credit budget does not limit how many emails go out. Credits pay for research, qualification and some other actions, not for sending [[24]](#sources). Builder is USD 29 per month with 320 credits a month, and Growth is USD 149 per month with 1650 credits a month [[24]](#sources). Qualification costs 3 credits, contact discovery 4 credits and deep research 30 credits [[24]](#sources). Check the planned research against the plan's credits.

Plans also set how much sending capacity you have. Builder includes 1 domain and 2 mailboxes, and Growth 2 domains and 4 mailboxes [[16]](#sources).

One more outside number matters if you are scaling up. Microsoft says: "For domains sending over 5,000 emails per day, Outlook will soon require compliance with SPF, DKIM, DMARC." [[25]](#sources) That was checked on 2026-10-22. If your plan could ever get near that, the authentication check in step 6 stops being optional.

Send back if: there is no cap on a channel, the cap is "as needed", or nobody can say which limit is the real one.

8. Stop conditions and escalation

Question: What makes this stop, who finds out, and who takes over?

Kill switches pause a campaign, a channel or the whole workspace at once [[4]](#sources). For ads, a kill switch stops all ads at once [[1]](#sources). Confirm who is allowed to use them, and that they know.

Then write down the conditions that should trigger a pause. Examples of signals that arrive as events: Smartlead sends sent, reply, bounce, unsubscribe and category-change events to Outlevo by webhook [[3]](#sources). Decide what level of bounces or unsubscribes makes you stop and look. The policy should state it, even if the threshold is a judgment you revisit.

Replies need an owner. Hot leads go to the right rep when owners come from the CRM [[2]](#sources). For interested replies with a booking link, on autopilot the answer goes at once. Otherwise it waits in Replies for you to send [[26]](#sources). Pick one deliberately. Consider keeping replies manual for the first campaign.

Telegram carries alerts for hot leads, approvals, problems that need you and credit alerts [[27]](#sources). Every alert also appears in the app [[27]](#sources). Confirm each named person has linked their own Telegram [[27]](#sources), or that someone checks the app on a schedule.

Send back if: nobody is named to act on a pause, the policy has no stated trigger for stopping, or interested replies have no owner.

What to check

Use this as the page you keep open during review.

What a good approval looks like

You can state in one sentence who is contacted, on which channels, how often and within what budget.
You opened sample Readiness Cards and each one had dated, sourced observations.
Exclusions are listed and a path exists for new opt-outs.
Every factual claim in the copy traces to a fact you can verify.
Each channel is on deliberately, with a named owner and its setup checked.
Every channel has a cap, and a person set it.
The pause triggers, the people who can pause, and the reply owner are written down.
Your approval note records anything you accepted with open questions, such as a low confidence segment.

What should send the policy back

Area	Send back when
Accounts	No dated evidence, or the segment cannot be summed up in a sentence
Markets	Nobody on your side chose the country list
Exclusions	Customers, opt-outs or open deals are "handled elsewhere" with no pointer
Claims	A number, name or result has no source
Tone	A draft would embarrass you if forwarded
Channels	A channel has no owner, or setup is unchecked or depends on an unreleased integration
Volume	A channel has no cap, or the cap was not chosen by a person
Stop and escalate	No pause trigger, no named person, no reply owner

Write the return note

When you send a policy back, name the line and the change you want. "Tighten the targeting" gives the author nothing to act on. "Remove the second segment until it has three dated observations per account" does. Edits in this form are fast to check and hard to misread.

After approval

Approval is not the end of the review. Each action is recorded in a ledger [[4]](#sources), so you can read what actually ran against what you approved. Support access is also visible: staff support access is time-limited and shown in your activity feed, with the reason and the number of changes made [[28]](#sources). Set a date to look at the first results and the first stop events before the policy is widened.

If your team builds on the API, test keys run against a sandbox with fake companies and contacts, and are not charged [[29]](#sources). The sandbox has 100 fake companies, so you can build without sending anything or spending credits [[30]](#sources). Use it to rehearse a change before it touches real accounts.

Next step

Take the policy you are about to approve and run the eight checks against it with a pen. Anything you cannot answer in a sentence is a question for the author.

Read how approval works in Approve outbound policy before anything is sent.
If you are still defining who the policy should target, start with the free ICP assessment. It reads up to 5 public pages of a website and returns facts labelled as verified observations or AI inferences, and up to 5 experimental segment hypotheses [[31]](#sources).
If you sell developer tools, the outbound playbook for developer tools shows one way to apply this kind of policy.
Check what each action costs on the pricing page before you approve a budget.