Direct answer: do not give an agent a shared employee credential, generic database access, or a connector that can change any object. Separate the planner that proposes a next step from a deterministic executor that accepts only tools covered by a Marketing Action Contract. Each tool declares inputs, business preconditions, read/write scope, impact tier, approval, idempotency, evidence, and rollback. The agent gains useful reach without inheriting unrestricted authority.
Moving from recommendation to execution changes the investment. A wrong lead summary creates review work; changing an opportunity stage, enrolling an audience, shifting budget, or sending a message can affect revenue, privacy, customer experience, and sales operations. Model accuracy is only one control. The action surface between the model and CRM, MAP, ad platforms, and service systems is the product that must be engineered.
Write the Marketing Action Contract
- 1. Outcome and owner — business decision, baseline, accountable operator, and validity window.
- 2. Allowed action — exact verb, object, system, and fields; deny everything not listed.
- 3. Input — schema, source, freshness, confidence, and required data.
- 4. Preconditions — eligibility, consent, commercial state, service holds, and protected records.
- 5. Identity — service principal, read/write scope, environment, and separation of duties.
- 6. Execution — idempotency key, timeout, retry, volume limit, and duplicate prevention.
- 7. Approval — impact tier, human or policy approver, and expiration.
- 8. Evidence and reversal — request, decision, version, result, error, correction, and rollback path.
OpenAI function calling defines tools with JSON Schema and returns a tool call for the application to execute. A schema reduces input ambiguity; it does not authorize the write or confirm that the account is still eligible. The executor should recheck permission, state, and limits at execution time even when the planner produced valid arguments.
Expose business tools, not system access
Prefer create_review_task, update_score_if_eligible, or pause_journey_for_open_case over execute_sql or update_any_field. A US B2B agent might recommend moving an account into an ABM sequence, but the gateway should verify active opportunity ownership, suppression, audience policy, and the current campaign state. The model proposes; the action service decides whether the proposal is executable now.
NIST is developing standards work for software-agent identity and authorization because autonomous action needs verifiable identities and controlled permissions. Microsoft documents agent identities and connector permissions. Salesforce custom actions require the agent user to have access to both the data and the referenced Apex class. Authority belongs in identity, policy, and code—not hidden in a system prompt.
Use three impact tiers
- Tier 1 — read or reversible preparation: check eligibility, draft, open a task; may run automatically with logs.
- Tier 2 — bounded write: update approved fields, add a campaign member, pause a journey; needs limits, a small cohort, and sampled review.
- Tier 3 — external or financial consequence: send, publish, delete, change budget or price; require explicit approval until evidence and policy support a different release decision.
Run an eight-week release path
- Weeks 1–2 — choose one low-impact action, baseline the current process, and inventory systems, credentials, errors, and exceptions.
- Weeks 3–4 — write the contract; build narrow actions, fixtures, and failure cases.
- Week 5 — shadow mode; compare proposals with operator decisions without CRM writes.
- Week 6 — approval-required writes for a small cohort with daily review.
- Week 7 — automate only the Tier 1 or Tier 2 path that passed release gates.
- Week 8 — test duplicate calls, stale state, expired permission, destination outage, and rollback; then scale, revise, or stop.
Choose the execution layer deliberately
- Platform-native action — fastest and close to business context; increases vendor dependence and inherits platform permission boundaries.
- Integration layer — coordinates CRM, marketing automation, media, and service under common controls; adds mapping, observability, and latency work.
- Custom action gateway — strongest policy control and portability; highest engineering, security, and operating responsibility.
Cost grows with action and system count, permission granularity, environments, volume, latency, test coverage, log retention, human review, retries, reversals, and licenses. Marketing owns the outcome and impact tier; RevOps owns objects and states; security owns identity; data validates inputs; engineering operates the gateway; legal and privacy specialists review applicable uses. NIST Govern reinforces accountability, defined roles, and lifecycle monitoring.
Measure valid execution, not agent activity
- Outcome — incremental conversion, revenue, cycle time, or quality per eligible unit.
- Execution — valid completions, latency, and cost per approved action.
- Failure — incorrect, duplicate, reversed, stale, or blocked action.
- Control — approval, override, scope violation, and denied attempt.
- Experience — complaint, opt-out, correction, or inappropriate contact.
- Operations — human time saved, exception queue, and recovery time.
Choose the autonomy level at https://makinai.co/insights/en/copilot-workflow-ai-agent-marketing-what-build-first, prepare production operations at https://makinai.co/insights/en/ai-marketing-pilot-production-operating-scale, and test journeys before expansion at https://makinai.co/insights/en/ai-test-broken-crm-customer-journeys. Autonomy determines who chooses the step; the action contract determines what that step can actually change.
If the agent already recommends useful work but the company will not let it execute, bring one workflow, the current permission map, and 30 days of errors and outcomes. MAKINAI can design the smallest auditable action layer at https://makinai.co/services/en/ai-strategy-transformation-consulting without unrestricted access or a full-stack replacement.