15 min read
When the Agent Started Writing the Machine Instead of the Campaign
A two-week edition. There is no week 34 issue, the gap is a planned skip, so everything between the fourteenth and the twenty-seventh of August is here.
Two weeks ago I wrote that the question for any vendor with an MCP server had stopped being whether they had one, and had become how many tools it exposes, which of them write, how long a session lasts, whose permissions it inherits, and how you revoke it. I thought that list would hold for a while.
It held for five days.
Between the nineteenth and the twenty-seventh of August, three platforms on my watchlist gave an agent write access to something none of those five questions was really written for. Not to a campaign, and not to an audience, but to the configuration of the system itself.
TL;DR
- Three platforms gave an agent write access to configuration in eight days, and none of them published a session lifetime or a revocation path. Salesforce Data 360 MCP on the nineteenth, Braze Operator on the twentieth with a setting that removes the confirmation step, Tealium’s Configuration MCP on the twenty-sixth. Salesforce scores best, with permission inheritance and per-user attribution in writing.
- A configuration error does not surface the way a campaign error does. Every campaign downstream behaves exactly as configured, against a definition that is quietly wrong, so nothing breaks and nothing alerts.
- The Dutch data protection authority put 824,990,000 euros on the absence of a human, fining Uber for solely automated deactivations and, separately, for not telling drivers the decisions were automated.
- Optimove and OpenAI published actual write boundaries, and everyone else published capability lists. Create-only, no edit, no delete, manual activation, in a note underneath a feature bullet from the smallest vendor on the list.
The fortnight the write scope moved from the campaign to the configuration
Take them in the order they landed. On the nineteenth, Salesforce took its Data 360 MCP server to general availability, exposing roughly two hundred APIs to agents that can build semantic models, transform data and create audience segments, and expanded Headless 360 into an open beta spanning every cloud from Marketing to MuleSoft. On the twentieth, Braze made Operator generally available, the partial case rather than the pure one: it creates and edits Canvases from a natural-language description, which is campaign work, but it also navigates itself to whichever dashboard page it needs and acts on user import, predictions, admin and settings, which is not. It ships with a setting called Auto-approve actions that removes the confirmation step before each of those moves. And on the twenty-sixth, Tealium shipped a Configuration MCP whose release note says, without hedging, that it lets AI agents read and update your server-side profile configuration using natural language, to explore configuration, make changes and implement new use cases without navigating the interface.
Three layers of the stack, one direction of travel. Engagement platform, customer data platform and enterprise platform each decided within eight days that the natural next thing for an agent to write is the thing that decides how everything else behaves.
None of the three published a session lifetime or a revocation path. Salesforce comes closest and deserves the credit: its documentation states that object permissions, field-level security, sharing rules and permission sets all apply, that every transaction runs as the authenticated user through an External Client App carrying the mcp_api scope, and that the audit trail attributes each action to that user. That answers permission inheritance and adds attribution, which none of the five questions thought to ask for, and it is the best score here. MoEngage’s thirty days, or seven days idle, published back in July, remains the only session-lifetime number any vendor on this watchlist has put in writing, and it is now six weeks old.
A lesson about the metric I have been using. Klaviyo’s answer to how many tools is more than two hundred and sixty; Salesforce’s answer is four, dispatching over two hundred APIs and a skill library the agent discovers at runtime. Same blast radius, an order of magnitude apart on the number. What governs is what the dispatch tool can reach, which is precisely the number nobody publishes. The closest proxy appeared in Salesforce’s newly readable change log, which recorded over a hundred additional objects becoming reachable in Setup in a single week.
A bad campaign is visible. A bad configuration is not.
This shift matters because of an asymmetry in how the two errors surface.
A Canvas an agent builds badly is caught within a week, because someone reviews it before launch, or the numbers look wrong, and the fault sits in an object a marketer can open and read. A server-side profile configuration that has been changed slightly wrongly is a different animal, because every campaign downstream then behaves exactly as configured, which is to say correctly, against a definition that is quietly incorrect. Attribution drifts, a trait computes on the wrong window, an enrichment fires on a subtly different trigger than the one somebody meant. Nothing breaks, nothing alerts, and the error is invisible from the campaign because the campaign is not where it lives. This is the architecture you cannot see that I keep coming back to, and an agent with a natural-language interface to it is a genuinely new way to change it without anyone noticing that it changed.
Tealium’s other release in the same forty-eight hours sharpens the point. AI enrichments apply LLM-based processing to real-time events, configured with a prompt, a trigger, and named input and output attributes, and the generated output becomes a new event available to audiences, connectors and downstream activation. That places a model inference inside the real-time event path and puts its output into segmentation, so latency, determinism, cost per event and auditability stop being campaign properties and become properties of the event stream, which is a different team, a different runbook and usually a different budget.
Matthew Niederberger asked the adjacent question at Martech Therapy this fortnight: when two systems disagree about a customer, on something as simple as email opt-in status, which value wins, and is that rule written down anywhere. In packaged systems the vendor decides, in composable systems your data team does, and most organisations have never made the choice explicitly. This fortnight adds something worse than an undocumented rule. If an agent can update the profile configuration in one platform while another creates a segment in a second, the precedence rule is not merely unwritten, it is being changed at runtime by software nobody watched.
Where somebody did write the boundary down
The silence is not universal, which makes it a choice.
Tealium drew the line inside its own product. One day after the Configuration MCP it shipped Studio, an AI chat interface for asking natural-language questions about the same server-side profile configuration, described in the release note as giving permission-aware responses without modifying or publishing changes. Two agent surfaces over one system, twenty-four hours apart, one of them explicitly read-only. The same engineering organisation showed in a single week that read and write surfaces are separable when somebody decides they should be.
Optimove went further, in a note underneath a feature bullet that is easy to scroll past.
Missions are created as drafts, so you activate them manually after review. Optimove MCP cannot edit or delete existing Optimove Gamify entities.
Create-only, no edit, no delete, and a human activation step between the agent’s output and anything reaching a customer. That is the most precise published write boundary on this watchlist, from the smallest vendor on it, expressed as a constraint rather than a capability list. Optimove also states that new Gamify features arrive with MCP capabilities unless stated otherwise, a reasonable engineering default that a buyer should know about.
And in a different market entirely, OpenAI published the governance model for exactly the same architectural move. Its Admin plugin lets an agent manage members, control feature and model access by role, and adjust usage limits and spending approvals, and the announcement states that it works within each user’s existing permissions and grants nothing broader, that each instruction maps to a supported read or write action returning a structured result, that approval requirements are honoured, that every change records what was requested, whether it completed and what changed, and that actions with broader impact can be reviewed before they are applied. I have written more about it in the AI edition, but those five sentences belong here too, and nothing in them is hard to build. This is a disclosure gap rather than a capability gap, and disclosure gaps close when buyers ask for numbers instead of accepting adjectives.
Eight hundred and twenty-five million euros for the missing human
On the twenty-first of August the Dutch data protection authority fined Uber 824,990,000 euros for taking fully automated decisions about drivers. Software tracked driving behaviour and customer ratings, and where it detected suspected fraud, or where ratings fell too low, accounts were deactivated automatically, with the driver’s income through the platform stopping for the duration and no human assessment at any point. The conduct ran from 2018 to 2022 and has ended.
The authority found two violations rather than one: the prohibition on fully automated decision-making, and separately a failure to adequately inform drivers that the decisions were being made automatically. That second ground is the one most likely to reach a marketing organisation first, because transparency about automated decisioning is a documentation problem rather than an architecture problem, and it is usually nobody’s job.
This is not a marketing case, and I would not report it as one except for what it prices and when. In the same fortnight that three platforms shipped agents which decide and act inside marketing systems, and one of them added a setting to remove the approval step, a regulator issued the largest penalty I have seen for the absence of a human in a consequential automated decision. The exposure attaches to whether a decision was solely automated and whether it produced legal or similarly significant effects on a person.
Most campaign decisioning, suppression from a channel included, does not clear that bar, and it is worth being calm about that. Eligibility decisions, individualised pricing, the withdrawal of an offer a customer relies on and anything touching account status increasingly might, and most vendors here now ship an agent that can reach at least one. A quieter item from the same regulator sharpens the incentive: from the first of September it must publish its sanctions by law rather than by policy, and a complete enforcement record is a better argument than a discretionary one.
Pega alone shipped in the opposite direction in the same window, with configurable explainability in T-Switch, a Customer Profile Viewer, and an Ethical Bias Check that runs before deployment rather than after an audit, the only release this fortnight that treats explainability as a shipping feature rather than a diligence questionnaire.
The approval click stops being a control the moment it becomes routine
Put two releases side by side and the fortnight gets uncomfortable.
On the seventeenth, Anthropic removed the option to allow all browser actions from its permission cards, leaving per-website approval as the coarsest grant available, and the following day it added a short delay to computer-use permission prompts because a send keystroke aimed at the message box could previously land on the prompt and approve it. Two days after that, Braze shipped a setting whose purpose is to stop asking.
I have written about the design side of that contrast in the AI edition. What concerns me here follows from the Dutch decision above, which turned on whether a human was in the loop and on whether anybody could demonstrate it afterwards.
An approval prompt produces a log, and a log looks like evidence. But a prompt that fires forty times an hour produces a log of approvals granted in under a second by someone who cannot possibly have read them, which is evidence of habit rather than of human involvement in any sense a regulator would recognise. If your organisation ever has to show that a person was meaningfully involved in a consequential automated decision, the artefact you want is a small number of approvals that took time, on decisions worth stopping for.
Which makes an auto-approve switch a governance decision rather than a convenience setting, and it should be recorded as one, with a name and a reason.
Quiet hours turned into a policy object
This is a smaller item with a larger consequence.
Adobe added Quiet Hours to Orchestrated Campaigns as time-based exclusions defined for preference and compliance reasons, and two days later Braze shipped workspace quiet hours in early access, setting a default window per messaging channel across an entire workspace, respected in each recipient’s local time zone by every campaign on that channel, with a per-campaign opt-out. Iterable got there first, shipping default quiet hours for new SMS campaigns in June, so what changed this fortnight is the scope rather than the idea.
The architectural difference between the two shapes is larger than it looks. A quiet-hours rule that lives on a campaign is an execution setting: every new campaign has to re-declare it, every new hire has to learn it, and no audit can enforce it, because there is no object to audit. A quiet-hours rule that lives on the workspace with an explicit opt-out is a policy object: it has a default, it has exceptions, and the exceptions are enumerable. New York’s restrictions on overnight push notifications to under-eighteens, covered when they landed, are precisely the kind of obligation that cannot be met by asking every campaign owner to remember something.
Anything you enforce by convention across campaigns is a candidate for the same treatment, and the list is longer than most teams expect once they write it down: frequency caps, channel eligibility, consent-purpose scoping, suppression windows around service messages. If the only place a rule exists is in the heads of the people who build campaigns, it is not a rule.
The agent that reads a journey instead of writing one
Most of the agents this fortnight were given something to build. Iterable, on the eighteenth, gave its agent something to read, and I think that is the more useful product.
Journey Summary keeps a standing description of every saved or published journey, built from its tiles, entry and exit rules, webhooks, live data and labels, so that Nova Agent can answer three questions about it: what this journey does, who goes where and why, and, the interesting one, what you should watch out for, with Iterable naming the examples as entry criteria that are too broad and exit rules that are missing.
Anyone who has inherited a mature instance of Braze, Iterable or Journey Optimizer knows that building journeys was never the hard part. The hard part is that nobody can tell you what the three hundred live ones do, which two are competing for the same audience on the same morning, or which one has no exit criteria and has been quietly re-messaging the same cohort since the campaign manager who built it left. That is why audits of an existing stack take as long as they do.
An agent that writes journeys makes that problem larger, and faster. An agent that reads them, explains them and flags their design faults is the first tool anyone has shipped that makes it smaller. Only one of the two can run unattended without a governance conversation first, and if you are choosing where to point an agent in a stack you did not build, point it at the audit rather than the authoring.
What to ask on Monday
Three questions and two dates, and then one thing from outside the watchlist entirely.
Ask every vendor whose agent can write to answer the five sentences OpenAI published above: permissions inherited and nothing broader, every instruction mapped to an enumerated read or write action, approval requirements honoured, a per-change record, and review before high-impact actions apply. If the answer is a capability list, you have learned something. Ask whoever owns decisioning for a written inventory of decision types, noting for each whether a human is in the loop, what evidence records it, and whether the person is told the decision was automated. And ask whether your approval prompts are rare enough to mean anything.
The two dates are near. Marketo removes the access_token query parameter on the thirty-first of August, so any REST integration still authenticating by query string stops working this week. And Gmail is rolling out warnings on non-HTTPS links by the end of October, which Twilio gave as its reason for shipping automatic SSL provisioning on SendGrid link branding. That is every branded tracking domain at every ESP, and it belongs with everything that starts before the send.
The outside item was in no vendor release note I monitor. ChatGPT Ads expanded to thirty-one European countries including Italy this fortnight, and the market entry is not the part that matters. The platform now runs conversion-optimised bidding, supports custom audiences, and reports through an OpenAI Pixel, a Conversions API and third-party measurement integrations, which is the standard interface between an ad platform and a marketing stack rather than the kit of an advertising experiment, and it puts OpenAI inside every conversation about server-side tagging and consent scope. The questions that follow are not media questions: does that pixel run through your tag manager and your consent framework or around them, and which consent purpose covers it.
The record for the fortnight is in MarTech Watch, Week 35.
The agent stopped writing campaigns and started writing the machine that runs them, and the clearest account of what it may not touch came from the smallest vendor on the list, in a note underneath a feature bullet.
Sources
Agent write surfaces
- Tealium release notes, 2026. Configuration MCP and AI enrichments (26 August), Tealium Studio (27 August). Dates confirmed against the Atom feed.
- Braze, 20 August 2026 release. Operator general availability, dashboard navigation, Auto-approve actions, workspace quiet hours.
- Salesforce, expanding Headless 360. Data 360 MCP general availability, Headless 360 open beta, Agent Skills.
- Salesforce Headless 360 MCP documentation. The four-tool contract and the published permission model.
- Salesforce Release Note Changes. The weekly log recording over a hundred additional objects in Setup.
- Optimove What’s New, August 2026. Optimove Gamify in Optimove MCP, and the published write boundary.
- OpenAI, Introducing the Admin plugin. The five published governance guarantees.
Regulation
- Autoriteit Persoonsgegevens, Uber fine, 21 August. The amount, the two violations, and the 2018 to 2022 period.
- Autoriteit Persoonsgegevens, mandatory publication of sanctions, 27 August. Effective 1 September 2026.
- CNIL note on the Uber sanction, 24 August. The cooperating authority’s publication.
- Pega, responsible AI capabilities and the Gryphon partnership, 18 August. T-Switch, Customer Profile Viewer, Ethical Bias Check.
Orchestration and content
- Adobe Journey Optimizer release notes. Quiet Hours and send using waves (18 August), fragment count limits blocking publishing (25 August).
- Iterable 2026 release notes. Journey Summary (18 August), and default quiet hours for new SMS campaigns (June).
- Anthropic Claude Desktop changelog. Removal of the allow-all browser actions option (17 August) and the computer-use prompt hardening (18 August).
Deadlines and the media layer
- Adobe Marketo Engage release notes. The
access_tokenremoval on 31 August 2026. - Twilio changelog. SendGrid automatic SSL provisioning, and Gmail’s non-HTTPS link warnings from the end of October 2026.
- OpenAI, ChatGPT Ads expands across Europe. Thirty-one markets, oCPC, custom audiences, OpenAI Pixel and Conversions API.
Analysis referenced, not used as a source of fact
- Martech Therapy, on which context wins when two systems disagree. Matthew Niederberger, 24 August 2026.
The digest behind each weekly article is produced through a structured AI-assisted scan of official release notes and product update sources. I review the output, verify the relevant signals and write the architectural interpretation.
This article draws from the Martech Weekly Digest scans run on August 27, 2026, covering the two weeks from 14 to 27 August across several CEP platforms and vendors. The dated record behind it is in MarTech Watch, Week 35.
If you find errors or gaps in coverage, I want to know. The process improves when the output is challenged.
