Can you let AI agents run your marketing unattended?

The pitch for agent chains is a marketing team that works overnight. Ten agents hand work to each other, and in the morning the campaign is live.

The problem is not that the agents are bad at the work. It is that the chain has no idea which of its own steps are reversible.

Drafting is reversible. Acting is not.

A plan you disagree with costs you the two minutes it takes to read it. An email sent to 2,000 prospects cannot be unsent, a published page is indexed before you see it, and spent media budget is spent.

So the line here is drawn at exactly that boundary. Only draft steps execute inside a chain. Every step declares what running it actually does, and a step that would spend, contact or publish is converted into an approval item while the chain continues with everything else.

You come back to a finished set of drafts and a short list of decisions, rather than either a half-finished run or a fait accompli.

Why the runner enforces it and not the chain

This is the part that matters, and it is a design choice rather than a feature.

A chain is data: a list of steps somebody wrote. If the rule lived in the chain — "remember to mark the sending step as needing approval" — it would hold until the first person in a hurry. The runner would faithfully execute whatever the chain declared, and a chain that declared a send to be a draft would send.

So the runner never calls the execute path for a non-draft step, whatever the chain says. A chain cannot grant itself a permission it was not given, because the permission is not the chain's to grant.

That is the same reasoning as the rights check refusing to publish an asset with a missing right, and the campaign guardrail refusing a reward above the ceiling. A limit that depends on the author remembering is a documentation item, not a control.

The second limit, which catches the other failure

Unattended spend is capped per brand per day.

The draft-only rule stops a single catastrophic action. The daily cap stops the other shape of failure: a chain that loops, each iteration individually cheap and defensible, with nobody watching the total. One expensive action is noticed; four hundred small ones are not.

Two independent limits, because they fail differently.

What this costs you, stated plainly

You will press buttons. For somebody who wanted to hand the whole thing over, that is a disappointment, and it is better to be disappointed before paying.

What you get in exchange is that nothing in your name goes out without somebody reading it — which, for a small business where the owner's name IS the brand, is usually the thing they actually wanted and had not separated from the convenience they asked for.

And the agents still do the heavy part. Research, drafting, analysis, the first version of everything: that is most of the hours, and none of it needs a human until the moment of consequence.

The question to ask any autonomous-agent vendor

Which of your steps can take an irreversible action, and what stops them?

If the answer is a confidence threshold or a system prompt instructing the model to be careful, the control is advice. Ask where in the code the irreversible path is unreachable.