Structural Patterns
Identity, gateway, policy, inspection, and audit are the structures that let marketing agents touch real systems without becoming unmanaged automations. This reference pattern turns the security architecture into a practical harness pattern.
Related reading from AI Knowledge Hub: Secure Marketing Agents. The article develops an execution architecture; this pattern explores the control plane that marketing teams need before agents touch campaign data, commerce feeds, or publishing workflows.
Read articleReference pattern
Plans the work, but does not hold platform credentials.
Checks scope, account access, protocol rules, and approval gates.
Run with scoped credentials owned by the gateway, not the agent.
Records actor, account, tool, decision, approver, and result.
Wrong default
The agent inherits a human account, sees whatever the person sees, and breaks when the person leaves, rotates credentials, or changes roles. Audit also becomes ambiguous because human and agent actions collapse into one identity.
Safer pattern
The agent authenticates to the gateway. The gateway owns platform credentials, applies account-level policy, runs inspection, and logs the action trail separately from human activity.
Control layers
Give every agent its own identity, scope, owner, and lifecycle instead of letting it borrow a human OAuth session.
Route every tool call through one controlled boundary that can enforce account access, protocol rules, and approval gates.
Define which accounts, tools, budgets, write actions, and data classes the agent can touch before execution begins.
Scan prompts, tool arguments, URLs, and responses for injection, leakage, unsafe destinations, and policy violations.
Log agent actions separately from human actions, including scope, tool, input hash, output hash, status, and approver.
Execution path
Agent requests campaign metrics
Gateway checks agent identity
Policy resolves allowed accounts
Tool call runs with scoped credentials
Audit log stores the action trail
Approval gates
Skills · Run locally
Before a reviewer approves a campaign action, they need to know which data the agent used and how it checked the result. The ChatGPT Advertising Experiment Plugin 0.2.0 lets you inspect that evidence with fictional account and campaign data. View the Skills release manifest for 0.2.0
Use Python 3.9 or newer and run these commands from the Skills repository. If you need to build ./bin/skills-hub, install Go and run make cli-build there first. Open the Skills repository
Installation downloads the pinned release into a temporary directory. The mock run then uses the bundled data without credentials or network access. Open the plugin in the Skills catalogue
lab_dir=$(mktemp -d) &&
./bin/skills-hub install \
--source remote --module plugins \
--registry-url https://skills.ai-knowledge-hub.org/registry/plugins-index.json \
--entry marketing/chatgpt-advertising-experiment-plugin@0.2.0 \
--runtime codex --execution-runtime python3 \
--target "$lab_dir/plugins" --cache-dir "$lab_dir/cache" &&
cd "$lab_dir/plugins/marketing/chatgpt-advertising-experiment-plugin" &&
python3 scripts/run_mock_lab.pyOpen output/mock-evidence-bundle.json in the installed plugin directory. The sample records zero network calls and one valid test conversion. In a separate matching example, it finds two event records, removes one duplicate, and matches one business outcome. Check those counts before using the bundle to inform a review.
The lab exercises the evidence step. A live account read requires separate setup and verification, and the release has no live write adapter. To practise collecting report pages and handling missing results, try the separate Harness sample collector.
Monday morning checklist
Does the agent have its own identity, or does it inherit a person's credentials?
Can access be revoked without touching the human account?
Which gateway sees every outbound tool call?
Which actions require approval before execution?
Can the audit log separate agent activity from human activity?