Agentic AI in Marketing Playbook

An AI agent is software that takes a goal, works out the steps and uses your tools to carry them out. In a marketing team, start with one or two workflows where the agent reads and drafts while a person approves, measure them on real work for six weeks, and give an agent more freedom only where the record shows it has earned it.

Most marketing teams already use AI assistants one prompt at a time. An agent is different: given a goal such as “summarize last week’s pipeline”, it plans the steps, pulls the data from your tools, writes the result and can act on it. That is what makes it useful, and also what makes it risky, because an agent that can act can act wrongly with whatever access you gave it.

Use is spreading, but unevenly. In McKinsey’s 2026 State of AI survey, 40% of respondents at organizations with $1 billion or more in revenue said they were scaling AI agents in at least one function, against 22% at smaller organizations^[1]. Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, because of rising costs, unclear business value or inadequate risk controls^[2]. Steps 1 to 7 deal with those three causes in about twelve weeks (Figure 1): choose work where the value is clear, put the controls in before anything runs, count the cost and decide on the evidence. Step 8 looks the other way, at AI agents that research and buy on your customers’ behalf.

Before choosing an agent, list the recurring work: campaign planning, content production, lifecycle email, reporting, lead routing, data clean-up. For each workflow, write down who does it, how many hours it takes in a normal week, which tools and data it touches, and what goes wrong. Ask the people who do the work as well as their manager, and include whoever owns IT and security, because they will set the limits in Step 3.

Then check the data an agent would read. An agent summarizing a pipeline is only as good as the CRM fields behind it: inconsistent campaign names, missing close dates or duplicate contacts come back as confident errors. Note where each data set lives, who can grant access to it, and whether your AI vendor’s terms let it train on what you send; the AI Tool Policy has a line for recording that answer. Then grade each workflow’s readiness: high when the data is clean and in one place, the steps are written down and one person owns the result.

Agents in marketing do four kinds of work. Research agents summarize call transcripts, reviews and competitors’ sites. Content agents turn a brief or a transcript into drafts of emails, landing pages and posts. Operations agents do rules-based setup and clean-up in your tools, such as UTM tags and naming conventions. Analytics agents turn performance data into a summary and suggested tests. Each workflow from Step 1 fits one of them.

Score each candidate from 1 to 5 on four things: impact, the hours freed or results improved; feasibility, clean data and tools an agent can reach; safety, how little harm a wrong output can do; and adoption, whether the people doing the work want it. Choose the one or two highest totals as pilots and the next as a backup. Workflows that write to customer records or reach customers directly score low on safety by design, so they wait until an agent has proved itself on safer work.

Agree the rules before you connect anything. Four decide most of the risk:

• Access. Which systems and data each agent may read, and which it may change. Give it its own account or key with only those permissions, never a person’s login.
• Actions. In a first version, let agents read, summarize, draft and prepare changes as proposals. Do not let them send email, publish, bulk-update records or touch sensitive fields.
• Review. Name the person who approves each output before it goes live or changes a system.
• Data and logs. What may never go into a prompt, such as customer lists, unannounced pricing, anything under NDA and credentials; what the vendor may keep; and a log of every action the agent takes.

Start narrow because an agent reads text you do not control. A web page, an email or a document can carry instructions the agent mistakes for yours, and it will follow them with the access it has. The 2026 edition of the OWASP Top 10 for LLM Applications keeps prompt injection as the first risk and moves excessive agency, an agent given more permission than its task needs, from sixth to third^[3]. Limiting what an agent can do limits what an injected instruction can do.

Some lines hold at every stage. Under the US Federal Trade Commission’s rule on consumer reviews and testimonials, in force since October 2024, a review or testimonial that misrepresents who wrote it or whether they used the product is unlawful, and that covers AI-generated ones^[4].

A spec turns a chosen workflow into something you can build and test. It has five parts:

1. Goal: one sentence with a deadline and a format, such as “Every Monday by 9:00, a one-page pipeline and campaign summary with three recommendations.”
2. Inputs: the data sources and fields it uses, and anything a person supplies, such as a brief.
3. Tasks and tools: each step the agent takes and the tool it calls for it: fetch, compare, draft, post.
4. Outputs: the format, the sections it must contain and where it goes.
5. Constraints and approval: limits on runs and retries, what to do when data is missing, who approves, and how to undo a change.

For the tools, use what your platforms already offer: built-in AI features and native connectors in your CRM or marketing platform, or connections through MCP, the open protocol most AI tools now use to reach other software (see Common questions). Each connection is a permission, so match it to the step on the staircase you chose in Step 3.

Build on tools you already pay for before buying new ones: your platforms’ own AI features, an automation tool your team uses, or an agent builder that connects to them. Test against last month’s data or a sandbox until the output meets the spec, and keep the test runs as the starting point for Step 6.

Then price it. Three costs matter, and the model is usually the smallest:

• Model usage: tokens in and out per run, times your provider’s price per million tokens, times runs a month, with room for retries and tests. The AI Inference Cost Modeler does this arithmetic.
• Platform fees: the automation or agent tool, and any seats it needs.
• People’s time: setting it up once, then reviewing and editing every output.

Put a spending cap on every API key an agent uses. An agent caught in a loop, or fed very large inputs, can run up a bill before anyone looks; OWASP’s 2026 list ranks this unbounded consumption sixth^[3].

Run each agent on real work for four to six weeks, on a limited scope such as one campaign type or one market. Shorter, and the first week’s fixes dominate the result; longer, and a pilot quietly becomes production without anyone deciding.

Log every run in one sheet: the date, whether the output was used as it was, edited or rejected, the minutes spent reviewing and fixing it, and any error or near miss. From the log, track three things:

• Time: hours on the workflow each week, review included, against the Step 1 baseline and the Step 5 plan.
• Quality: the share of outputs used with light edits, and what the reviewer had to fix.
• Risk: every wrong figure, invented claim or action outside the spec, however small.

Every fortnight, ask the people using it what works and what they work around.

At the end of the pilot, choose one of four outcomes for each agent: scale it as it is, scale it with changes, keep it in a limited pilot, or stop it. Decide from the log, not from a demo: time against the baseline and the plan, the quality of what was used, and every near miss.

Then update the rules. Give each agent an owner, who decides who may change its instructions and settings, reads the log every month and retires the agent when it stops paying for itself. Write a one-page guide for the people who use it, including its known failure modes. Move an agent up the staircase only where its log supports it.

Finally, choose the next one or two workflows: the backup from Step 2, or work next to what succeeded. Keep a short list of what agents will not touch yet, such as legal and compliance approvals, pricing, messages to customers without review and detailed personal data.

Agents are also arriving on the buyer’s side. In McKinsey’s 2026 B2B Pulse survey of nearly 4,000 decision makers in 13 countries, generative AI had moved into the top five channels buyers use to find and evaluate suppliers^[5]. Agents that complete the purchase are being built now:

• OpenAI’s Agentic Commerce Protocol, whose first payment implementation is Stripe’s, lets a merchant share a product feed and run checkout from ChatGPT while remaining the merchant of record^[6]. In March 2026 OpenAI said it would let merchants use their own checkout and focus on product discovery, rather than keep developing in-chat Instant Checkout as a standalone feature^[7].
• Google’s Agent Payments Protocol (AP2), announced in September 2025 with more than 60 payment and technology partners, records what a person authorized an agent to buy in signed “mandates”^[8]. Google’s Universal Commerce Protocol runs checkout in its own AI shopping features^[9].

These standards are young, still changing and built mostly for consumer retail. For a B2B company the work that pays now is simpler: make sure an agent researching for a buyer can read your site, find your price and take a next step without booking a call. In AAJ’s Agent Readiness Study 2026, at most 27% of 295 young B2B startups showed a price in the HTML of their pricing page, and up to 39% offered no next step but a demo or a sales call.

What changes by stage?

What mistakes should I avoid?

• Starting with “AI everywhere”. Pilot one or two scored workflows (Step 2).
• Giving a first agent write access. Start it on reading and drafting, with its own restricted account (Step 3).
• Letting an agent state numbers no one traced. Every figure names its source (Step 4).
• Pricing only the model. Count platform fees and review hours, and cap the spend (Step 5).
• Judging on a demo. Judge on four to six weeks of logged runs (Step 6).
• Leaving a pilot running with no decision. Scale, change, keep or stop each agent (Step 7).