Separate reading, preparation and execution. Use limited permissions, action-specific review and an audit trail that shows what happened and supports correction.
Conversations about AI agents often begin with how much they could do independently. A business should start with another question: which decisions remain under human control, and which portions of the work can be prepared safely?
This guide addresses agents that research, draft or interact with marketing tools. It is not a recipe for bulk outreach or authorization to access accounts. It proposes an operating model that must be adapted to the business, the integration and the consequences of each action.
Define a task with a verifiable finish
“Acquire customers” is a commercial objective, not a sufficiently specific operating instruction. A more controllable task would be reviewing public information about ten businesses and preparing a summary with evidence, sources and questions for human review. The output can be inspected before anyone decides whether contact is appropriate.
Specify inputs, permitted sources, deliverable, acceptance criteria and stopping conditions. When information is missing, the agent should say so instead of turning assumptions into apparent facts. Define exclusions too: sending messages, changing budgets, publishing pages or editing records. Useful autonomy starts with clear boundaries rather than a broad instruction that implicitly delegates every subsequent decision.
Separate read access from write access
An agent preparing an analysis does not need administrative control of an entire advertising account. Define the minimum access required and who can revoke it. Where an integration supports the distinction, use specific permissions and appropriate service identities instead of sharing personal credentials.
OpenAI’s documentation recommends combining application controls with human review for consequential actions. Our practical implementation is an inventory of each tool, accessible data, permitted actions, responsible owner and access expiry. A sentence in a prompt does not replace technical controls. If an integration cannot be adequately restricted, start with exports or a test environment rather than granting broad access for convenience.
Sources: OpenAI Developers: Guardrails and human review · OpenAI Developers: Computer use integration recipes
Treat external content as information, not instructions
An email, webpage or document can contain text intended to redirect an agent. An instruction inside a source is not equivalent to authorization from the business owner. OpenAI describes this risk as prompt injection and recommends defenses throughout the workflow.
For commercial research, the agent should extract facts and cite their origin without obeying requests embedded in a prospect’s website. Keep evidence fields separate from task instructions. Test misleading documents and confirm that the workflow does not copy private data, change a message recipient or expand the task because an external source asked it to. Record unexpected behavior as a defect, not as initiative.
Approve a concrete action
A useful approval displays the final draft, recipient or destination, information involved and the change about to occur. Approving a strategy does not approve every later publication, budget change or message. If the content changes materially, the earlier review may no longer represent the intended action.
We recommend allowing reversible preparation and pausing where an external consequence begins. Preparing three advertisement variants is different from activating them with spend. The workflow must also distinguish completion, failure and a pending action. An optimistic sentence from an agent is not proof that a tool executed correctly. Review the resulting state or a dependable confirmation before recording the action as complete.
Illustrative example: preparing an audit
Imagine an agent reviewing a public URL and identifying a possible mismatch between an advertisement’s promise and the landing page’s explanation. It saves evidence and drafts an observation for a person to verify. This hypothetical scenario does not describe an automation deployed for a Patagonia client.
The reviewer confirms whether the mismatch is real, corrects the wording and chooses the next step. The agent can assemble approved findings, but it must not invent lost revenue or imply access to a prospect’s private performance data. It should not send the report without authorization for that action. A useful commercial conversation begins with an accurate observation, not an exaggerated diagnosis.
Test difficult cases and a recovery path
Before expanding use, test incomplete inputs, contradictory sources, expired permissions and tool failures. Record what the agent requested, what the integration actually executed and what the responsible person saw. Keep secrets and unnecessary personal information out of test logs.
Choose a small task, review every early result and establish how to stop the workflow. Preserve recoverable versions for published changes; for data operations, document how to correct an error without erasing the history of what happened. Measure time saved together with errors and review effort. A successful pilot establishes one bounded capability, not that the agent is ready to manage every aspect of marketing without supervision.
REFERENCES
Sources and review
Source documentation consulted on October 24, 2026. Platforms and features may change; check the official source before implementation. The English adaptation retains the source review date of the original article.
- Guardrails and human review OpenAI Developers
- Safety in building agents OpenAI Developers
- Computer use integration recipes OpenAI Developers
This guide provides general guidance. It does not guarantee search rankings or replace a review of your business, locations and data.