Most DM bots are a prompt and a prayer. Ours has handled thousands of conversations, and every rule below exists because something broke without it. Four layers, in build order.
I run an AI DM bot on Instagram for my agency and for clinics. It has handled thousands of inbound and outbound conversations. This is the framework it runs on, written so a clinic owner or an agency owner can copy it without hiring an engineer.
Here is the mistake almost everyone makes. They build the plumbing and the prompt, watch it reply to people, and call it done. Then the numbers are bad and they blame the model.
The bot is four layers. Plumbing. Conversation design. Hard guardrails. Measurement. Most builders stop at two. The two they skip are the ones that decide whether it books calls or embarrasses you.
One rule above all the others. Anything that costs money when it goes wrong gets enforced in code, not in the prompt. Prompt-only rules fail somewhere between 10 and 90 percent of the time, and they fail silently. Our consent gate lived in the prompt for nine days and failed 87 percent of the time before we moved it.
A webhook and a system prompt. It replies. It also pastes the wrong link, pitches people who said no, and promises a call that nobody is dialing.
Plumbing with a kill switch and batching, a five track conversation design, and the first four guardrails in code. It books, and you can see the funnel every morning.
Follow-up cascades inside the 24 hour window, voice notes at the emotional beats, verified conversions from the CRM, and a daily report with day counters on every open bug.
A prompt that replies to DMs.
Four layers. The prompt is one of them, and it is not the one that protects your money.
| Role | Talks to you | Job |
|---|---|---|
| 1. Plumbing | DM platform, webhook, AI, reply | Kill switch, batching, dedupe, media handling |
| 2. Conversation design | System prompt and assets | Five tracks, stage model, readiness gate, CTA rules |
| 3. Hard guardrails | Backend code, never the prompt | Commitments, crisis interrupt, consent, links |
| 4. Measurement | A reporting job and one channel | Daily audit, funnel with percentages, bug day counters |
Give every subscriber a kill switch field (ai_bot_active). A human flips it off to take over, and the bot checks it before every send. Store outbound text in a field and fire a one step published send flow, because unpublished flows fail silently. People send four short messages in a row, so store each inbound, dedupe identical text within five minutes, and process a batch after a dynamic delay (20 seconds on a new conversation, 90 to 150 on a slow replier). Three dedupe layers, not one. If the AI returns empty, block the send.
Voice notes and images arrive as expiring CDN links. Download at webhook time, re-host, then transcribe on a separate job two to five minutes later. Never transcribe a remote URL inline. Assume a 24 hour messaging window and compress every follow-up to fit inside it.
You cannot tune what you cannot see. One channel, one report at a fixed time, summary on top and the breakdown in a thread. Build this before the conversation design, not after.
Inbound warm, outbound or new follower, keyword fast track, disqualified redirect, post conversion. Track the stage on the conversation record: new, warming, discovery, pain identified, pitch, link sent, converted, post conversion, plus dq, declined and disengaged as terminal states. Store the pitch message number, when the link went out, decline count and the DQ reason.
No pitch until both are true: six or more exchanges (or a high intent opener) and the prospect has stated a concrete problem in their own words. This one gate was the largest single lift in conversion we ever measured.
Never send the pitch and the link in the same message. Pitch, wait for an explicit yes, then the link. The immediately preceding user message must match an explicit yes pattern: yes, yeah, sure, send it, I'm down, interested. "Ok", "hmm", an emoji, or "I'm thinking" gets the URL stripped and the question asked again. DQ redirects are exempt, because there the link is the point.
Hardcode every URL. Never let the model choose or generate one. Ours pasted the booking link into the downsell flow for four straight days. Thirty minute cooldown on re-sending the same link. If your URL strip runs, it must remove the whole sentence, because "check it out here:" with no link is a silent conversion killer. Detect "I don't see a link" and push that lead to a human queue that someone actually works.
Never commit to a specific time, a named person or a live call. Crisis interrupt on distress keywords and, for clinics, symptom red flags: halt everything, send the scripted response with emergency resources, page a human, lock the conversation. Terminal states are terminal: no pitch, no voice note, no follow-up to anyone who declined or was disqualified. Business pitch auto disqualify. Do not run volume without these four.
Engaged with no ask yet: four hour contextual nudge, then a 23 hour callback with a value asset. Link sent, no conversion: five minutes, four hours, 23 hours, then stop and hand to a human. Any reply cancels the rest. Use a round id so stale jobs cannot fire. Never send a bare "...?", it was the single most complained about behaviour we ever shipped.
Pre-recorded notes beat text where it is emotional: the opener, discovery, two to four objection specific empathy notes mapped to your real top objections, the bridge to the pitch, the downsell, and a post conversion prep video. Always a short text line before a voice note, typing indicator before every bubble.
Report the CRM confirmed number next to the chat inferred number, every day. The gap between them is where your real bugs live. Then add the cold reactivation tiers, 48 hours and one week first, because those two are the only ones that ever produce volume.
Each phase has a done-when. If you have not hit it, do not start the next one. Every failure I have seen came from skipping ahead.
Paste these as written. They are short on purpose, because the long ones drift.
250 characters per bubble, two to four bubbles per turn. Never end a turn on a statement. Match their energy and their words for the problem. Reference their city or the season once in the first three messages. If they say it is midnight, defer the ask to tomorrow.
Decide in advance how the bot answers "is this a bot?" and make it honest for your jurisdiction. For a clinic: this is the clinic's assistant, a team member reads every thread. Never confirm the platform or the model.
Keep an explicit list of things the bot may claim: services, locations, results that are cleared. Anything outside it gets a hedge, never an invented specific. No diagnosis, no dosing, no outcomes, no insurance quotes, no before and after claims in DMs.
Qualified: primary CTA. Partial fit: secondary offer, a lower cost service line, a virtual visit, a course, a community. No fit: graceful exit, log the reason, never re-pitch. For agencies ask budget, revenue and decision authority by message four to six.
Every one of these has happened to me or to someone I set this up for.
| Failure | Fix |
|---|---|
| "He's dialing you right now" sent six times while two people waited | Guardrail 1 in code: no times, no names, no live calls |
| Booking follow-up voice note sent to someone in distress | Crisis interrupt halts pitches, notes and cascades, pages a human |
| Consent gate in the prompt failed 87 percent for nine days | Explicit yes pattern enforced in code before any link |
| Downsell flow pasted the booking link for four days | Links are hardcoded constants, the model never chooses |
| "Check it out here:" with no link | URL strip removes the whole sentence |
| Bare "...?" nudges | Rotate contextual follow-ups, never the bare version |
| 62.5 percent of deep conversations never got an ask | Ask rate on the weekly dashboard, readiness gate tuned |
| Manual link queue nobody worked | Post it twice a day, capped, with a reply when done line |
It holds the whole framework: the four layers in build order, the five conversation tracks, the readiness and consent gates, the eight hard guardrails, the cascades, and the daily report format. Hand it to your bot or your builder and say the trigger. It walks the build in the order that survives contact with real people.
--- name: ig-dm-bot description: Builds and operates an Instagram DM bot on a four layer framework, plumbing, conversation design, hard guardrails in code, and daily measurement, in the build order that survives real conversations. Trigger on "build my dm bot", "my dm bot keeps pasting the wrong link", "set up manychat ai", "why isn't my dm bot booking". --- # Instagram DM Bot Generalized from a live bot that has handled thousands of inbound and outbound DMs for an agency and its clinic clients. Every rule exists because something broke without it. The one rule above the others: anything that costs money when it goes wrong is enforced in code, not in the prompt. Prompt-only rules fail 10 to 90 percent of the time, silently. ## The four layers | Layer | What it is | Where it lives | | --- | --- | --- | | 1. Plumbing | DM platform, webhook, AI, reply | ManyChat or similar plus your backend | | 2. Conversation design | Tracks, stages, voice assets, CTA logic | System prompt and assets | | 3. Hard guardrails | Rules the AI cannot override | Backend code, never the prompt | | 4. Measurement | Daily audit, funnel KPIs, bug list | A reporting job and one channel | ## Build order 1. Plumbing: kill switch field per subscriber, published one step send flow, batching with dynamic delays (new 20s, rapid 15s, normal 30s, slow 90s, very slow 150s), three dedupe layers (message 5 min, atomic batch claim, send guard 30s), last 20 messages to the model, empty response guard. Media: download at webhook time, re-host, transcribe on a 2 to 5 minute job. Assume a 24 hour window. 2. Logging and the daily report, before tuning the prompt. 3. Core flow: warm up, discovery, readiness gate, pitch, consent gate, link. 4. Guardrails 1 to 4 and the crisis interrupt. Do not run volume without them. 5. Auto DQ rules and secondary offer routing. 6. Cascades inside 24 hours. 7. Voice notes and media assets. 8. Conversion verification via CRM webhook. 9. Cold reactivation tiers and human queues. ## Conversation design **Five tracks:** inbound warm, outbound or new follower, keyword fast track (book in 2 to 3 exchanges, no warm up), disqualified redirect, post conversion. **Stages on the record:** new, warming, discovery, pain identified, pitch, cta link sent, converted, post conversion. Terminal: dq, declined, disengaged. Store stage, pitchMessageNumber, ctaLinkSent and ctaLinkSentAt, secondaryLinkSent, converted, declineCount, dqReason, lastUserMessageAt, followUpRoundId, escalatedToHuman. **Readiness gate:** no pitch until six or more exchanges (or a high intent opener) and a concrete problem stated in their own words. **CTA rules:** pitch, wait for an explicit yes, then link. Explicit yes pattern enforced in code (yes, yeah, sure, i'm down, send it, bet, interested). Vague replies get the URL stripped and the question asked again. DQ redirects are exempt. Thirty minute link cooldown. Condense copy on the fourth send but never strip the URL. If you strip a URL, strip the whole sentence. Links are hardcoded constants. Detect link delivery failure, hard strip URLs for that conversation, and push the lead to a staffed human queue. **Style rules:** 250 characters per bubble, 2 to 4 bubbles per turn, never end on a statement, match register, use their words, one local or seasonal reference in the first three messages, late night awareness, gender and name detection, an honest identity line, a tech stack deny script, an explicit allowlist of claims. ## Hard guardrails (code, with an event log) 1. Never commit to a specific time, a named person, or a live call. 2. Crisis interrupt: distress keywords and clinic symptom red flags halt all pitches, notes and follow-ups, send the scripted response with emergency resources, page a human, lock the conversation. 3. Terminal states are terminal. No pitch, voice note or follow-up to dq or declined. 4. Business pitch auto DQ. 5. Consent gate before any link (above). 6. Link constants and cooldown (above). 7. Fit rubric with three buckets and a destination each. Never mention primary pricing to a no fit. Route DQs within two messages. Log dqReason. 8. Empty response guard and send guard. ## Cascades - Mid funnel, no ask yet: 4h contextual nudge, 23h callback with a value asset. - CTA sent, no conversion: 5 min, 4h, 23h, then stop and hand to a human. - Post conversion: confirmation, prep asset, reminder inside 24h. - Cold tiers: 48h, 1 week, then monthly. Build the first two well; only they produce volume. - Any reply cancels the rest. Use followUpRoundId. Never a bare "...?". - Human lists posted twice a day, capped around 15 per tier, with a reply when done line. ## Daily report Summary split inbound and outbound. Funnel dropout with a percent of total column. Conversion with the verified number next to the headline number. Compliance percentages. CRM cross reference both directions. Three to five transcripts to review. Open issues with severity and a day counter. Suggestions with why. Day over day and week over week. Secondary offer audit. Human queue. "Verify these" for the owner. Keep a running learnings file. Exclude test accounts by pattern. If counters break, say so. ## KPIs Weekly, only four: conversations started, deep conversation rate (8 plus messages and a stated problem), ask rate, verified conversion rate. Diagnostics: deep to CTA dropout, CTA to conversion, reply rate to first outbound, median exchanges to conversion, show up rate, consent gate compliance (target 95 percent plus), link delivery failure rate, human queue age, terminal state violations (target 0), unbacked commitments (target 0), distress time to human (under 15 minutes), silent drops (target 0), cost per conversation and per verified conversion. Set alarm thresholds. ## Sector cautions Clinics: disclose the assistant, never diagnose, dose or promise outcomes, hard block symptom triage into an urgent script, treat transcripts as sensitive, confirm identity outside DMs, no before and after or testimonial claims unless cleared, route insurance and pricing to a human or a static page. Agencies: qualify on budget, revenue and authority by message 4 to 6, never quote a custom price in DMs, expect competitors pitching you, make the secondary offer genuinely good.
This framework is what runs inside my agency for cash-pay clinics. The plumbing, the guardrails and the reports are taught step by step inside the AI CEO Lab.
AI CEO Lab