Build account research agents that sellers can trust

Choose one initial use case, such as discovery preparation for existing named accounts with an upcoming meeting. Require account_id, requesting_user_id, current_owner_id, and research_question before retrieval. Reject an account outside the requester's permitted book. If ownership changed after the request, stop delivery and ask the new owner to accept the request through the internal review queue. Research access must not become an informal account transfer mechanism.

Set the minimum useful output before choosing a model. For discovery preparation, require a company change supported by evidence, a connection to the existing opportunity, and a question the AE can ask. An account with no qualifying change gets a concise no-new-evidence result. Do not replace missing research with generic industry predictions. For research into a new region, use new-market-entry to decide the expansion hypothesis before assigning dossiers to existing owners.

Create dossier_id, revision, account_id, owner_id_at_request, owner_id_at_delivery, research_question, requested_at, generated_at, review_state, reviewer_id, and reviewed_at. Each evidence row needs evidence_id, canonical_url, publisher, source_title, entity_account_id, exact_excerpt, published_at, retrieved_at, content_hash, access_class, and expires_at. Use null for an unknown publication date. A retrieval timestamp does not prove that the underlying announcement is recent.

Each claim needs claim_id, statement, claim_kind, supporting_evidence_ids, contradictory_evidence_ids, freshness_state, and reviewer_decision. Allow claim_kind values fact, hypothesis, and unknown. A hypothesis also needs reasoning and a question_to_validate. Store suggested_action separately from accepted_action. In PostgreSQL, primary keys identify records, unique constraints protect combinations of values, and NOT NULL constraints reject missing required values. Apply those mechanisms to dossier revision keys and mandatory evidence metadata rather than relying on prose instructions.[4]

Give the agent a narrow account lookup function instead of a generic CRM client. The application supplies the permitted account ID and field list. The agent cannot alter either through a page instruction. In HubSpot, the companies API documents crm.objects.companies.read and crm.objects.companies.write as separate scopes. Company retrieval supports selected properties and property history. Batch company reads cannot retrieve associations, so plan a separate association lookup if that context is required. Do not grant write scope merely because a connector setup wizard offers it.[1]

Acceptance means the credential inventory has no company-write permission and the retrieval adapter exposes no create, update, delete, or message function. Keep contract values, private correspondence, and unrelated account records out of public-web requests. Pass a verified company domain and the public research question to the web retriever, not the complete opportunity history. A seller sees which internal fields informed the dossier without those fields leaving their approved processing boundary.

Treat every retrieved page and document as untrusted data, including pages on a familiar company domain. OpenAI describes prompt injection as malicious instructions in untrusted text that attempt to redirect model behavior, including private-data exfiltration through tools. Its guidance recommends keeping untrusted variables out of developer messages and using structured outputs between workflow nodes. Store the excerpt as evidence data. Never append the page body to the agent's privileged instructions or let it define a new connector destination.[3]

Use a retrieval worker with no CRM context to extract bounded evidence fields. The dossier worker receives those fields and a minimized account summary. Reject instructions such as upload the full account record, ignore previous rules, or call this verification endpoint. Domain checks, content limits, and explicit tool argument validation remain application controls. The acceptance case is a hostile careers page that demands a private note export. The dossier must omit that instruction, record the rejection reason internally, and complete with safe evidence or a partial result.

Do not assume one guardrail covers the entire workflow. The Agents SDK documents input guardrails on the first agent, output guardrails on the final agent, and tool guardrails for guarded function-tool calls. Hosted tools do not use that function-tool guardrail pipeline. Parallel input guardrails may allow tool execution before cancellation, while blocking mode completes the check before the agent starts. Place explicit validation at each retrieval boundary and use blocking checks where a forbidden call must never start.[2]

Match evidence to the buying entity rather than the first company name in a search result. Use the verified domain, legal entity, subsidiary relationship, and source context. In a hypothetical case, a parent group's announcement about a plant in Spain does not establish that its separately owned Canadian subsidiary is expanding its operations. Attach the announcement to the parent and mark its relevance to the subsidiary as a hypothesis. If the entity relationship is unresolved, exclude the announcement from the fact summary.

Give each evidence class an editorial freshness rule that the AE manager approves. For example, refresh a current leadership claim before a scheduled meeting and retain an older annual report as historical evidence with its reporting period visible. These are team policy choices, not universal time limits. On refresh, compare the source content and preserve the previous excerpt. Acceptance means the AE can see both the announcement date and retrieval date, and an expired claim cannot appear as a current fact without renewed evidence.

Write one checkable statement per fact. A source saying the company opened a regional support center supports the opening, not a conclusion that the company needs your product. Put the latter in the hypothesis section with the missing premise visible. A hypothetical dossier could say that distributed support may create reporting friction, then ask who reconciles regional queues today. Do not label this as verified pain, a budget signal, or an active buying project.

Require evidence IDs for every fact and reject a claim whose excerpt does not entail the statement. Keep contradictions visible instead of selecting the source that creates the strongest sales angle. If a company page and a dated filing disagree about operating locations, report the disagreement and ask the AE to verify it. Acceptance means the seller can inspect an evidence excerpt beside the exact fact, and every hypothesis contains an explicit validation question rather than a confidence number presented as authority.

Show the AE a compact cover panel with the account, current owner, research question, dossier revision, and freshness warning. Under that panel, show the supported facts, the hypotheses, the missing information, and one suggested meeting action. Let the AE accept a fact, correct its wording, reject its relevance, or flag the entity match. Store the original draft and the accepted text separately so the next reviewer can see what changed and why.

The seller-visible result should be something the AE can use immediately, such as an accepted discovery question attached to a meeting preparation view. Default to preview and copy, not automatic CRM publication. If you add a publication tool, keep it outside research credentials and require approval for its exact input. n8n documents tool-level human review that pauses execution and shows the tool and parameters for approval or denial. Approval of one dossier revision must not authorize a later regenerated revision.[5]

Name failure states that sellers can understand. Wrong entity means the evidence belongs to another organization. Stale fact means the source no longer meets the team's freshness rule. Unsupported hypothesis means the agent skipped a premise. Restricted context means a requested internal field cannot enter this workflow. Partial retrieval means at least one planned source failed. None of these states should become a polished but unsupported summary. Keep a usable supported subset and state what is missing.

Keep ownership conflicts separate from research quality. If the requesting AE and current account owner differ, withhold the seller action and route the ownership question through revenue-team-handoffs. Do not resolve it by sending the dossier to both sellers. A rejected injection should not appear in customer-facing text. A deleted source should retain its recorded excerpt only under the team's retention policy, and the dossier must disclose that the original link no longer resolves rather than implying live confirmation.

Report fact support rate as reviewed factual claims whose cited excerpts support their full wording divided by all reviewed factual claims. Report fresh-evidence coverage as accepted current claims within their evidence-class freshness policy divided by all accepted current claims. Report entity error rate as reviewed dossiers with at least one wrong-entity claim divided by all reviewed dossiers. Show each ratio as a percentage with its raw numerator, denominator, review period, and sampling method. Exclude hypotheses from the factual-claim denominator.

Measure seller use as accepted dossiers with a seller-recorded next action divided by accepted dossiers delivered to an active owner during the same cohort. Measure preparation time in minutes per reviewed meeting-preparation request, including source checking and corrections. Compare like meeting types rather than claiming agent generation time equals AE time saved. Track rejected and partial dossiers alongside accepted ones. A high acceptance rate has little meaning if reviewers never open evidence or if difficult accounts disappear from the cohort.

Pilot one manager's existing book with the manager responsible for review quality and a GTM engineer responsible for retrieval boundaries. Keep the initial queue small enough that reviewers can inspect every factual claim. Include deliberate negative cases for a subsidiary announcement, an old leadership page, an ownership change, a malicious page instruction, and a source outage. Promote a broader cohort only after the team agrees which rejected cases now produce clear seller-visible outcomes.

The security owner can disable retrieval credentials without deleting reviewed dossiers. The AE manager can withdraw a defective revision and return sellers to their previous preparation process. Mark withdrawn dossiers in the seller view and remove their suggested actions from the active queue. Preserve review history for diagnosis under the retention policy. Resume only after the accountable owner identifies the failed boundary and approves the repaired behavior. Keep territory changes outside this rollout even when research uncovers a regional expansion opportunity.