How the engine writes — a worked example for Tech Legion

What is real here and what is not

Real: the writing rules, word ceilings, banned-phrase lists, fabrication policy, signal types, signature structure, and the audit-and-regenerate step are all lifted from the live system. Nothing in the process section is aspirational.

Composite: the prospect company, its people, and its signal values are illustrative. Wasatch Peak Construction is not a real company. Every signal shown is a type the system actually collects, populated with plausible values so the sequence has something to be built from.

Not sent: these emails were generated for this document. Nothing has gone to anyone.

The sender profile, loaded once

Before any prospect is researched, the system holds a profile of you. It is loaded into every email the engine writes, and it is the only source of permitted claims about Tech Legion. If a fact is not in this profile, the writer is forbidden from asserting it.

Below is what we could assemble from your public material. The rows marked confirm are the ones we would sit down and get right with you before a single send.

identity

Tech Legion. Outsourced IT, cybersecurity, cloud, and fractional-CTO services for the Intermountain West. Fifteen-plus years operating.

confirmed
techlegion.com

positioning

"Friendly Technologists" with "CTO Level Consultancy." Nine verticals served, construction among them.

confirmed
site, verbatim

problem you solve

Companies that have outgrown ad-hoc IT: the one-person side job, the break-fix vendor, the unanswered 6am call. Your site says it in services; we would sharpen it into one sentence a president recognises.

confirm
onboarding

proof inventory

99% customer retention across 15 years. 100+ companies served. No long-term contracts. 99.9% service-level guarantee. These four are the entire universe of claims the writer may make about you.

confirmed
site claims — we verify wording with you

the offer

The specific low-friction thing a first reply gets them. A one-hour DMARC fix note, a network health check, an insurance-questionnaire answer sheet.

confirm
your call, not ours

voice profile

Preferred phrasings, banned phrasings, and two or three real samples of how your team writes. "Friendly Technologists" is a voice, and the writer is anchored to it — rhythm and word choice, never facts.

confirm
from your existing emails

guardrails

Claims we may never make and topics we may never raise. For an IT provider the big one is the verified-only rule on security claims, shown in section 06.

confirm
compliance review

security posture

On, soft mode. This is the switch that stays off for most brands, and on for you. The engine verifies every prospect's email-authentication records against public DNS, and because an IT provider can actually fix what it finds, a real finding becomes your opener. Soft mode frames it as a helpful heads-up, not a scare.

on (soft)
per-brand setting

One prospect, and everything we would know about them

The engine does not write to a list. It writes to a dossier. Below is what a fully researched construction prospect looks like at the moment the writer is handed the pen.

Each row carries its source and its age, because a claim without provenance is a claim the writer is not allowed to use. Everything below is a signal type the system collects today.

The company

S-1 firmographics

Wasatch Peak Construction — commercial general contractor. Ogden, Utah. Roughly 65 employees. Founded 1996.

live
Apollo · 8d old

S-2 open roles

Two "Project Manager" reqs and one "Estimator" req open. Growth hiring — every seat is another laptop, another field tablet, another account.

live
job postings · 4d old

S-3 mail platform

MX records point at Microsoft 365. Tells you the stack before anyone picks up a phone.

live
MX probe · 3d old

S-4 email auth

No enforced DMARC policy. Verified against public DNS, twice. Because your security switch is on, this becomes the strongest email in the sequence. The rule that comes with it: this reading is the only security fact the writer may state about them.

live
DNS probe · 3d old

S-5 site hygiene

Website copyright still says 2023. Small on its own; alongside S-6 it rounds out a picture of nobody owning the digital side.

live
homepage probe · 3d old

S-6 incumbent read

No MSP tooling detected in their stack. Reads as self-managed IT, or a one-person side job. inferred — and because it is inferred, the writer may imply it only as a question, never state it as fact.

live
tech probe · inference-labelled

The person

S-8 contact

Marcus Bell, President. Owner-operator profile. Based in Ogden.

live
Apollo · verified email

deliverability

Address verified before a single word is written. Catch-all and risky addresses are held back rather than burned on a send.

live
bulk verification

why this company

In-vertical GC inside the size band, growth hiring under way, a verified security gap, and no detectable IT provider. Four independent signals pointing the same direction.

live
discovery evaluator

why this person

At 65 employees the president signs the IT decision personally. There is no CIO to route around.

live
discovery evaluator

fit score

94 / 100 against your ICP. Below the floor and the company never reaches a writer at all.

live
scored pre-spend

The part that matters

Everything above is gathered before the decision to write. Companies that fail the fit gate are dropped without ever costing a research call or a send. The intelligence comes first, and the outreach is what is left over once the intelligence has done its filtering.

Turning a dossier into four different conversations

A sequence fails when four emails say the same thing four times. So each step is assigned its own angle, drawn from a different signal, with a defined job in the arc. No step is allowed to reuse a previous step's hook.

Step	Day	Job in the arc	Angle	Built from
1	1	Observation, then a challenge. No pitch.	Three new hires landing on IT that looks like a side job.	S-2, S-6
2	4	The verified finding, soft framing.	The DMARC gap, translated into the one fraud pattern every GC knows: spoofed invoices and wire instructions.	S-4, S-1
3	9	Fresh thread. A different pain entirely.	The cyber-insurance renewal questionnaire, and who answers it.	S-1
4	16	Honest exit. Nothing about us at all.	Acknowledge the busy season they are hiring into, and step back.	S-2

The rules the writer runs under for a company president

Tone and length are calibrated to the recipient. An owner-operator president gets the C-level calibration, which is the shortest leash in the system.

Length ceiling. Steps 1 and 2 stay under 90 words. Steps 3 and 4 under 65. When a research signal and the word ceiling conflict, the ceiling wins and the signal gets cut.
Peer voice, business-impact first. One specific observation, why it matters to them, one direct question. Soft closers like "Worth exploring?" and "Want me to walk you through it?" are on the banned list for this tier.
Verified security facts only. The DMARC reading is the only security claim permitted anywhere in the sequence. No "you're probably also missing MFA," no endpoint guesses, no inferred controls. Section 06 shows the auditor enforcing exactly this.
Collective voice only. "We" and "our", never "I built" or "I noticed". The email is from a company, not a persona.
One ask. A single closing question, answerable in one line from a truck. No calendar links in the body, no thirty-minute requests.
Plain text only. No bold, no bullets, no images, no em dashes. Em dashes in particular are the clearest tell that a machine wrote it.
No invented anything. No made-up case studies, percentages, client counts, or pricing. If a claim is not in your proof inventory or this prospect's dossier, it does not get written.

The sequence

Four emails to one person. Every claim carries a marker back to the signal that produced it. Nothing in these emails exists that the dossier did not supply.

Step 1 · Day 1Observation

IT at Wasatch Peak

To: Marcus Bell, President, Wasatch Peak Construction

You're hiring two project managers and an estimator right now.S-2 From the outside, IT at Wasatch Peak looks like somebody's side job.S-6 More laptops, more field tablets, same side job.

That holds until the week it doesn't, and it's usually a bid week.

Who picks up the phone today when something breaks at 6am?

Best,

[sending rep]

Tech Legion

[phone]|techlegion.com|LinkedIn|Book a call

S-2The three open reqs, stated specifically. Growth is the hook because growth is what breaks side-job IT.

S-6The self-managed read is inferred, so it is phrased as "looks like from the outside" and landed as a question — never asserted as fact.

56 words subject 18 chars mentions of us 0 asks 1 links in body 0

Why it opens there. Step 1 is not allowed to say anything about Tech Legion. No retention rate, no fifteen years, no service list. A president reads fifty-six words in one glance, and the only job of those words is to make him picture the 6am call. The pitch is held to step 2, capped at a single clause even there.

Step 2 · Day 4Verified finding

your email domain

To: Marcus Bell, President, Wasatch Peak Construction

Quick, specific one.

Your domain has no enforced DMARC policy.S-4 In plain terms, anyone can send email that looks like it comes from a wasatchpeak address. For a GC moving sub invoices and wire instructions over email, that's the exact gap invoice-fraud crews probe for.S-1

It's about an hour to fix. Want us to send over exactly what to change?

Best,

[sending rep]

Tech Legion

[phone]|techlegion.com|LinkedIn|Book a call

S-4The verified finding, in soft mode: a heads-up with a fix attached, not a scare. This email exists only because the DNS reading was unambiguous — a borderline reading falls back to a research angle instead, because a wrong finding is worse than none.

S-1The vertical translation. DMARC means nothing to most presidents; a spoofed wire instruction means everything to a GC.

63 words subject 17 chars verified findings 1 inferred claims 0 asks 1

This is the email the security switch buys you. It offers the fix in the email itself, before any meeting. Giving the answer away is the point: a president who gets a real finding and a real fix from a company he has never heard of remembers who sent it.

Step 3 · Day 9New thread

renewal questionnaire

To: Marcus Bell, President, Wasatch Peak Construction

Different one.

Cyber-insurance questionnaires for contractors keep getting longer: MFA, backups, who watches the network overnight. Filling one out from a standing start eats a week you don't have mid-season, and the answers set your premium.

Has this year's renewal packet landed on your desk yet?

Best,

[sending rep]

Tech Legion

[phone]|techlegion.com|LinkedIn|Book a call

No named regulation, no invented statistic, no claimed knowledge of their policy. Industry-level framing is the doctrine-safe lane when the dossier holds no signal for this angle, and the question lets him tell us where he is in the cycle.

48 words subject 21 chars asks 1 closing type binary

Step 4 · Day 16Exit

Marcus

To: Marcus Bell, President, Wasatch Peak Construction

No reply needed.

Two PMs and an estimator coming aboard is a good problem to have, and the season won't leave room for much else.S-2

Door's open if the IT question resurfaces.

Best,

[sending rep]

Tech Legion

[phone]|techlegion.com|LinkedIn|Book a call

S-2The only content permitted in a step 4 is something about them. Not one word about Tech Legion, the retention rate, or the fifteen years.

34 words subject first name mentions of us 0 asks 0

Why step 4 gives up. The breakup email is the highest-replying step in most sequences, and the reason is that it is the only one asking for nothing. The moment it slips a pitch back in, it stops working. So the rules ban it outright: no company mention, no differentiators, no "closing the loop" subject line, no last-chance framing. It reads the room and leaves.

The signature, and why it looks like that

The writer never composes a sign-off. It is banned from the body entirely, and any closing it tries to sneak in gets stripped. The signature is applied afterwards, identically, to every step of the sequence.

That separation matters for two reasons. The body stays purely about the prospect, and the signature stays consistent no matter which mailbox sends it or which rep's name appears.

Applied to all 4 steps

Best,

[sending rep]

Tech Legion

[phone]|techlegion.com|LinkedIn|Book a call

[your lead magnet, one line]

rep name

Resolved per mailbox at send. The same sequence sent from three reps carries three names and one voice.

variable

no images

No logo, no banner, no social icons. Image-heavy signatures are a spam signal on cold mail and they are the first thing a filter weighs.

deliverability

one bold link

Only "Book a call" carries emphasis. Everything else stays quiet so there is exactly one thing to click.

design

calendar lives here

Never in the body. A calendar link in a first-touch body reads as a pitch and depresses replies. In the signature it is available without being asked for.

doctrine

lead magnet slot

One line, one link, changed per campaign. For Tech Legion this is where a free domain-security check or an insurance-questionnaire answer sheet would sit.

confirm

What gets caught before it ships

Every sequence is audited after it is written and before it can be sent. This is the part that is hard to see from the outside, so here is a real failure mode: a first-pass step 2 that did not survive. For an IT provider, this section is the one to read twice — the verified-only rule is what keeps a security-led opener honest.

Step 2 · first passBlocked

Quick, specific one.

Your domain has no DMARC record, and companies your size without managed IT are usually also missing MFA and endpoint protection across the fleet.

We helped a 60-person GC in Provo cut support tickets 40% and pass their cyber renewal on the first try.

Want me to walk you through what that looks like?

Best,

[sending rep]

Tech Legion

[phone]|techlegion.com|LinkedIn|Book a call

security_claim_beyond_verified The DMARC reading is the only verified security fact in the dossier. "Usually also missing MFA and endpoint protection" is an inference dressed as a finding, and the hard rule bans it in every email of the sequence: no MFA claims, no endpoint claims, no guessed controls, however hedged. One wrong guess and the real finding loses its credibility too.

fabricated_case_study No 60-person GC in Provo exists in the proof inventory. The writer invented a client because the paragraph wanted proof. This is the single most common failure in AI-written outreach and it is a hard block.

fabricated_stat "40%" appears nowhere in the approved claims. The retention rate and SLA are approved; ticket-reduction numbers are not.

banned_cta + first_person "Want me to walk you through" fails twice: consultative softening is banned for C-level recipients, and "me" breaks the collective-voice rule.

What happens next. The auditor flags the offending step only, and only that step is rewritten. Steps 1, 3, and 4 were clean, so they are preserved untouched rather than regenerated, which keeps the narrative thread intact. The rewrite is handed back with the specific violations attached, then audited again. If a step cannot be written cleanly, the lead is pulled from the campaign rather than sent something weak.

That last point is the one worth holding onto. The system is built to not send when it cannot send something true.

Where these four emails sit in the bigger picture

It takes roughly seven touches to convert. Email is the engine's highest-volume channel, not its only one. The same dossier that produced the sequence above feeds every other touch, which is why they sound like one company rather than four disconnected efforts.

This document Researched email

Four steps over sixteen days, written per person from the dossier.

Same dossier LinkedIn

Connection and message on the highest-scoring prospects only, timed against the email cadence.

Same dossier Call sheet

Phone days come pre-briefed with the same signals, so a rep opens with the hiring surge rather than a script.

Same dossier On-site route

Doors clustered along the Wasatch Front for the days when someone is driving between Ogden and Provo anyway.

Ambient Social

Keeps the name familiar before the first email lands.

Ambient Lead magnets

The signature link, built per vertical, that gives a not-yet-ready prospect a reason to raise a hand.

Inbound Managed inbox

Replies land with the full dossier attached, so whoever answers already knows why the email was sent.

What we would need from you to make this real

The sequence above was built from your public website in an afternoon. A live campaign runs on better inputs than that, and all of them come from you.

The offer. What a first reply actually gets someone. This is the single highest-leverage input and it is the one we cannot guess.
The proof inventory. The retention rate, the SLA, and any named client outcomes you are willing to stand behind. Every claim you give us is one the writer is permitted to make. Everything you withhold, it writes around.
The guardrails. Claims your delivery side will not allow, and how hard the security findings are allowed to lean — soft mode and direct mode read very differently.
Voice samples. Two or three emails your team has actually sent and been happy with. "Friendly Technologists" should survive automation.
The ICP. Seat count, geography, verticals, and the titles worth writing to. The tighter this is, the less of your budget goes to companies that were never going to buy.
The niche sources. What tells us an Intermountain West business is outgrowing its IT: permit filings, license activity, hiring bursts, lease announcements. You know these better than we do. We build them into the engine.

That last one is where the leverage sits. Anyone can send email. The reason a sequence like the one above works is that the company receiving it was hiring three people onto self-managed IT with a verifiable security gap, and we knew all three before we wrote a word.