Marketing & Ad-Operations Agents

The work is not the copy.

Ask a paid-media team what ate last week and the answer is almost never "writing ads". Generation was the first thing to get cheap and it is the smallest line in the budget.

• Reconciliation is the biggest single cost. The platform says one number, the analytics tool says another, the finance system says a third, and somebody spends two days a month finding out which campaign got renamed. This is joining and diffing structured records — mechanical, high-volume, and exactly what an agent is good at.
• Broken tracking is the most expensive silent failure. A landing page ships without the conversion tag, or a parameter gets dropped from a redirect, and the campaign optimises against zero conversions for eleven days. Nobody notices because the dashboard looks like a normal bad week. A checker that fires a synthetic click through every live destination and asserts the event arrives pays for itself the first time it catches one.
• Taxonomy discipline decays continuously. Naming conventions, UTM hygiene, campaign-to-product mapping and audience labels drift the moment three people and two agencies touch the same account, and every downstream report inherits the drift. Enforcing a convention is a validation problem with a fixed rulebook.
• Pacing is arithmetic that nobody has time to do daily. Which of forty line items will overspend its flight, which will underdeliver, and which just changed slope — computable exactly, from data you already have, before anyone opens a dashboard.
• Creative trafficking is high-volume, low-judgement assembly. Sizes, placements, disclaimers, localised variants, and the checks that a claim approved for one market is not running in another. Tedious, rule-shaped, and where the compliance risk quietly lives.

You are the second controller on a plant that already has one.

Every major ad platform runs a bidding optimiser inside the account. It has more data than you do, it updates continuously, and it treats structural edits as a reason to re-explore. Dropping an autonomous agent on top of it is not "adding intelligence" — it is putting two controllers with different objectives on one system and hoping they do not fight.

• Edits reset learning. Material changes to bidding, budget or targeting push a campaign back into an exploration phase in which its performance is unrepresentative by design. An agent that reacts to that dip with another edit has built an oscillator, and each oscillation is billed.
• Set a minimum change interval per object and enforce it in the tool, not the prompt. The interval comes from the platform's own stated learning period, not from how often your agent runs. A tool that refuses an edit to an object touched within the window is one function and removes the entire failure class.
• Prefer changing the inputs to the platform optimiser over out-guessing it. Feeding better conversion signals, cleaner audience definitions and correct value data usually beats manual bid manipulation, and it does not fight the controller you cannot turn off.
• Two agents on one account is the same bug, worse. An in-house agent and an agency's automation editing the same campaigns will produce changes neither can explain. If more than one system has write access, one of them owns each object — write that partition down before either ships.

The feedback signal is noise at the agent's timescale.

This is the load-bearing constraint of the whole domain. A line item with a handful of conversions a day carries almost no information about a day-over-day change, and the agent's natural cadence — hourly, or every run — is far faster than the rate at which real information arrives.

• Compute the detectable effect before allowing the decision. With daily conversions in the single digits, the smallest change a day of data can distinguish from noise is enormous. The gate is arithmetic: if the observed window cannot resolve the effect size you care about, the correct action is to wait, and the agent should say so.
• Set a minimum observation window per decision type, expressed in conversions, not in hours. Time-based windows fail exactly where they matter — on the low-volume campaigns that are most tempting to fiddle with and least able to support a conclusion.
• Pre-register the decision rule. The agent declares in advance what it will do at each outcome, then executes it. Letting the model look at the data and then decide what the threshold should have been is the mechanism behind every over-fitted optimisation, human or machine.
• Watch for the fleet-level version of the same error. An agent evaluating two hundred line items daily is running two hundred tests a day; some will look significant. If you act on every apparent winner you will act on noise roughly as often as the multiplicity implies, and the bill is real even when the lift is not.
• Exhaustion beats significance for creative. Ad fatigue means performance is non-stationary — yesterday's winner degrades on its own. A rule that rotates on a delivery threshold is more honest than one that declares a winner on a fortnight of data that will not hold.

Never optimise against a number reported by the party you are paying.

Platform-reported conversions and return on ad spend are produced by the advertising system's own attribution model, which decides how much credit its own inventory deserves. Every platform will claim the same conversion, so summing them gives you more conversions than you had. An agent optimising to that number is being graded by the vendor it is buying from.

• Give the agent one authoritative outcome source. Your own warehouse, joined to the actual revenue event, is the objective function. Platform metrics are inputs for diagnosis and pacing, never the target.
• Reserve incrementality for the decisions that deserve it. Geo holdouts and randomised suppression tests are the only reliable way to know whether spend caused anything. They are expensive and slow, so run them at the channel and budget level — not for a creative rotation.
• Make the agent report the number it optimised. Every recommendation should carry the source, the window, and the count behind it. "ROAS 3.1" is unreviewable; "reported ROAS 3.1, warehouse-attributed 1.8, 41 conversions over 14 days" is a claim a human can accept or reject in seconds.
• Expect measurement to move under you. Attribution windows, consent regimes and modelled-conversion behaviour change without warning and shift every historical comparison. Pin the definition your agent optimises against and version it, or you will spend a quarter explaining a step change that was a redefinition — the same discipline as quality regression detection.

Spend is irreversible, and the account is a credential with a lever on it.

Money spent on impressions cannot be recalled, and a published ad is public speech by your company. Both properties make ad ops a domain where the blast radius is set by architecture, not by the quality of the model's judgement.

• Cap spend at the platform, not in the prompt. Account-level and campaign-level budget caps are enforced by the ad system and survive any agent misbehaviour. Everything you enforce only in your own loop fails open the moment the loop misbehaves — the reasoning in denial of wallet.
• Give the agent a change budget per run. A ceiling on the number of edits and on the total budget delta it may apply, failing closed when exhausted. The runaway shape here is not one catastrophic edit but four hundred small ones nobody reviewed.
• Scope the credential to the accounts and objects in play. An ad-platform token typically carries far more authority than the task needs, including the ability to add users and change billing. Scope it down per scoped credentials.
• Publishing creative is a one-way door and belongs behind a human gate. Regulated claims, comparative advertising, pricing statements and anything touching a protected category need a named approver — see approval and confirmation UX. Audience targeting is part of this: some combinations of attribute and vertical are prohibited outright, and that check belongs in the tool, not in the model's discretion.
• Feed lists are an untrusted input path. Product feeds and partner-supplied copy end up in a context window and then in a live ad. Treat them as adversarial text on the reasoning in the agentic threat model, and never let feed content select the tool.

Ship the read-only agent, and measure recovered waste.

The first build should have no write access to anything. It is less exciting than an autonomous bidder and it is where nearly all the reliable value is, because misconfiguration — not suboptimal bidding — is what is actually costing the account money.

• Scope it to five checks: broken or missing conversion tracking on every live destination, naming and taxonomy violations, pacing exceptions against flight plans, spend anomalies against a rolling baseline, and reconciliation breaks between platform, analytics and warehouse.
• The metric is money recovered from misconfiguration, not lift. Days of untracked spend caught, overspend prevented, reporting breaks closed. It is attributable, defensible, and immune to the attribution argument in Step 4 — which is precisely why it makes a good first metric.
• The guard metric is alert precision. A checker that pages on a normal Monday gets muted in a fortnight and then misses the real one. Tune to a small number of alerts that are acted on, on the reasoning in notifications and digests.
• Promote to writes one action class at a time. Pausing an obviously broken ad is the safest first write — it is reversible, cheap and its failure mode is lost impressions. Budget shifts come next, targeting changes after that, and creative publication probably never goes unattended. The staging pattern is progressive autonomy.
• Evaluate against replayed history. Before letting it act, run the agent over past weeks and ask a media buyer to grade the recommendations it would have made. Cheap, fast, and it exposes the noise-chasing behaviour of Step 3 immediately — build it into an evaluation harness rather than judging by vibes.

Related: sales and GTM agents for the pipeline this feeds, content moderation agents for judging generated creative at volume, cost control in the loop for bounding the agent's own spend, and adapting a playbook for the method used to derive this one.