# Writing AI Outreach Emails That Don't Sound Like AI (Benjamin) > [!question] Lingering Questions > - What specific words are on the full "ban list" beyond the four named in the talk (leverage, seamless, unlock, and "others")? > - What does "check the draft against the skill" mean mechanically — a second LLM critique call, a deterministic word-list scan, or both? > - How does the maker-checker workflow handle false positives — a banned word or pattern that's actually appropriate in context? > - How does this workflow scale beyond one person's approval bottleneck as an agency grows? > - Is there evidence this approach increases reply rates, or does it only reduce a human evaluator's perception of "AI-ness"? > [!tip] Article Ideas > - A WordPress Abilities API security checklist for agencies deploying AI outreach agents, built from Benjamin's four pre-flight checks (who's connected, what permission, which user, what can it see). > - A short piece translating "a prompt is a note on your fridge, a skill is a system" into a general PKM/ops principle for any durable-instruction use case, not just outreach email. > [!link] Cross Reference > - [[3. Resources/Permanent Notes/Spec-Driven Development Turns Throwaway Prompts Into Durable System Memory]] — same underlying mechanism in a different domain: a prompt is intent that evaporates per-conversation, a persisted artifact (spec, or here, "skill") is intent that compounds across sessions and tools. > - [[3. Resources/Permanent Notes/Delegated Credentials Must Attenuate Rather Than Escalate]] — same least-privilege principle applied to AI agent accounts: read-only, never admin, is the attenuation floor for any agent touching a real system. > - [[3. Resources/Permanent Notes/An Ops Agent Is Only as Capable as Its System Access]] — the capability-equals-access framing that underwrites why "read-only, own account" is the correct default for the Abilities API demo. > [!example] Fiction & Worldbuilding > None. > [!quote] Vocabulary > - **Skill** — a small, persistent folder of markdown files (voice examples, rules, ban list) loaded consistently by every AI tool, as opposed to a one-off prompt. > - **Abilities API** — WordPress 6.9's named, scoped functions that let an authenticated AI client read/act on a site's own back-end data (e.g., WooCommerce). > - **Ban list** — the specific words/phrases (e.g., "leverage," "seamless," "unlock") a skill instructs the model never to use. > - **Maker-checker** — a workflow where one pass drafts and a second pass checks the draft against rules before a human ever sees it. ## Bib capsule Benjamin (WordPress agency owner, Germany), "Writing AI Outreach Emails That Don't Sound Like AI," WordCamp US 2026 talk. https://www.youtube.com/watch?v=GTUi2p76Zwk — a practitioner talk on fixing AI-sounding outreach email by moving voice/tone into a persistent "skill" and grounding content in real, scoped data via WordPress's Abilities API, gated by mandatory human approval. ## Author's thesis **Q1 (what's the talk about):** Why AI-written outreach email sounds like AI, and what one WordPress agency owner does instead in his own daily practice. **Q2 (how does it develop that):** Benjamin splits "sounds like AI" into two independent problems — style (fixed by moving tone/rules into a persistent, multi-tool "skill" instead of a per-conversation prompt) and substance (fixed, as an explicit prototype, by letting an AI agent pull real, checkable facts from a site's own data via the WordPress Abilities API) — then subordinates both fixes to a non-negotiable human-approval gate before anything sends. ## Key arguments 1. A prompt is ephemeral per-conversation instruction; a skill is a persistent, reusable artifact loaded the same way across tools — voice/tone belongs in the latter, not the former. 2. Content lacking a verifiable fact should be deleted, not rewritten into nicer-sounding language — "improving" empty flattery just produces better-disguised emptiness. 3. Real personalization requires scoped, read-only, auditable data access (the Abilities API), not free-text guessing, and must stay strictly within a business's own systems, never a third party's. ### Voice belongs in a persistent skill not a prompt > [!quote] ID:rw_atom1 > A prompt forgets, a skill does not forget. Chapter 1's core reframe — the load-bearing distinction that everything else in the "sound" half of the talk builds on. ### The sound problem and substance problem need separate fixes > [!quote] ID:rw_atom2 > The problem is not that the AI writes badly, it writes like AI and this is nothing real. The talk's opening diagnostic move: one sentence-level symptom, two unrelated causes, each needing its own fix — the structural spine of the whole talk. ### Ungrounded content gets deleted not improved > [!quote] ID:rw_atom3 > words with no facts do not get better words, they get cut The check/rewrite rule demonstrated in the before/after email pair — a sharper editing principle than "make it sound nicer." ### The Abilities API lets an agent read a site's own data > [!quote] ID:rw_atom4 > Your AI reaches into your own WordPress back end. It reads real data from there and it use it that data can re write the email for your customer or for your sales. The Chapter 3 prototype's mechanism — WordPress 6.9's Abilities API plus the 7.0 client/adapter, explicitly labeled not-yet-production. ### AI agent accounts must be read-only never admin > [!quote] ID:rw_atom5 > a junior can read a lot and a junior can ask good questions but a junior can break nothing The security posture stated as the single thing to remember even if everything else is forgotten — least-privilege in plain, non-security-audience language. ## Permanent candidates - **rw_atom1** (skill vs. prompt persistence) — not promoted; the mechanism duplicates the existing [[3. Resources/Permanent Notes/Spec-Driven Development Turns Throwaway Prompts Into Durable System Memory]] (a different domain, same claim: durable artifact beats evaporating prompt). Cross-referenced instead. - **rw_atom3** (delete, don't polish ungrounded content) — **promoted**, see [[3. Resources/Permanent Notes/Ungrounded Content Gets Deleted Not Rewritten]]. - **rw_atom5** (read-only, never admin for AI agents) — not promoted; the least-privilege mechanism is already covered by [[3. Resources/Permanent Notes/Delegated Credentials Must Attenuate Rather Than Escalate]] and [[3. Resources/Permanent Notes/An Ops Agent Is Only as Capable as Its System Access]]. Cross-referenced instead. - A fifth candidate not tied to a single quote atom — "a style rule is only useful if a draft can be checked against it" (untestable "confident but warm" vs. checkable "begin with a fact") — **promoted**, see [[3. Resources/Permanent Notes/A Style Rule Only Works If a Draft Can Be Checked Against It]]. ## Processing checklist - [x] Checked for existing Literature Note — none found for this talk. - [x] Checked for existing Permanent Notes — found close-mechanism matches for 2 of 4 candidate atoms (see Permanent candidates above); promoted the 2 genuinely novel claims, connected the other 2 to existing notes. - [ ] Registered in MOC(s) — orchestrator to add to [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] (primary: prompt-vs-skill durability thread) and [[3. Resources/MOCs/AI Agent Safety MOC]] (secondary: least-privilege AI agent accounts / Abilities API security).