How do you prevent hallucinations and off-brand messages?

Put a second process over the output, and never make that second process depend on an LLM. Test against rules as well as against a model. Most of what goes wrong repeats, and repeating problems are exactly what rules catch. For the remainder, the model flags it, raises an incident, and a human looks.

I am Eduard Klein. I advise CEOs, founders and boards on AI Business Strategy, and that rule is the one I would tattoo on the forearm of anybody starting an agent project. It sits under all 7 components in the full AI SDR blueprint, published 19 August 2026.

Why the second checker must not be a model

The fashionable answer in 2026 is LLM-as-judge. Put a Claude or a GPT in front of the Claude or GPT already doing the work. I tested that and I do not do it, and the reason is structural rather than aesthetic.

A judging model shares the failure modes of the model it judges. If the input can talk the worker into something, it can talk the judge into agreeing. Two models sharing a failure mode do not give you 2 checks. They give you 1 check. Then they give you a false sense of having 2.

Rules cannot be talked into anything. That is the entire reason to have them, and it is why I wrote rules over 2 weeks in 2026 instead of writing a second prompt. The model still has a job in the loop. It handles the residue that no rule anticipated, and when it is unsure it raises an incident rather than deciding.

The rule underneath the rule

If a task has a correct answer you already know in advance, do not use a model for it. Agents for judgement. Code for rules. That is the whole rule.

That single line explains most of my architecture across all 7 components. It is cheaper, it is faster, it is testable, and it will never invent a discount at 2 in the morning because an Out of Office reply looked like a negotiation.

Most hallucination in a sales system is not exotic. It is a model filling a gap that a lookup should have filled. Price, terms, what was quoted, what the prospect actually said in the thread. All 4 of those have a correct answer sitting in the CRM, and every time you route one through a model instead of a query you have chosen to gamble on something you could have known.

The component I deliberately did not automate

Follow-up in my system is not an agent. Not at all, and not a small one.

When somebody is genuinely interested, the agent drafts the offer straight from the CRM. The scope we discussed, their requirements, in their own words, quoted back from the thread where they said them. I review it, I set the number, I send it. That is Component 7 of 7, and I built it that way in 2026 because being wrong about a number is expensive and hard to detect.

The follow-up after that is plain automation. No reply after 4 days, send this. Nothing after 10, send that. Follow-up needs to be reliable and boring rather than creative. I built it that way in 2026 and I have never once wished it were smarter.

A definition of an AI SDR that lists what it automates is a marketing definition. What it deliberately does not automate tells you whether the person built one.

How do you ensure the AI maintains our brand voice and tone?

Let one agent write the substance, then a second agent rewrite it in your style. I tested both single-agent and two-agent versions in 2026, and the split is the most consistent approach by a distance.

Brand voice is the easiest problem in this whole system, which surprises people who expect it to be the hardest. Separating what to say from how to say it is what makes it easy. Ask 1 agent to do both and it trades one against the other under pressure. The thing it drops is always the voice.

There is a side effect I did not plan for. The rewriting agent drafts in the customer's language. I sell across several countries from Barcelona, so it writes the German version, I adjust the 2 sentences that sound like a translation, and it goes out in my name.

What still gets through

Agents write genuinely silly things. I do not mainly mean factual hallucinations.

They talk too much. They overwhelm the reader with information. They go off in directions no experienced person would take. Across 3 years I have watched all 3 of those happen more often than I have watched an invented fact, and no fact-checking rule catches any of them.

That is why I stay in every loop that touches a human being. An agent cannot assess the consequences of its own actions, whether it runs on Claude or on GPT. Only people can, in September 2026, and I do not expect that to change soon enough to plan around.

The correction is where the value sits. Every time I overrule the system, that correction is stored and fed back in as an example. It is not reinforcement learning in the academic sense, it is feedback that becomes context, and after 6 months of it in 2026 the system sits measurably closer to my judgement than it did in March.

How this pairs with the attack from outside

Hallucination is a failure from inside the system. Prompt injection is an attack from outside it. The defence has the same shape, and I built both in 2026.

In both cases a second process checks, and in both cases that second process does not depend on a model. For injection the check lives in the credential broker outside Component 5, the research sandbox. For hallucination it lives over the output before anything reaches Gmail. Same principle, 2 different places in the pipeline.

If you want somebody who has already built both to sit on your side of the design, that is what my AI coaching work is. The broader business question of whether ChatGPT and Google AI Overview can see your company when a buyer asks is a different piece: AI strategic visibility.

What I still cannot do

I cannot write a rule for tone. Not in 3 years of trying.

Everything with a known correct answer is now handled by code, and everything with a judgement in it still needs me. Between those 2 there is a band I have not managed to describe well enough to automate: the message that is factually correct, on-brand, and still the wrong thing to send this week. I catch those by reading them myself. I have tried for 3 years, since 2023, to write down what I am doing when I catch one, and I still cannot.

The other half of the same problem: whether someone can hijack your AI SDR from a web page and the tech stack I actually run.

About the author

Eduard Klein is an AI Business Strategist for CEOs, founders & boards, and he has trained thousands of sales people on exactly the problem this article gives to a second process: what to say, how to say it, and which correct-sounding message still loses the account. Years in key account management and inside sales, an SDR quota up to 3.5 million in revenue, software sales for SAP, for Microsoft, for Oracle and for the German Stock Exchange, and 170+ articles across 100+ publications including woodpecker.co and Comm100 sit behind the rules here (the full list).