# Lead Routing Proposer: An AI Agent That Suggests Lead Owners

The Lead Routing Proposer is an AI lead routing agent that suggests an owner for each new lead, using written territory and capacity rules alongside a customer data platform (CDP) or CRM. Revenue-operations teams use it at propose level (L2). It never contacts a lead, never uses protected attributes and never ranks named sales staff by behaviour or traits.

On [AI agent rails](https://privycdp.org/ai/rails) this job stays narrow, because routing touches both prospects and the people who sell to them. Rule-based routing keeps running underneath it.

## Rail at a glance

The Lead Routing Proposer reads rules and suggests how they apply, and its approved field list decides what it can consider at all.

| Field | Value |
|---|---|
| Job | Propose routing for new leads with reasons, using territory and capacity rules. |
| Trigger | A new lead, or a routing exception. |
| Data scope | Lead firmographic fields, territory rules and team capacity. No protected attributes. |
| Tool scope | Read: lead fields, territory rules, capacity. Propose: a routing proposal with a reason. Execute: none. |
| Output contract | Proposed owner, rule applied, reason, and any exceptions. |
| Gate | The revenue-operations lead accepts exceptions. Rule changes go through change control. |
| Limits | No outbound tools, and approved fields only. |
| Ledger | Lead reference, proposal, rule, decision. |
| Evaluation | Labelled historic routing, plus bias checks across regions. |
| Owner and kill switch | The head of revenue operations is accountable. Disabling proposals leaves rule-based routing running. |

## What it does and who uses it

The Lead Routing Proposer earns its place on awkward leads, where a territory rule gives one answer and another record suggests a different one.

In this illustrative case, the German subsidiary of a US manufacturer fills in a demo form.

| Field | Proposal |
|---|---|
| Lead | L-20417 |
| Proposed owner | DACH mid-market team |
| Rule applied | TERR-14: country and employee band |
| Reason | Germany, 800 employees; team is under its agreed open-lead cap |
| Exception | Parent company is on another team's named-account list |

The revenue-operations lead reads the exception, sends the lead to the enterprise team that holds the parent account, and logs the decision. When the pattern appears a second time, she raises a rule change, because a repeating exception is a missing rule.

## Why this level

The Lead Routing Proposer stays at L2 because routing looks reversible but stops being so once someone has emailed the lead. Before first contact, moving a lead takes a click. After it, the prospect may hear from two teams.

A rule error can also spread fast, so the rule engine holds the rules and the model only reads them. Salesforce's help pages give a small example: an extra comma in a rule entry can make it match any record with a value in that field, so later rules are ignored [3](#source-3). Two routers cause similar trouble. One HubSpot partner reports Salesforce assignment rules overwriting an owner set in HubSpot, then syncing the change back [4](#source-4). Pick one system of record for assignment.

Rule of Two thinking applies to the lead itself [2](#source-2). Web forms let anyone write into lead fields, and the [ForcedLeak research](https://privycdp.org/ai/7-things-ai-agents-should-never-do-with-customer-data) used a Web-to-Lead description to carry hidden instructions. So the approved field list excludes free text, and the session has no outbound tool.

The AI Act is the other reason for caution. Annex III point 4(b) covers AI used "to allocate tasks based on individual behaviour or personal traits or characteristics", and AI used to monitor and evaluate workers [1](#source-1). Those obligations are on the [deadline tracker](https://privycdp.org/regulation/deadline-tracker-2026-2027) for 2 December 2027. Territory and team capacity rules are chosen to stay clear of that wording, while routing by a named seller's win rate or reply speed moves towards it. Take advice before any performance data reaches this rail.

Nothing here argues for promotion above [L2](https://privycdp.org/ai/rails/rail-levels-autonomy-ladder), because a proposal class that is nearly always accepted should become a rule.

## Three ways it fails, and the control for each

Lead routing agents usually go wrong through data that should not be there, so these Lead Routing Proposer controls sit in the data view and a rule validator.

| Failure | What it looks like | Control |
|---|---|---|
| Performance data enters through capacity | Someone adds win rate or reply speed to the capacity table to "send leads to the best closers". Allocation now depends on how named staff behave. | The data view allows only team, open-lead count and agreed cap. Schema changes go through change control, and a test fails if a person-level metric appears. |
| Proxies for protected attributes | Names, titles, photos or free-text notes let the model infer gender, ethnicity or age, even though no protected field exists. | The approved field list holds company, country, size band and industry. Test leads with swapped names and contact language must get an identical proposal. |
| A confident reason for the wrong rule | The proposal cites a territory rule that does not cover this lead, and the reason reads well. | A deterministic validator reruns the cited rule on the lead's fields. A mismatch turns the proposal into an exception for a person. |

## How to evaluate it

Evaluate the Lead Routing Proposer against the rules in force at the time, because past routing contains old exceptions and workarounds.

- **Labelled historic routing.** Have revenue operations mark which past assignments followed the rule of the day, and use only those as the answer key.
- **Bias checks across regions.** Compare acceptance and exception rates for similar firmographics across regions and lead sources. A gap is a prompt to inspect the rules and data, not proof on its own.
- **Share of proposals accepted,** by rule and region. If acceptance is close to total, the rules may be enough, so consider dropping the model.
- **Time to first owner,** by team and region.

Report by rule, region and team, and let no output rank a named seller. Keep team-level capacity as the default, and check any per-person variant with your advisers.

## Where it runs

Prefer a private model for the Lead Routing Proposer, and use an external one only with masking and contract cover. With names and free text removed, the remaining firmographics carry less risk, but territory plans and named-account lists are commercially sensitive. The [boundary architecture patterns](https://privycdp.org/ai/ai-agents-on-customer-data-inside-your-boundary) help you place the model. PrivyCDP provides an MCP-ready interface and supports bring-your-own-model in the customer environment.

## Related

- [AI agents for sales and revenue operations](https://privycdp.org/ai/rails/functions/sales-revenue-operations): the playbook, and the closest thing this job has to a worked use case.
- [Rail card template](https://privycdp.org/tools/agent-rail-card): the place to record your approved field list.


More on the method is in the [AI agent rails hub](https://privycdp.org/ai/rails). Download the [rail card template](https://privycdp.org/tools/agent-rail-card) and agree the field list.

Rail level: L2 · Risk: medium · Function: sales revenue operations

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### Can an AI agent route leads automatically?

Here it proposes and does not assign. Deterministic rules do the routing. If you only need territory and round-robin logic, your CRM's assignment rules are enough, and no model is needed.

### Is AI lead routing high-risk under the EU AI Act?

That depends on how it works. Annex III point 4(b) lists allocating tasks based on individual behaviour or traits [1](#source-1). A territory and team capacity design is meant to stay clear of that, but take advice, because this page gives no legal conclusion.

### Can the agent send leads to the best-performing rep?

No. Routing by a named person's performance means ranking staff by behaviour, which the rail forbids. If your business wants this, it needs HR and legal review before any data is connected.

## Sources

1. EU AI Act, Annex III, employment and workers management: https://artificialintelligenceact.eu/annex/3/
2. Meta, untrusted inputs in agent sessions (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
3. Salesforce Help, assignment rules sending leads to the wrong user: https://help.salesforce.com/s/articleView?id=000385136&language=en_US&type=1
4. Resonate, lead routing in HubSpot (updated 27 April 2026): https://www.resonatehq.com/blog/lead-routing-in-hubspot

This article is general information, not legal advice.

## Further reading

- [AI Agents for Sales and Revenue Operations: The Playbook on Rails](https://privycdp.org/ai/rails/functions/sales-revenue-operations)
- [Account Signal Digest: An AI Agent That Summarises Account Activity](https://privycdp.org/ai/rails/agents/account-signal-digest)
- [CRM Hygiene Fixer: An AI Agent for Approved CRM Clean-Up](https://privycdp.org/ai/rails/agents/crm-hygiene-fixer)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)