Duplicate CRM follow-up after an AI-assisted lead review
A sample of the evidence note an agency can hand to a non-technical client after an unexpected automation action.
Example systems: form intake → workflow engine → AI classification → CRM → email provider. All names, IDs, timestamps, payloads, and outcomes below are invented.
Client summary
At 10:03 UTC, one synthetic form submission started two workflow executions. Both executions classified the lead as qualified and each created a follow-up email. The available evidence proves duplicate execution and duplicate external action. It does not yet prove why the trigger was delivered twice.
Expected versus observed
| Expected | Observed | Impact |
|---|---|---|
| One submission creates one workflow execution and one follow-up. | One synthetic submission ID appeared in two executions, producing two provider message IDs. | The recipient received a duplicate follow-up three minutes apart. |
Evidence timeline
| Time (UTC) | Stage | Evidence | Status |
|---|---|---|---|
| 10:03:11 | Trigger | Execution run_SYN_1041 records form ID lead_SYN_77. | Confirmed fact |
| 10:03:12 | Transformation | Email lowercased; company field normalized; no customer value retained in this sample. | Confirmed fact |
| 10:03:14 | AI decision | Classifier returned qualified=true, confidence 0.82. | Confirmed fact |
| 10:03:16 | External action | Email provider accepted message msg_SYN_A. | Confirmed fact |
| 10:06:02 | Trigger | Execution run_SYN_1042 records the same form ID lead_SYN_77. | Confirmed fact |
| 10:06:07 | External action | Email provider accepted message msg_SYN_B. | Confirmed fact |
Facts, inference, and missing evidence
- Fact: the same synthetic business key appears in two executions.
- Fact: both executions reached the external email action and received different provider IDs.
- Inference: the source platform may have retried delivery, or a user may have submitted twice. Current evidence cannot distinguish these paths.
- Gap: no source request ID, delivery-attempt counter, or raw webhook-header hash was retained.
- Gap: no idempotency decision was logged before the external action.
One implementation-ready control
Before CRM or email actions, create an idempotency key from source + submission_id + action_type. Store it with a 24-hour uniqueness window. If the key already exists, stop the second path and log duplicate_suppressed=true, the first execution ID, and the attempted timestamp.
Acceptance check: replay the same synthetic submission twice. Exactly one provider message ID should be created; the second execution must end at the idempotency gate with a visible suppression record.
Boundary
This example demonstrates evidence packaging and control design. It is not production forensics, a compliance assessment, a legal conclusion, or proof of a specific root cause.
Review the paid evidence-pack scope