The VP Marketing Agent: One Agent That Sees the Whole Picture and Changes Nothing

Who this is for: CMOs and VPs of marketing, and the marketing-operations leads who would build this for them. The agent prepares the VP's week and holds no decision rights. It belongs to the AI agent rails method, which is vendor-neutral, and the glossary calls this role the whole-picture agent.

On this page: what it is and is not · what it reads · how the limits hold · example readout · conflict catalogue · named staff · failure modes · a first version

Why does nobody see the whole picture?

Nobody sees the whole picture because function agents and function dashboards each optimise one part. Lifecycle sees its journeys, paid media its spend, and data its test results. Each can look healthy in the same week that the same customers receive two offers, one of them before a consent fix has landed. The costly problems live between functions, and no one's dashboard is built to show them.

More agents will widen this gap. Gartner's 2026 CMO Spend Survey of 401 marketing leaders, as reported by Marketing Dive, found budgets at 7.8% of company revenue and 15.3% of budgets directed to AI, while only 30% felt they had the infrastructure to scale it 2. As agents multiply, each one optimises locally at machine speed. A leader then needs one read-only view across them. The VP Marketing agent is that view, and its job is to connect what others cannot see.

What the VP Marketing agent is and is not

The VP Marketing agent prepares the VP's week and holds no decision rights. The table separates it from five things it is often confused with.

An agent that drafts campaigns or moves budget is a different job on a different rail. Many will be useful. This page is about the one agent with permission to see everything because it can touch nothing.

What data should a leadership AI agent read?

A leadership AI agent should read aggregates, inventories and metadata from ten sources, and nothing at customer level. The freshness column shows typical values and is illustrative. Each source carries its own stamp into the readout.

Aggregates only, and how that is enforced

Aggregates-only is enforced by what the tools return, because a prompt cannot enforce anything. An instruction not to look at customers is not a control. These are the systems that do the work.

Small groups can still identify people, so suppression needs care. Hiding a small cell is not enough if a total and the other cells let someone subtract their way back to it. Suppress a second cell, or round the totals. The boundary architecture patterns describe the aggregate-first tools this depends on.

The Rule of Two gives the same answer from a security angle 1. This agent reads some untrusted text, such as campaign and segment names that anyone can type. It also holds sensitive business data. So it already has two of the three properties and must never gain the third, the ability to change state or communicate outside. If a campaign name carries hidden instructions, the worst outcome is a misleading paragraph that the VP reads next to its evidence.

Because it works on aggregates, an external model is acceptable where the contract allows. A private model suits regulated teams.

The weekly readout: a complete example

The weekly readout is the agent's main output: five sections, with every claim tied to evidence, a freshness stamp and a confidence level. Some teams call this a weekly marketing brief, but it is built for a decision rather than a slide. The example below shows the full format.

Readout r46, version 1. Draft for the VP. Week of 9 November 2026. Nothing has been changed or sent elsewhere.

Top line (invented): three launches collide with other work, one as soon as Tuesday, and three decisions are due by Wednesday. Nine of ten inputs were fresh at run time. Pipeline data failed its freshness check and is excluded.

What changed since last week

Hypotheses, not findings. C4 follows the consent reconciliation closed on Thursday (q-cal-018), but a data-quality error could produce the same pattern. C3 coincides with 11 new requests against a usual 6 (invented, q-que-003). Corrected from last week: readout r45 said overlap was falling. The query had excluded one region, and this week's figures use the fixed query.

Conflicts

Risks

Decide this week

The ranking is a draft. The VP decides, and the agent records nothing as decided until the VP says so.

What I cannot tell you

• The revenue effect of X1. Pipeline data is nine days old (invented), so it is excluded.
• Whether C2 comes from volume, content or list quality. These inputs cannot separate them, and Google's figure covers Gmail only.
• Overlap in small markets. Three cells fell below the minimum group size (invented) and were suppressed.
• What the ad platform's own agent did. It writes to the vendor's log, not to this ledger.
• Who did what. This agent holds no view of named staff, by design.

That last list matters most, because it stops a tidy summary being mistaken for the whole truth. In production, each reference opens the query and its stored result. Set confidence by rule, from source coverage and freshness, and never from the model's own sense of certainty.

The conflict catalogue

The conflict catalogue lists problems that appear only when two sources are read together, which is why function agents miss them. Start with these eight, and add to the list after each post-mortem.

The spam-rate row uses Google's guidance to stay below 0.10% and never reach 0.30%, covered in the guide to inbox placement. Rule layers still enforce the hard limits. The catalogue finds conflicts early, and it does not replace a block at send.

Seeing the agents themselves

The ledger and rail cards let a VP see the agent estate in one place. For a leader answering to a board or a risk committee, this may matter as much as the campaign view. The agent can report, by rail:

• The busiest rails, so effort follows real use.
• The slowest gates, where people may start to bypass approval.
• The most rollbacks, which suggest a rail is above its evidence.
• Approval rates so high they suggest rubber-stamping, which is a question for the Trainer, not an accusation.
• Rails with no named owner, which the rail levels treat as a demotion trigger.

The source is the ledger, not each agent's own account of itself. Every rail figure comes from the same metadata an auditor would read.

Report on rails and roles, never on named staff

The readout reports on rails and roles, never on named staff, and this is a hard rule on the rail. AI Act Annex III point 4(b) lists systems that monitor and evaluate the performance and behaviour of workers, and that allocate tasks based on individual behaviour or traits, as high-risk uses 6. Annex III obligations apply from 2 December 2027 7. Marketing segmentation is not high-risk per se, as the EU AI Act guide explains, but a readout that ranks named marketers or approvers could change what this system is. Take advice before anyone proposes it.

A role with one holder is a named person in all but name. If the deliverability lead is one person, a figure about "the deliverability lead's response time" reports on that person. Apply a minimum group size to staff as well, and report such a figure at team level.

The temptation will come as a helpful request: "just show me who is slowest at approving". The answer is that the view does not exist. Slow gates are a capacity question, and the VP can ask it by rail.

Numbers come from queries

Every number in the readout comes from a query, because the model writes the words and never does the arithmetic. A simple pattern enforces this. Fixed queries produce a locked figures table with a reference for each value. The model writes prose using those references, and a renderer fills in the values. A check then rejects any digit in the text that has no reference.

Causes appear as hypotheses with evidence, never as fact. The reporting summaries use case applies the same principle to a single function. PrivyCDP's AI layer covers AI-assisted review of reports, with limits on data access and review of results. The VP Marketing agent itself is a method you build, not a product feature of the platform.

How does the VP work with it?

The VP works with this agent as with an analyst who prepares the week and has no authority to act. The rhythm below is illustrative.

1. Monday early. The readout arrives through the delivery service, and only to the VP.
2. Monday. The VP marks each decision, disagrees where needed, and asks follow-up questions.
3. By Wednesday. People resolve the conflicts through their own functions and tools.
4. Next run. Decisions and disagreements are recorded, and the next readout starts from them.

Anything forwarded beyond the VP is edited and sent by a person. A draft section for a board pack stays a draft until a person owns it. When the VP disagrees with a claim, that disagreement is the most useful input the agent gets, because it shows where the sources or the method fall short.

The VP Marketing agent's own rail card

The VP Marketing agent's rail card is short because it holds so few powers. All ten fields of the rail card are still filled in.

It never sees an individual customer, changes anything or reports on named staff. Its level never moves past L2, because adding an execute tool would give one session all three Rule of Two properties.

Five ways the VP Marketing agent fails, and the control for each

The VP Marketing agent fails mainly by being believed too easily, because a clean summary from one voice carries weight. Each control below works without trusting the model.

Which metrics show the readout is worth reading?

The metrics that show a readout is worth reading are accuracy, early warning and timely decisions. Avoid measures such as hours saved, which say nothing about whether the content was right.

A first version on three sources

A first version needs only three sources: the campaign calendar, the segment inventory with overlaps, and approval queue stats. These are already in systems you own and need no new model infrastructure, and they show whether conflict detection is worth pursuing. A script can detect the collisions, and a person can write the note. A model adds value later, once there is enough to connect.

Ask your marketing-operations lead for that version first. Add consent health and deliverability next, and the ledger once you run several rails. The marketing operations playbook and the AI marketing operations roadmap show what usually comes first.

You may not need this at all. With one team, one calendar and one weekly meeting, a shared calendar and a good analyst will catch these conflicts. The agent earns its place when functions run separately, several agents are active, and no single person can read everything. The control plane page shows how it fits beside the routing and learning jobs.

Checklist for a leadership AI agent

• ☐ No profile tool exists on this rail.
• ☐ Tools return aggregates only, with a minimum group size set outside the model.
• ☐ Small cells are suppressed, including those that subtraction could reveal.
• ☐ Ledger views exclude payloads.
• ☐ Views carry roles and rails, and you have taken advice on staff data.
• ☐ A separate service delivers the readout to fixed recipients.
• ☐ Every figure has a query reference, and a check rejects any mismatch.
• ☐ Every claim shows evidence, freshness and confidence.
• ☐ Each readout includes "what I cannot tell you" and corrections to the last one.
• ☐ Disagreements are recorded and feed the next readout.