# AI Agents for Marketing Operations: The Playbook on Rails

AI agents for marketing operations draft segments, check journeys before launch, watch for anomalies and summarise results. They work at read, propose and approval-gated levels (L1 to L3), with one narrow pause at L4. They never launch a campaign alone or change consent. This playbook gives marketing-operations leads the roster, rails and weekly rhythm on any customer data platform (CDP).

**Who this is for:** heads of marketing operations, with a DPO and an architect close behind. By the end you should be able to pick a first agent and defend the choice, assign the human roles, and start a 90-day path with baselines. The method comes from [AI agent rails](https://privycdp.org/ai/rails): one job, one data scope, one approver, one audit trail. It is a vendor-neutral method, not a product.

**In this playbook:** [the jobs](#what-customer-data-jobs-does-marketing-operations-do-today) · [where agents help](#where-do-ai-agents-help-marketing-operations-most) · [the roster](#which-agents-should-marketing-operations-run) · [how it works](#how-marketing-operations-works-on-rails) · [rail cards](#rail-cards-for-the-first-three-marketing-operations-agents) · [what not to automate](#what-not-to-automate-in-marketing-operations) · [regulation](#regulation-touchpoints-for-marketing-operations) · [metrics](#metrics-that-are-honest-for-marketing-operations) · [90-day path](#a-306090-day-adoption-path-for-marketing-operations) · [vendor agents](#vendor-agents-for-marketing-operations-and-when-they-are-enough) · [checklist](#marketing-operations-checklist)

## What customer-data jobs does marketing operations do today?

Marketing operations does seven recurring jobs on customer data, and each one fails in its own way. The table is qualitative on purpose. Fill in your own frequency and time figures before you change anything, because those numbers become your baseline.

| Job | How often | Where the time goes | Cost of an error |
|---|---|---|---|
| Audience requests | In bursts before campaigns | Clarifying vague requests, translating them into a definition, checking overlap | Wrong people contacted; a sensitive attribute used by accident |
| Journey building | Weekly | Wiring branches, waits and exits; copying from older journeys | Faulty logic that repeats for everyone who enters |
| Launch QA | Every launch | Reading configuration by hand; chasing links and fallback values; waiting for a second reader | Errors reach customers, with no record of what was checked |
| Audience sync | Per activation or on a schedule | Mapping fields, checking destinations, retrying failures | Personal data reaches the wrong place; people who withdrew stay in an audience |
| Monitoring | Continuous in theory, whenever someone looks in practice | Checking dashboards; deciding whether a dip is real | Reputation damage or wasted spend grows until someone notices |
| Reporting | Weekly and per campaign | Copying numbers, reconciling definitions, writing the story | A wrong number or invented cause shapes a decision |
| Fixing data issues | As they arise | Tracing a broken field through journeys and destinations | Silent audience errors, and reports nobody trusts |

## Where do AI agents help marketing operations most?

AI agents help marketing operations most where work is read-heavy and a mistake stays inside the team. Start there, then move towards actions that leave the building. These five marketing operations AI use cases are ranked by value and risk, and the order is the recommendation.

| Order | Use case | Level | Why it sits here |
|---|---|---|---|
| 1 | [Reporting summaries](https://privycdp.org/ai/rails/use-cases/reporting-summaries) | L1 | Low risk and quick to prove, and it teaches the team to review output |
| 2 | [Journey QA](https://privycdp.org/ai/rails/use-cases/journey-qa-before-launch) | L2 | High value and read-only, and it catches real errors |
| 3 | [Anomaly detection](https://privycdp.org/ai/rails/use-cases/campaign-anomaly-detection) | L1, L4 pause | Reads metrics first, and the pause comes later |
| 4 | [Segment drafting](https://privycdp.org/ai/agent-assisted-segmentation-walkthrough) | L2 | Needs sensitive-attribute checks before anyone relies on it |
| 5 | Audience sync | L3 | Personal data leaves, so it comes last |

Pick your first agent with three questions. Can a wrong output reach a customer? Does the job touch more than aggregates? Can you measure its error rate this month? Start with the first job where the answers are no, no and yes. For most teams that is reporting.

Agentic marketing operations, as used here, means agents doing bounded jobs beside named people. Forrester's readiness tool offers a broader way to score options: 52 use cases across data, analytics, measurement, content, operations, orchestration and experience delivery, rated on priority, people, process and technology [1](#source-1). Use it to widen the list, and use the order above to sequence anything that touches customer data.

Sequence matters because this market is early. Gartner predicted in June 2025 that over 40% of agentic AI projects will be cancelled by the end of 2027 [2](#source-2). Its April 2026 Hype Cycle reported that 17% of organisations had deployed agents, and over 60% expected to within two years [3](#source-3).

A script, or nothing, is sometimes the better answer. A link checker or a fixed threshold alert needs no model. A job that runs twice a year does not justify a rail at all.

## Which agents should marketing operations run?

Marketing operations should run five agents, each with one job and a person beside it. The table lists them in the recommended order, and each name links to its full profile.

| Agent | Job | Level | Data scope | Gate | Main metric |
|---|---|---|---|---|---|
| [Reporting Summariser](https://privycdp.org/ai/rails/agents/reporting-summariser) | Weekly and per-campaign summaries | L1 | Aggregates only | Owner reviews, then samples | Numeric errors on spot checks |
| [Journey QA Reviewer](https://privycdp.org/ai/rails/agents/journey-qa-reviewer) | Check a journey before launch | L2 | Journey configuration, audience counts; no profiles | A person resolves each finding | Catch rate on seeded defects |
| [Anomaly Watcher](https://privycdp.org/ai/rails/agents/anomaly-watcher) | Explain alerts; pause on threshold | L1, L4 pause | Metrics; no free text on the pause path | Pause rule pre-approved; only a person resumes | Alert precision, time to contain |
| [Segment Drafter](https://privycdp.org/ai/rails/agents/segment-drafter) | Draft a segment from a plain request | L2 | Schema, counts, pseudonymised IDs | Named approver, bound to the definition hash | Override rate, sensitive-attribute failures |
| [Audience Sync Steward](https://privycdp.org/ai/rails/agents/audience-sync-steward) | Run an approved sync | L3 | Approved segment reference; destination allow-list | Named approver every time; second above a size threshold | Sync errors, rollbacks |

Publishing is a separate L3 step after the Segment Drafter, because the drafting agent has no activation right. The [segmentation walkthrough](https://privycdp.org/ai/agent-assisted-segmentation-walkthrough) shows that handover. Three control-plane agents sit around the roster and change no customer data: the [Orchestrator](https://privycdp.org/ai/rails/orchestrator-agent) routes work, the [Trainer](https://privycdp.org/ai/rails/trainer-agent) keeps tests current, and the [VP Marketing agent](https://privycdp.org/ai/rails/vp-marketing-agent) reads across functions.

The Rule of Two sets the safe combination for each session [4](#source-4). A session that reads untrusted text and holds sensitive data gets no state-changing tools. The next table names which properties each session holds.

| Session | Reads untrusted input | Holds sensitive data | Changes state | What keeps it safe |
|---|---|---|---|---|
| Reporting Summariser | Yes: campaign names, tracking parameters | Yes: business aggregates | No | A separate service delivers the report |
| Journey QA Reviewer | Yes: copy, templates, merge fields | Yes: configuration | No | No write tools exist |
| Anomaly Watcher, explanation | Yes: campaign names, change notes | Yes: metrics | No | No write tools on this path |
| Anomaly Watcher, pause | No: numeric inputs only | Yes: metrics | Yes: one pause | Rules act, and no model is involved |
| Segment Drafter | Yes: the plain-English request | Yes: schema and counts | No | Publishing runs elsewhere |
| Audience Sync Steward | No: approval record and hash | Yes: references | Yes: one approved sync | The execution service acts, and the model reads no profiles |

## How marketing operations works on rails

Marketing operations on rails runs through five human roles, a weekly rhythm and one launch path where every step has a named proposer, checker and approver.

### Who holds which role?

Five roles cover the work, and in a small team one person can hold more than one. The exception is that an approver never approves their own request.

| Role | What they do | Who usually holds it |
|---|---|---|
| Requester | Asks for an audience or a launch | Marketer, lifecycle marketer or campaign manager |
| Reviewer | Accepts or rejects drafts and resolves findings | Marketing-operations specialist |
| Approver | Signs the exact payload; never the requester | Marketing-operations lead; compliance on a conflict |
| Rail owner | Owns the rail card, budget, kill switch and promotion decisions | Head of marketing operations |
| Auditor | Samples the ledger and tests rails against reality | Compliance, internal audit or the DPO's team |

Systems enforce these roles, not prompts. A data view fixes what an agent can read. A tool allow-list fixes what it can call. An approval service holds the gate and binds approval to a hash of the exact payload, so a later change voids it. Timeouts expire and never auto-approve. An execution service with its own credentials performs the action, and a ledger writer outside the agent records each step.

### A week in the life (illustrative)

The week below gives AI marketing ops examples in context. Its team, journeys and values are invented to show the rhythm.

- **Monday.** The Reporting Summariser's readout reaches the owner's review queue with a locked figures table. The owner queries one hypothesis and releases the report, and a separate service delivers it.
- **Tuesday.** A lifecycle marketer asks for German customers who lapsed this quarter. The Orchestrator routes the request to the Segment Drafter, which returns a definition, counts and two open questions. The reviewer rejects the first version for a close proxy, and accepts the second.
- **Wednesday.** The Journey QA Reviewer flags a missing suppression on a win-back journey. A rule-based check has already blocked the launch. A person fixes the journey and resubmits, which creates a new version hash.
- **Thursday.** The Anomaly Watcher's rule pauses a send on a bounce threshold, and the owner is told at once. The explanation points to a list imported that morning. The owner removes the import and resumes the send, with the reason logged.
- **Friday.** The team reviews the gate queue: what waited, what expired, and whether any step invites a bypass. The Trainer runs a sampled reviewer drill by placing a seeded defect in the queue. Results go to the rail owner by rail and role, not by person.

### A campaign launch, step by step

A campaign launch on rails passes through eight steps, and the proposer, the checker and the approver differ at each one that matters.

| Step | Proposes | Checks | Approves | Logged |
|---|---|---|---|---|
| Request | Marketer | Orchestrator classifies | Not needed | Request hash, route |
| Audience | Segment Drafter | Rule-based QA checks | Marketing-ops reviewer | Definition hash, counts |
| Journey | Marketer | Journey QA Reviewer, rule checks | Marketing-ops lead resolves findings | Findings, resolutions |
| Consent review | [Consent Conflict Reviewer](https://privycdp.org/ai/rails/agents/consent-conflict-reviewer) | Rule-based consent checks | Compliance, on conflict | Conflicts, decisions |
| Launch | Marketer | Launch checklist | Named approver, not the requester | Approval bound to version |
| Send or sync | Audience Sync Steward or sending service | Send-time consent check | Already approved | Destination, count, check ID |
| Watch | Anomaly Watcher | Statistical detector | Owner resumes after any pause | Alert, pause, resume |
| Report | Reporting Summariser | Number check | Owner | Query references |

Consent rests on rules at every step, as the [consent check use case](https://privycdp.org/ai/rails/use-cases/consent-suppression-check-before-send) explains. A retry of an approved sync is not a new activation only if version, audience hash and destination are unchanged and consent is re-checked. Anything else needs approval.

> **Diagram:** Swimlane of a campaign launch with lanes for marketer, agents, rule checks, approver and ledger, showing the steps from the table. Gates drawn as diamonds, with the ledger as a continuous bar along the bottom.

## Rail cards for the first three marketing-operations agents

The first three agents carry the lowest risk, so write their rail cards first. Rail cards have ten fields, and the condensed version below follows the published order. Budgets and limits are yours to set. For the fourth agent, read the [Segment Drafter's full card](https://privycdp.org/ai/rails/agents/segment-drafter).

| Field | Reporting Summariser (L1) | Journey QA Reviewer (L2) | Anomaly Watcher (L1, L4 pause) |
|---|---|---|---|
| Job | Write a plain-language summary from approved metric queries | Review one journey version before launch and report findings | Explain alerts in context; pause a send when a pre-approved threshold is crossed |
| Trigger | A schedule, or a request from the report owner | A journey submitted for launch | An alert from a statistical detector or threshold rule |
| Data scope | Aggregates above a minimum group size, definitions, calendar | Configuration, content, audience counts, rule results; no profiles | Metrics, calendar, change log; no profiles; no free text on the pause path |
| Tool scope | Read fixed queries; no propose or execute tools | Read only; propose a findings report | Read; propose an explanation; execute one pause under a written rule |
| Output contract | Summary, locked table, query references, hypotheses, what it does not show | Findings with severity, location, evidence, fix; checks actually run | Explanation with evidence links; pause record |
| Gate | Owner reviews at first, then samples; a separate service delivers | A person resolves every finding; unresolved high-severity findings stay blocked by the rule layer | Rule approved in advance; only a person resumes |
| Limits | Budget per run, minimum group size, no export | Budget per run; one version per run | Threshold, minimum volume, exempt list, daily cap; transactional mail excluded |
| Ledger | Query IDs, result hash, model and report version, reviewer | Version hash, checks, findings, resolutions, model version | Metric values, threshold version, send paused, time, who resumed and why |
| Evaluation | Spot checks; automated number check on every run | Seeded-defect set | Replay of past incidents and quiet periods |
| Owner and kill switch | Analytics or marketing-ops lead; stop the schedule | Head of marketing operations; Orchestrator pause returns launches to manual QA | Head of marketing operations; disable the pause rule, and alerts continue |

## What not to automate in marketing operations

Five marketing-operations actions stay with people or rules, whatever an agent's track record. The reasoning and real incidents are in [7 things AI agents should never do with customer data](https://privycdp.org/ai/7-things-ai-agents-should-never-do-with-customer-data) and in the [roadmap's list](https://privycdp.org/ai/ai-marketing-operations-roadmap).

- **Launching without a named approver.** The launch approval service holds this gate.
- **Changing consent or suppression state.** No agent has a write path, as the [suppression architecture](https://privycdp.org/email/consent-withdrawal-suppression-architecture) sets out.
- **Targeting on protected attributes or close proxies.** Sensitive-attribute checks block these before approval.
- **Sends to newly created audiences.** A new audience is never a bounded, reversible action, so it stays out of L4.
- **Regulated claims without compliance review.** Compliance signs off, and an agent may only flag.

Rail levels are for jobs, and the [ladder](https://privycdp.org/ai/rails/rail-levels-autonomy-ladder) stops at L4. Promotion needs written evidence and owner sign-off. Demotion is automatic on triggers such as a breached error budget, a serious escaped error or a model change without a regression pass.

## Regulation touchpoints for marketing operations

Regulation touches marketing operations in five places, although marketing segmentation is not high-risk per se under the EU AI Act. Legal teams should read this as a map, and take advice on specifics.

**GDPR Article 22 and SCHUFA.** Article 22 applies where marketing shades into decisions with legal or similarly significant effects, such as credit offers or eligibility. In C-634/21 SCHUFA (7 December 2023), the Court of Justice held that a score can be the decision when others draw strongly on it. In the UK, section 80 of the Data (Use and Access) Act 2025 treats a decision as solely automated when there is no meaningful human involvement. The [explainable AI article](https://privycdp.org/ai/explainable-ai-customer-decisions) covers the logging this needs.

**AI Act Article 5.** Article 5 bans manipulative techniques and exploiting vulnerabilities tied to age, disability or a social or economic situation, where they cause or are likely to cause significant harm [5](#source-5). For marketing operations, that is a targeting limit. It matters most in gambling and consumer finance. See the [EU AI Act guide](https://privycdp.org/regulation/eu-ai-act-marketing-customer-decisioning).

**AI Act Article 50.** Article 50 transparency duties have applied since 2 August 2026, and they cover systems that interact directly with people [6](#source-6). The agents in this playbook work behind the scenes. A customer-facing assistant is a different case, and it needs its own review.

**AI Act Annex III point 4(b).** Annex III lists monitoring and evaluating workers' performance, and allocating tasks by individual behaviour, as high-risk uses [7](#source-7). Obligations apply from 2 December 2027. So report override rates and queue statistics by rail and role, and take advice before using agent data to assess a person.

**Sector rules.** Financial promotions and health marketing carry their own rules. Start from the [financial services hub](https://privycdp.org/industries/financial-services) and the [HIPAA marketing rules](https://privycdp.org/regulation/hipaa-marketing-rules). An agent can flag a claim, but it cannot substitute for that sign-off.

## Metrics that are honest for marketing operations

Honest metrics for marketing operations are measured against a baseline taken before any agent starts. The definitions come from the [AI marketing operations roadmap](https://privycdp.org/ai/ai-marketing-operations-roadmap). We publish no ROI figures, because those depend on your team, data and baseline.

| Metric | Definition | What to watch for here |
|---|---|---|
| Campaign cycle time | Median time from approved brief to launch-ready | Rework can hide in other steps |
| Escaped error rate | Errors found after launch per 100 campaigns | Count human and agent errors alike |
| QA catch rate | Defects caught in QA as a share of all defects found | Needs a seeded-defect set |
| Override rate | Share of drafts changed or rejected | Near zero may mean rubber-stamping, so sample reviews |
| Audit coverage | Share of AI-assisted actions with a complete ledger record | Anything below 100% is a defect |
| Approval turnaround | Median time from proposal to decision | Long queues push people to bypass |
| Alert precision | Real issues as a share of alerts | Low precision causes fatigue |
| Cost per accepted task | Inference, infrastructure and review time per accepted output | Include idle capacity |

## A 30/60/90-day adoption path for marketing operations

A 30/60/90-day adoption path adds one level of risk at a time, and a team can stop at any stage. Stopping at L1 or L2 is a legitimate result, as the roadmap says. Each stage needs written evidence before the next begins.

| Days | What you do | Evidence to move on |
|---|---|---|
| 1 to 30 | Take baselines. Turn on the ledger. Write the first two rail cards. Run the Reporting Summariser at L1 with full review. | Baselines recorded; zero numeric errors on spot checks; audit coverage at 100% |
| 31 to 60 | Run the Journey QA Reviewer at L2 with a seeded-defect test. Run the Anomaly Watcher sending alerts only. | Catch rate by defect type on file; alert precision measured against your baseline |
| 61 to 90 | Run the Segment Drafter at L2. Add the pause rule after a drill. Run one L3 sync if the evidence supports it. | Sensitive-attribute traps caught; pause and resume drilled; a passed kill-switch drill |

If the evidence is missing, stay where you are and fix the cause. Do not skip the seeded-defect test to keep a date.

## Vendor agents for marketing operations, and when they are enough

Vendor agents are enough for marketing operations when the data is not regulated, it sits with one vendor, the contract is acceptable and you have no team to run private inference. The table reflects public pages checked on 1 November 2026. Products change often, and features may exist that these pages do not describe.

| Vendor | What it covers for this function | How approval works | Where the data goes | Source |
|---|---|---|---|---|
| Salesforce Agentforce | Salesforce describes a Marketing Goals Agent (a pilot), and Segmentation and Activation agents with no stated status [8](#source-8) | Trailhead says a human approver reviews the execution plan before a campaign goes live [9](#source-9) | Salesforce's cloud. Costs in our [Agentforce pricing article](https://privycdp.org/ai/agentforce-pricing-vs-owned-inference) | [8](#source-8)[9](#source-9) |
| HubSpot Breeze | Agents acting on CRM records and content | "Take action" tools need review by default, and the setting can be changed [10](#source-10). An inbox status shows runs awaiting approval [11](#source-11). The MIT AI Agent Index says automatically triggered agents run without approval [12](#source-12) | HubSpot's cloud | [10](#source-10)[11](#source-11)[12](#source-12) |
| Adobe agents | Audience and Journey agents, generally available since 10 September 2025 [13](#source-13) | Adobe describes human-in-the-loop refinement and gives no approval steps per agent [13](#source-13) | Built on Adobe Experience Platform; the release does not say where data is processed [13](#source-13) | [13](#source-13) |
| Braze Operator | Prepares campaigns and Canvases; reviews content and configuration [14](#source-14) | Shows each change for approval and cannot launch anything that affects users. Auto-approve exists for some actions [14](#source-14) | Sends data to OpenAI as a sub-processor; Braze says it does not train OpenAI's models [15](#source-15) | [14](#source-14)[15](#source-15) |
| Klaviyo Composer | Drafts campaigns from a goal [16](#source-16) | Creates a draft, and does not send or schedule [16](#source-16) | Klaviyo's platform; the page does not state model location | [16](#source-16) |

Choose private inference when regulated personal data reaches the model, when you need one ledger across vendors, or when a contract does not cover the use. The [on-premise LLM guide](https://privycdp.org/ai/on-premise-llm-deployment-marketing-personalization) covers the cost of running it. Aggregate-only jobs such as reporting may not need it at all. PrivyCDP's [product page](https://privycdp.org/cdp) describes AI-assisted review of groups, workflows, unusual events and reports, bring-your-own-model in the customer environment, and an immutable audit ledger that records each AI-assisted action with the actor that authorised it.

## Marketing operations checklist

Use this marketing operations checklist before you give any agent production access.

- [ ] Baselines exist for cycle time, escaped errors and approval turnaround.
- [ ] A ledger written outside the agents runs before the first action.
- [ ] Every agent has a rail card, with a named owner and kill switch.
- [ ] A data view and a tool allow-list enforce each scope.
- [ ] The approver is never the requester, and approval binds to a payload hash.
- [ ] Timeouts expire approvals and never approve.
- [ ] Rule-based checks block launches, and agents only add findings.
- [ ] No agent has a write path to consent or suppression state.
- [ ] Report delivery and sync execution run in separate services.
- [ ] A seeded-defect set and injection cases run before any model or tool change.
- [ ] Reviews and metrics report by rail and role, not by named person.
- [ ] A kill-switch drill has been run and timed.

Rail level: L1 to L3, L4 pause · Risk: medium · Function: marketing operations

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### What can AI agents do in marketing operations?

They can summarise results from approved metrics, check journeys against the written intent, explain alerts, and draft segments for a person to approve. One narrow pause can run alone under a written rule. Approved syncs run at L3 through a separate service. They do not launch campaigns alone, decide who may be contacted, or change consent.

### Which AI agent should marketing ops start with?

Start with the Reporting Summariser in most cases. It reads aggregates only, a wrong summary stays inside the team, and numeric errors are easy to count. It also teaches people to review agent output. Move on to the Journey QA Reviewer once baselines exist and the first reports have passed full review.

### Can AI agents launch campaigns on their own?

Not on this method. Launch stays behind a named approver who is not the requester, and approval binds to the exact version. An agent can pause a send under a written rule, because a pause is reversible. A launch reaches real people and depends on consent, so it does not qualify for L4.

### Who approves AI agent actions in marketing?

A marketing-operations lead usually approves launches and syncs, and a marketing-operations reviewer accepts segment drafts. Compliance decides consent conflicts. The approver is never the requester, and a size threshold can add a second approver. An approval service enforces this outside the agent, and a timed-out approval expires rather than passing.

### How do you measure AI agents in marketing operations?

Baseline first, then track cycle time, escaped error rate, QA catch rate, override rate, audit coverage, approval turnaround, alert precision and cost per accepted task. Report by rail and role. Avoid ROI claims unless you can attribute them in your own data, and sample reviews, since a very low override rate can hide rubber-stamping.

### Do we need a private LLM for marketing-ops agents?

Not for every agent. Reporting on aggregates can use an external model where the contract allows. Agents touching pseudonymised IDs or journey content should prefer a private model, or use masking and contract cover. Consent conflict review should stay on a private model inside your environment. Decide by data class, per rail.

## Sources

1. Forrester, "AI Agents For Marketing Are Here: Are You Ready?" (8 September 2026): https://www.forrester.com/blogs/ai-agents-for-marketing-are-here-are-you-ready/
2. Gartner press release (25 June 2025), as cited in our AI marketing operations roadmap; Gartner's page blocks automated readers: https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
3. Gartner, "What the 2026 Hype Cycle for Agentic AI Reveals" (15 April 2026), as cited in our roadmap: https://www.gartner.com/en/articles/hype-cycle-for-agentic-ai
4. Meta, Agents Rule of Two (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
5. EU AI Act, Article 5: https://artificialintelligenceact.eu/article/5/
6. EU AI Act, Article 50: https://artificialintelligenceact.eu/article/50/
7. EU AI Act, Annex III: https://artificialintelligenceact.eu/annex/3/
8. Salesforce, Winter '27 product release announcement (31 August 2026): https://www.salesforce.com/news/stories/winter-2027-product-release-announcement/
9. Salesforce Trailhead, Configure agentic campaigns: https://trailhead.salesforce.com/content/learn/modules/agentic-campaigns/configure-agentic-campaigns
10. HubSpot Developers, Agent tools reference: https://developers.hubspot.com/docs/apps/developer-platform/add-features/agent-tools/reference
11. HubSpot Knowledge Base, Run agents and review output in the agent inbox: https://knowledge.hubspot.com/ai/review-agent-output
12. MIT AI Agent Index, Breeze Agents (sources dated February 2026): https://aiagentindex.mit.edu/2025/breeze-agents
13. Adobe, General availability of AI agents (10 September 2025): https://news.adobe.com/news/2025/09/adobe-announces-general-availability-ai-agents
14. Braze Docs, What you can do with Operator: https://www.braze.com/docs/user_guide/brazeai/operator/capabilities
15. Braze Docs, Operator: https://www.braze.com/docs/user_guide/brazeai/operator
16. Klaviyo Help, How to use the marketing agent: https://help.klaviyo.com/hc/en-us/articles/40992879084059

If private deployment applies to your team, [request an architecture review](https://privycdp.org/demo) and bring your first two rail cards. More on the method is in the [AI agent rails hub](https://privycdp.org/ai/rails).

This article is general information, not legal advice.

## Further reading

- [AI Agent Rails Readiness Assessment: Where to Start, Function by Function](https://privycdp.org/tools/agent-rails-readiness-assessment)
- [Correlation ID](https://privycdp.org/learn/glossary/correlation-id)
- [Anomaly Watcher: An AI Agent That Explains Alerts and Pauses Sends](https://privycdp.org/ai/rails/agents/anomaly-watcher)
- [Audience Sync Steward: An AI Agent for Approved Audience Syncs](https://privycdp.org/ai/rails/agents/audience-sync-steward)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)