A marketing agent is not a writing assistant with a longer prompt.
The useful dividing line is operational. An assistant produces an artifact. An agent carries a bounded outcome from trigger to measurement, knows which decisions it may make, and stops when a decision exceeds its authority.
If a human still chooses every topic, assembles every brief, checks every link, moves every draft, and remembers to look at the results, the human owns the workflow. The model is a fast subcontractor inside it.
Give the agent a job with an end state
“Write content” is not a job. It has no finish line and no useful feedback loop.
“Publish a useful article for a demand generation leader, distribute it to opted-in readers, and learn whether those readers engage” is closer. It names an audience, an outcome, a distribution path, and a signal the system can observe.
The states the system actually moves through
A job with an end state implies a machine with real states. Here is the one this publication runs on. Not a metaphor: the actual gates.
| State | What it means | It leaves when |
|---|---|---|
| Draft | Content can still change freely | Machine checks all pass |
| Blocked | A check failed: an unsourced number, a prohibited source, a broken canonical link | The specific blocker is fixed |
| Validated | Checks passed; the exact version is frozen under a hash | The hash goes to a human |
| Awaiting approval | A human has the exact version and its risk summary | They approve that hash. Any edit resets it to Draft |
| Approved | That version, and only that version, may ship; approval expires after two days | The page is published |
| Published | The page is live and the system verifies it at the canonical URL | Verification passes |
| Sent | The email has left; this is the step that cannot be taken back | Never. It can only be measured |
| Paused | A stop condition fired; nothing publishes or sends | A human decides the underlying issue is resolved |
Every arrow in that table is a permission, and the order is load-bearing. A system that cannot name its current state cannot be audited, and a system that cannot be audited will not be trusted with the next increment of autonomy.
Move judgment into the constitution
Removing humans from routine execution does not mean removing judgment. It means deciding where judgment lives.
A reliable system writes the recurring decisions down: who the piece is for, what the publication believes, which sources are acceptable, which claims require evidence, what must never enter the prompt, and when the system must stop.
Those rules form a constitution. The agent reads it on every run. The human edits it when the system reveals a gap.
This changes the value of review. An edit should not die inside a document. It should become a proposed rule that improves the next cycle. Over time, the human reviews fewer artifacts because the system has learned more of the standard.
Approval should be a lock, not another work queue
Early in the rollout, a human should still approve every public package. But approval needs a precise meaning.
The article and its email belong to one package with one version hash. Approval applies only to that version. Any change invalidates it. Silence means wait. A generic thumbs-up on an older draft means nothing.
The agent does the preparatory work: research, drafting, claim classification, link checks, formatting, and risk summary. The human sees one compact decision: approve this exact version, request changes, or reject it.
That precision is what makes widening the delegation defensible later. A vague approval cannot be pointed at when something goes wrong.
Order actions by how correctable they are
An earlier version of this piece called editorial publishing “a reversible loop.” An external editorial review flagged the overclaim, and the reviewer was right. A sent email cannot be recalled. A published page cannot be unseen. Caches, archives, and answer engines may have read it minutes after it went live. A correction changes the page going forward; it does not un-happen the error.
What the loop actually has is a gradient of correctability, and the honest design principle is to sequence actions along it. Staging is fully private. Publishing is public but correctable. Sending is neither. So the page goes live first, the system verifies the expected title at the canonical URL, and only then may the email leave. The least correctable action sits behind the most gates, with the freshest approval. If verification fails, the email never leaves.
Blast radius is contained by ordering and by gates. There is no undo button, and a system designed as if there were one will eventually need the correction policy it did not write.
The stop conditions, specifically
“The system pauses when something goes wrong” is the kind of sentence that sounds like governance and specifies nothing. These are the actual stop conditions this publication runs, and any of them halts publishing and sending until a human clears it:
A validation blocker. A missing, expired, or invalidated approval, since any content change after approval invalidates it. A live-page verification failure, which specifically blocks the email step. A factual-error report from any reader. A confidentiality concern. A legal complaint. Uncertainty about send integrity, meaning not knowing exactly who would receive what. And a human kill switch that requires no reason at all.
Write your own list before your agent's first autonomous run. If a condition is not on the list, the system will not stop for it.
How this system failed in July
This publication failed against its own standard in July 2026, and the failure is more instructive than the design.
Two early articles passed every machine check (every number in the claims ledger, every source attached) and still shipped headlines that claimed more than their sources supported. A survey about who should own marketing agents was presented as proof that almost nobody runs them accountably. A study of buyer research behavior was stretched into a death certificate for the MQL. The validators verified what they were built to verify: numbers, sources, prohibited terms. Nothing verified the thesis against the ledger.
An external editorial review caught both. The system paused on its own stop condition, the pieces were corrected and republished, and the editor's notes are still on the pages, here and here, because a governed system should keep the receipts of its failures. The rubric gained a new gate: a headline must trace to a cited source or a labeled inference.
The general lesson: your gates catch what they were built to catch, and the next gate arrives by post-mortem. Owning the loop includes owning that.
Measure the loop the agent actually owns
A content agent cannot improve from applause in a planning meeting. It needs property-native signals tied to its job.
For an editorial system, useful signals include confirmed subscribers, verified clicks, direct replies, repeat visits, unsubscribes, complaints, approval edits, and failed deployments. Those signals tell the agent whether the audience found value and whether the operation stayed trustworthy.
The scorecard also needs a human-cost metric. If the system ships good work but consumes an hour of repair every day, it has not removed the human from the loop. It has hidden the loop in cleanup.
The goal is exception-based management
The steady-state interface should be quiet.
The agent runs the ordinary cycle. The human receives an exception when a claim is ambiguous, a boundary is crossed, a provider fails, or a policy decision is genuinely new. A weekly scorecard shows whether the system is earning more autonomy.
That is the experiment behind this publication: not whether an AI can produce another article, but whether an agent can operate a useful, inspectable marketing loop without making a human carry the work.
Editor's note, July 2026: this piece was revised after an external editorial review. The original called editorial publishing a reversible loop. It is not, and the section above now says why. This version also replaces an abstract description of system state with the actual state machine, enumerates the real stop conditions, and documents the publication's own July failure. How we handle corrections is described in our corrections and sourcing policy.