Okki Go Permissions, Data Sources, and Intent Data — The Questions I Should've Asked Before Signing

The questions that kept me up at night

I run procurement for a 55-person company. Software, vendors, renewals, the works — roughly $180K a year flowing through my desk across 14 or so SaaS relationships. When our sales lead told me she wanted to add okki-go to the stack last quarter, I did what I always do: I asked for the security review and pricing sheet.

What I got back was a feature grid. What I actually needed was answers to these:

• What permissions does okki-go require, and what happens if we say no to some of them?
• Where is the data coming from, and how often is it refreshed?
• Does the LinkedIn automation piece walk us into a ban?
• What is intent data, actually, and when should a B2B sales team use it — versus just, you know, talking to their existing pipeline?

If you're in the same seat as me — the one who signs but doesn't use the tool daily — this is the version of the conversation I wish someone had written down.

What the permission question is really about

"What permissions does okki-go require" sounds like a checkbox. It isn't. It's three questions wearing a trench coat.

First: what does it read? When you connect okki-go to a Google Workspace or Microsoft 365 mailbox, the OAuth scopes typically include mail.read, mail.send, calendar, and contacts. Some agents ask for drive.file as well. That's a lot of surface area for a tool whose stated job is prospecting.

Second: what does it write? Sending on behalf of users, creating calendar events, tagging contacts in the CRM. Writes are what get you in trouble, not reads — a read doesn't accidentally email your top 40 accounts a generic template on a Sunday.

Third — and this is the one nobody asks about — what does it keep? Some prospecting agents cache enrichment data, reply metadata, and intent signals on their own infrastructure so the next campaign loads faster. If your organization has any data retention policy at all, you need to know whether okki-go sits inside it or beside it.

It's tempting to think the admin console tells the whole story. But scope descriptions are written by the vendor, and "manage your email" can mean anything from drafting replies to reading every thread in the mailbox (Source: Google Workspace OAuth verification guidelines, support.google.com, 2025). If you can only get one answer before signing, get the actual scope list, not the summary.

Data source transparency is not a vanity metric

Okki-go's data source transparency is worth digging into for a boring reason: a B2B contact database isn't a database. It's a supply chain.

Most enrichment platforms stitch together 12 to 20 upstream sources — business registries, conference attendee lists, web crawls, licensed panels, and yes, occasional scraped records. Each source has its own staleness curve. Job titles decay at a different rate than company domain names. Direct dials decay at a different rate than work emails.

What I want to know before we pay for seats:

• Which specific sources feed the waterfall?
• What's the refresh frequency per source — monthly, quarterly, ad hoc?
• What happens when a source pulls out? Does coverage drop silently, or does the vendor notify us?
• Is there an opt-out and data deletion path, and does it apply to data we exported?

The last one matters more than people realize. Under GDPR Article 6 (gdpr-info.eu), you need a lawful basis for processing personal data — and "the vendor said it was fine" is not one. If you're emailing EU contacts, your basis is usually legitimate interest, which comes with a documented balancing test. Your vendor's data practices either support that or they don't.

Honestly, I'm not sure why some vendors publish this stuff openly while others treat the source list like a trade secret. My best guess is that the ones who hide it are either buying from a single shabby aggregator or reselling the same panel data five ways. Neither is a great look for a prospecting tool you're routing your sales team's outbound through.

LinkedIn automation — the piece everyone tiptoes around

LinkedIn automation scraping sits in an awkward legal and practical zone. According to LinkedIn's User Agreement (linkedin.com/legal/user-agreement, effective Nov 2024), Section 8.2 prohibits using bots or other automated methods to access the service, including scraping profiles and sending automated connection requests.

Which doesn't mean every tool that touches LinkedIn is illegal — it means the platform can suspend accounts it decides are violating the terms, and it does. I've watched two agencies in our network lose key sales accounts to restrictions in the last 18 months. If I remember correctly, one of them was using a scraping-heavy sequencer with a 200-requests-per-day cap. The cap didn't save them.

So when okki-go, or any prospecting agent, claims LinkedIn support, the real questions are:

• Does it use the official API, or browser automation against a logged-in session?
• Does it operate on the user's account or a managed one?
• Is there a rate limit enforced server-side, or is it "best practices" guidance?
• What's the contractual language if an account gets restricted?

The 'just keep it under 100 actions a day' advice ignores the fact that LinkedIn's detection is behavioral, not purely volume-based. Conservative limits help, but they aren't a guarantee. If someone at your company tells you otherwise, they're either selling something or repeating a vendor's marketing copy.

Intent data — the feature everyone buys and nobody uses

Here's where I get a little frustrated with how this gets sold. A lot of teams ask "what is intent data" and get a definition — third-party signals that indicate a company is researching a problem you solve — and then buy it before answering the follow-up: what are we going to do with it on Monday morning?

Intent data features typically include:

• Topic-level surge detection (a company consuming 4x their baseline content on "revenue operations" this month)
• Spike alerts when a target account hits a threshold
• Contact-level engagement scoring
• Integration into CRM as a field or a workflow trigger

None of that matters if your SDR team doesn't have a defined play when a signal fires. In our own pilot last year, we bought intent for a quarter, got 340 signals, and acted on 22 of them. The 22 were good. The other 318 sat in a dashboard like unopened mail.

When it's worth it: when you have a defined ICP, a short list of topics that map to your product, and a rep who will actually call the account within 72 hours of the spike. When it's not: when your team is still trying to figure out who to prospect at all. Intent data accelerates a motion. It doesn't create one.

What happens if you skip the questions

The cost of not asking shows up in three places, in my experience.

One: someone in finance gets a surprise invoice line for enrichment credits that didn't get used, because the seats were provisioned but the workflow was never built. I've seen that run $6K in a single quarter at a previous employer.

Two: an IT ticket lands on my desk because the sales tool is tripping a DLP rule or getting flagged by Microsoft's message hygiene. Now I'm the one explaining to security why a prospecting agent has mail.read on 40 mailboxes.

Three — and this is the quiet one — you end up defending a tool in a renewal conversation you never really understood the first time around. That's the worst use of anyone's Tuesday.

The short version of what I'd actually do

If you're evaluating okki-go or something next to it, here's the checklist I now run, and it hasn't failed me yet:

1. Get the literal OAuth scope list, not the marketing summary. Ask which are required vs. optional.
2. Ask for the enrichment source list and refresh cadence in writing. If it's proprietary, ask for at least the categories.
3. Clarify whether LinkedIn features use the official API or session automation, and get the vendor's position on account restrictions.
4. Write down the play for intent signals before you buy intent data. If you can't write one in two sentences, wait a quarter.
5. Ask what data lives on the vendor's side after offboarding, and how deletion works.

That's it. Ninety minutes of emails, one call, and you know more about the tool than the rep does.

Where okki-go might not be the right fit

I'll be honest — this is where I get uncomfortable with how most tools get evaluated, including the one I just walked you through the due diligence for.

If your team is three people sending 400 cold emails a month, an agent-native prospecting platform with waterfall enrichment and intent integration is overkill. You'll spend more time configuring it than using it, and the ROI math won't hold.

If your compliance posture requires every data source to be individually documented and auditable — some regulated industries do — you might find that any third-party B2B contact database, okki-go included, has gaps you'll have to work around through legal review.

And if your sales motion is 90% inbound, the outbound infrastructure that these tools are built for may not be where your constraint sits. Fix the pipeline first. Buy the tool second.

None of that makes okki-go a bad choice. It makes it a specific one. The teams that get real value out of it have an outbound motion already running, a clear ICP, and someone who'll own the tool operationally. If that's you, the questions above are worth asking once, not annually.

If it isn't — the more honest move is to say so, save the budget line, and revisit next year when the workflow exists. Nobody remembers the renewal you didn't sign. They remember the tool that never got used.