# Segment Drafter: An AI Agent That Drafts Segments for Human Approval

An AI segment builder agent turns a plain-English audience request into a definition someone can review. The Segment Drafter does this at L2, the propose level, for marketing-operations teams on any customer data platform (CDP). It returns counts, overlap and reason codes. It never activates a segment, reads free-text fields, or uses special-category data or close proxies, and the requester cannot approve its draft.

This rail is one entry in [AI agent rails](https://privycdp.org/ai/rails), a vendor-neutral method rather than a product feature.

## Rail at a glance

The Segment Drafter's rail appears below, and none of it relies on the prompt. A data view strips identifiers and free text before the session starts, and the tool allow-list contains no activation call.

| Field | Value |
|---|---|
| Job | Draft a segment definition from a plain-English request and return it with counts and reason codes. |
| Trigger | A marketing-operations request routed by the [Orchestrator](https://privycdp.org/ai/rails/orchestrator-agent), never a schedule. |
| Data scope | Segmentation schema, consent-filtered counts and pseudonymised IDs. No direct identifiers, free-text fields or special-category data. |
| Tool scope | Read: schema, existing segments, count estimates. Propose: a versioned segment draft. Execute: none. |
| Output contract | Draft definition, estimated count, overlap with live segments, reason codes, open questions. |
| Gate | A marketing-operations reviewer who is never the requester. Approval binds to the definition hash. |
| Limits | Runs per day, budget per run, and an audience size above which a second approver is needed. |
| Ledger | Correlation ID, request hash, tools called, draft version and hash, counts, approver, outcome, model version. |
| Evaluation | Past requests with accepted definitions, plus seeded sensitive-attribute traps. |
| Owner and kill switch | Owned by the head of marketing operations; the Orchestrator can pause it, and repeated rejections on one request pause it automatically. |

## What it does and who uses it

The Segment Drafter handles the translation between what a marketer asks for and what a segmentation engine can run. Specialists submit requests, and reviewers decide which drafts become segments.

Consider an illustrative request at a grocery subscription service: "lapsed subscribers in Ireland who regularly buy our gluten-free range, for a win-back offer".

1. The draft maps "lapsed" to no order in 45 days and lists that reading as an open question.
2. A count service, not the model, estimates 23,400 people, with 3,100 already in a live campaign.
3. A rule check fails the gluten-free clause, because the catalogue tags that range as a close proxy for a health condition.
4. The agent returns a version without it, with a reason code for each remaining condition.
5. A different person from the requester changes the window to 60 days and approves that exact hash.

Nothing has gone anywhere at that point, because activation belongs to the [Audience Sync Steward](https://privycdp.org/ai/rails/agents/audience-sync-steward).

EU case law explains the proxy check. In Case C-184/20 (1 August 2022) the Court of Justice applied Article 9(1) of the General Data Protection Regulation (GDPR) to data "liable indirectly to reveal sensitive information" [1](#source-1)[6](#source-6). In Case C-21/23 (4 October 2024) it treated online orders for pharmacy-only medicines as health data, even without a prescription [2](#source-2). A gluten-free range is a different set of facts, so take advice.

## Why this level

The Segment Drafter stays at L2 because a definition decides who gets reached, and that call belongs to a named person. A weak draft costs a reviewer a few minutes. An unreviewed one could carry a sensitive inference to an ad platform, where it cannot be recalled.

Meta's Agents Rule of Two allows a session two of three risky properties [5](#source-5), and this one uses both. Request text counts as untrusted, since people paste wording from agencies and old tickets. Pseudonymised IDs are still private data, in the view of the European Data Protection Board [3](#source-3). Changing state therefore stays out.

No promotion path leads past L2. Months of accepted drafts would show that the agent translates well, not that a particular audience ought to exist.

## Three ways it fails, and the control for each

The Segment Drafter's failures tend to look like success, because a wrong audience still returns a believable count.

| Failure | What it looks like | Control |
|---|---|---|
| Proxy through the side door | No single column is sensitive, yet postcode plus a product category points to religion or a health condition. | Catalogue tags for known proxies, a rule check on the composed definition, and seeded traps that must fail. |
| Silent interpretation | "Recent" or "high value" becomes a number nobody chose, or the model invents a field. | The contract requires an open question for each assumed value. A validator rejects fields outside the catalogue. |
| Rewording until it passes | A rejected request comes back in softer words with the same sensitive aim. | Linked requests share a correlation ID. Repeated rejections pause the run and alert the owner. |

## How to evaluate it

Evaluate the Segment Drafter by comparing audiences rather than wording, because two differently written definitions can select the same people.

1. **Replay past requests.** Score the overlap between each draft's membership and the accepted definition's, using pseudonymised IDs in a test environment.
2. **Run the seeded traps.** Each one must produce a rule failure. Report misses by sensitive category, since a good total can hide a blind spot.
3. **Split the override rate by clause type.** A changed date window usually means a vague request, while a changed attribute may mean a mistranslation.

Report these figures by rail and role, never by named reviewer. Annex III point 4(b) of the EU AI Act treats monitoring of workers' performance as high-risk, so take advice before building any per-person view [4](#source-4). A catalogue change reruns the whole set, because a newly added column can create a new proxy.

## Where it runs

The Segment Drafter is best hosted on a private model, because audience logic shows what you know about people. External hosting is possible only with masking and contract cover, and the [boundary architecture patterns](https://privycdp.org/ai/ai-agents-on-customer-data-inside-your-boundary) compare the options. PrivyCDP offers AI-assisted review of groups with limits on data access, though you would write this rail yourself.

## Related

- [Agent-assisted segmentation walkthrough](https://privycdp.org/ai/agent-assisted-segmentation-walkthrough): the use case, with sample audit fields.
- [AI agents for marketing operations](https://privycdp.org/ai/rails/functions/marketing-operations): how drafting fits with journey QA, syncing and reporting.
- [Rail card template](https://privycdp.org/tools/agent-rail-card): a blank card for your own drafting rail.


More profiles sit under [AI agent rails](https://privycdp.org/ai/rails). To write your own drafting rail, download the [rail card template](https://privycdp.org/tools/agent-rail-card).

Rail level: L2 · Risk: medium · Function: marketing operations

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### Can an AI agent build customer segments on its own?

It can draft them. Publishing is a separate decision that needs a named reviewer, and on this rail the agent has no tool that makes a draft live.

### What happens when a request is ambiguous?

The agent picks a provisional reading and states it as an open question beside the clause. The reviewer then confirms or changes it, and the reason codes record why each condition exists.

### Is an agent always better than a saved template?

No. If most requests are variations on a few audiences, a parameterised template costs nothing to run, which fits Anthropic's advice to look for the simplest solution first [7](#source-7).

## Sources

1. GDPR Article 9: https://gdpr-info.eu/art-9-gdpr/
2. Court of Justice of the EU, Press Release 159/24, Case C-21/23 (4 October 2024): https://curia.europa.eu/jcms/upload/docs/application/pdf/2024-10/cp240159en.pdf
3. European Data Protection Board, Guidelines 01/2025, consultation version (16 January 2025): https://edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf
4. EU AI Act, Annex III: https://artificialintelligenceact.eu/annex/3/
5. Meta, Agents Rule of Two (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
6. Inside Privacy, commentary on Case C-184/20: https://www.insideprivacy.com/eu-data-protection/special-category-data-by-inference-cjeu-significantly-expands-the-scope-of-article-9-gdpr/
7. Anthropic, Building Effective Agents (19 December 2024): https://www.anthropic.com/engineering/building-effective-agents

This article is general information, not legal advice.

## Further reading

- [AI Agents for Marketing Operations: The Playbook on Rails](https://privycdp.org/ai/rails/functions/marketing-operations)
- [The Agent Rail Card: A One-Page AI Agent Permissions Template](https://privycdp.org/ai/rails/agent-rail-card)
- [Correlation ID](https://privycdp.org/learn/glossary/correlation-id)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)