okki-go Permissions, Data Source Transparency, and Intent Data: A Scenario-Based Walkthrough

There's No Single Answer to 'What Permissions Does okki-go Require?'

Every time someone asks me what permissions okki-go requires, I ask them one thing back: what does your outbound motion actually look like right now?

Because the honest answer is — it depends. Not in a hand-wavy consultant way, but in a very concrete way. The permissions you should accept, the level of data source transparency you should demand, and whether intent data is even relevant to you depend entirely on where your team sits today.

I've been on the wrong side of this question twice. First time cost us roughly $2,400 in wasted connect-and-nurture cycles in April 2023. Second time was worse — a data source we didn't vet properly pushed bad-fit leads into our pipeline for eleven weeks before anyone caught it. So I started keeping notes. Here's what I'd tell anyone evaluating okki-go (some sources spell it okki-go, same product) or any comparable prospecting tool.

There are three broad scenarios. You're almost certainly in one of them.

Scenario A: Small Team, First Serious Prospecting Tool

You're running 1-3 SDRs, sending under 1,000 contacts a month, and haven't built a dedicated RevOps function yet. Maybe you're doing LinkedIn outreach manually and you're tired of it.

What matters most: minimum viable permissions

In this scenario, you should care about permissions the way you care about your bank's privacy policy. Not because anything bad will definitely happen, but because the permissions you grant teach you something about the vendor's philosophy.

Here's what I've learned: a tool that asks for only what it needs is usually a tool that's thought carefully about security. A tool that asks for blanket access to your inbox, calendar, LinkedIn account, and CRM — all at once, on day one — is usually a tool that's optimized for features, not for your risk.

Case in point: I didn't read the OAuth scopes on a tool I connected in April 2023. It wanted "read all email and contacts." I clicked allow. Three weeks later I heard a competitor mention something I'd shared in what I thought was a private thread. A contact got cross-synced through a shared list I didn't know existed. That single oversight cost a month of pipeline and a relationship I still haven't fully rebuilt. (Note to self: read every OAuth screen, every time.)

What about data source transparency?

Truthfully? At this scale, it matters less. You're not going to audit every record. You're trying to get a motion working.

But — and this is the part people skip — if the vendor's website doesn't even describe where their data comes from, that's a signal. Not a dealbreaker. Just a signal. Put it on the list of things to revisit when you're closer to Scenario B.

LinkedIn automation scraping, same story. At low volume, you're unlikely to trip LinkedIn's detection. But you should know what the tool is actually doing — API-based or direct scraping. API is safer. Scraping puts your account at risk. Neither is inherently wrong, but you deserve to know which one you're using.

Scenario B: Scaling Up, Pipeline Accountability

You've got a real SDR team now. 5,000+ contacts a month. Someone is tracking reply rates and conversion-to-SQL per rep. Leadership asks about pipeline coverage every Monday.

This is where data source transparency stops being a nice-to-have and starts being a line item in your risk register.

What to ask about data sources

Stop asking "do you have good data?" Every vendor says yes. Start asking:

• Where does each data type come from — firmographic, contact, email verification?
• How fresh is it? What's the re-verification cadence?
• When you enrich a record, can you tell me which source it came from, for that specific record?

That last one is where most tools fall apart. They'll show you a list of 47 data partners and call it transparency. That's not transparency. That's a logo wall.

Waterfall enrichment — where a record gets checked against multiple providers in sequence until it's found — is the right approach here. But if the tool can't tell you the provenance of a specific field, you're trusting vibes, not data.

Here's the counterintuitive part: I don't actually want full disclosure of every source. I want record-level provenance. "This email was verified 14 days ago against two providers" is more useful than "we work with 47 data partners."

LinkedIn automation scraping at this scale

At 5,000+ contacts a month, you're on LinkedIn's radar whether you like it or not. If your tool is doing direct scraping on your account, you're accepting a real risk. Not a theoretical one. I've watched an SDR's LinkedIn account get restricted for three weeks — and she was following the tool's "recommended" limits.

Ask the tool directly: does it use LinkedIn's official API, a third-party data provider, or direct scraping? If the answer is fuzzy, assume scraping.

What is intent data — and when should you actually use it?

Intent data is a signal that a company or person is in-market for what you sell. It comes in three flavors:

1. First-party intent — your own website visits, pricing page hits, content downloads. Highest signal, lowest volume.
2. Second-party intent — data from partners, communities, or review sites you have an agreement with.
3. Third-party intent — aggregated signals from providers like Bombora, G2, or TrustRadius. Broad coverage, noisy.

When should a B2B sales team use it? Honestly — later than most vendors would like you to believe.

Use intent data when your ICP is wide enough that manual prioritization breaks down. If you've got 4,000 accounts that technically fit and no way to sequence them, intent signals help.

Use it when your sales cycle is long enough that a 60-90 day head start matters. If you close in two weeks, intent signals are mostly noise.

Don't use it when you're still figuring out your ICP. Intent data tells you who's showing interest. It doesn't tell you who you should be selling to. Those are different questions.

Scenario C: Regulated Industry or Enterprise Procurement

You're in fintech, health tech, or any space where the security team has veto power. Or you're big enough that procurement has a standard vendor review process.

Permission logs and audit trails come first

In this scenario, the permission question changes shape. It's no longer "what does the tool access?" It's "can I prove — to an auditor, to a client, to a regulator — what the tool accessed, when, and on whose behalf?"

Things to demand:

• Exportable permission and access logs
• A signed data processing agreement (DPA)
• SOC 2 Type II or ISO 27001 — ask before you're asked
• Data residency options if you operate across regions

This is where my stance gets firmer: I'd rather work with a vendor who says "here's what we're great at, and here's where you'll need your own security review" than one who claims to handle everything. The vendor who admitted their compliance tooling wasn't built for our region — and pointed us to what to build internally — earned three years of business from us. The one who said "we do it all" got cut in the second review round.

How to Figure Out Which Scenario You're In

Three questions:

1. How many contacts are you touching per month? Under 1,000 → Scenario A. 1,000-5,000 → B. 5,000+ → C, or B if you're not regulated.
2. Does your data need to survive an audit? If yes, you're in C. Skip the debate.
3. How much of your outbound are you outsourcing to the tool? The more you're handing over — list building, enrichment, verification, sequencing — the more data source transparency matters to you.

My experience here is based on roughly 40 vendor evaluations across mid-market B2B teams over the past six years. If you're in a different segment — enterprise or ultra-lean startup — your calculus will look different. I can't speak to how these principles hold up in, say, a 30-person agency running 50,000 contacts a month. That's a different animal.

But one regret I keep coming back to: I spent almost two years treating every tool the same way. Same evaluation checklist, same questions, same weight on each criterion. That was wasteful. If I'd just stopped and asked "which of these three scenarios am I in?" I'd have saved weeks of evaluation time and avoided at least one bad contract.

Figure out your scenario first. Everything else follows from there.