AI agents for marketing: where they fit in a local business

AI agents for marketing earn their place where the work is reading and writing: drafting replies to enquiries, sorting leads, summarizing reviews, and writing first drafts of evergreen posts. Where a step can be written as a rule, a plain automation is cheaper and more predictable. In both cases, the setup around the agent (what it can read, what it can do, and who approves) matters more than which model you pick.

That setup is called the harness: the loop, the tools, the permissions, and the checks. It also includes the person who approves what goes out under your name. This post sorts common marketing tasks into "rule" and "agent", explains the harness in plain words, and lists the steps to set one up safely.

What an AI agent is, in plain words

An AI agent is a setup in which a language model works through a task in steps. You give it a goal, such as "answer this enquiry", and a few tools it can use, such as reading your price list or saving a draft. The model reads what it has, picks a next step, uses a tool, looks at the result, and decides what to do next. The loop keeps going until the task is done or it reaches a limit you set.

Anthropic, which makes the Claude models, puts it the same way in its guide Building effective agents. Agents are systems where models "dynamically direct their own processes and tool usage", and they are "typically just LLMs using tools based on environmental feedback in a loop".

Say a parent writes to a day camp asking whether the August session has space and whether siblings get a discount. An agent handling that message would:

1. read it and find the two questions;
2. look up August availability and the sibling policy in the camp's source document;
3. write a draft that answers both;
4. check the draft against the camp's rules, such as quoting only listed prices and never promising a spot;
5. leave the draft for a person to approve.

The model picked those five steps itself, based on what the message asked.

That flexibility has a price. The same guide notes that agentic systems "often trade latency and cost for better task performance", and it advises finding "the simplest solution possible". For a local business, an agent goes on the tasks that need reading and judgement, and a plain rule handles every step you can write down in advance.

Rule or agent: a sort for each marketing task

Here is how we sort the common jobs in a local business's marketing system, and where an agent actually helps. The test is simple. If you can write the step as "when X happens, do Y", use a rule. If the step needs someone to read free text and make a judgement, an agent can help, as long as a person checks the result.

Notice the split inside a single enquiry. The confirmation is a rule, so it goes out at once. The considered answer is drafted by an agent and then approved by a person. That way follow-up stays on time, and nobody sends a reply they haven't read.

The harness: loop, tools, permissions, and checks

The model only produces text, while the harness is everything around it that turns text into work: what the model gets to read, which tools it may use, when it must stop, and who checks the result.

Anthropic describes the loop at the centre of a harness as "gather context -> take action -> verify work -> repeat", in its post on the Claude Agent SDK. For a reply to an enquiry, the loop looks like this:

1. Gather context. Read the enquiry, your price list, your hours, and your policies.
2. Take action. Write a draft reply, or label the lead.
3. Verify work. Check the draft against rules, such as "only prices from the list" and "never the word guarantee".
4. Repeat or stop. Fix what failed, or hand the draft to a person.

A harness has four parts worth naming when you set one up:

• Tools: what the agent can touch, such as reading the inbox, reading a policy document, or writing a draft. Each tool is a door you choose to open, so open as few as the job needs.
• Permissions: which of those tools need a person's approval before they run. Sending, publishing, and changing a booking should.
• Checks: tests the output must pass before anyone sees it. The same Anthropic post says the best feedback is "clearly defined rules for an output", along with an explanation of which rules failed and why.
• Stop conditions: a limit on how many times the loop runs, which the Building effective agents guide describes as common practice "to maintain control".

Why the harness matters more than the model

Expect to be held responsible for what your agent says. In a February 2024 small-claims decision by BC's Civil Resolution Tribunal (2024 BCCRT 149), an airline's website chatbot told a passenger they could apply for a bereavement fare after travelling, which the airline's policy didn't allow. The tribunal ordered the airline to pay $812.02, including interest and tribunal fees. It found the company "is responsible for all the information on its website", and that "it makes no difference whether the information comes from a static page or a chatbot." The correct policy was on the same website, but the chatbot didn't answer from it.

A better model alone doesn't prevent that. A harness does more, because each layer catches a different failure: the agent answers only from the policy document, a check flags any refund or fare promise, and a person approves the reply. Marketing should only promise what the business can deliver.

Enquiries are also untrusted text. The OWASP Gen AI Security Project lists prompt injection first (LLM01) in its Top 10 risks for language-model apps: text from outside, such as a website or a file, can change how the model behaves. A contact form, for instance, is exactly that kind of input.

OWASP's advice is a harness decision rather than a model choice. Restrict the model's access "to the minimum necessary", and use human-in-the-loop controls for privileged operations. An agent that can only write drafts can't be talked into sending anything on its own, and the person approving still reads every draft.

Finally, models change often, so you'll likely switch at some point. The harness is the part you own: your policy document, your checks, your approval step. Built well, it carries over to whichever model you use next.

How to set up AI agents for marketing safely

These steps work whether you build on a general automation tool or a custom setup. They follow the same pattern as the table above: start narrow, keep a person on anything public, and widen only what has earned it.

1. Pick one task and write down what a good result looks like. For a camp, that might be "a reply to enquiries that answers the question, gives the right session dates, and invites a call." One task, one page of criteria.
2. Give it one source of truth. Put prices, hours, session dates, policies, and service areas in a single document. Tell the agent to answer only from it, and to say "I'll check and get back to you" when the answer isn't there.
3. Start with draft-only permissions. The agent can read and write drafts, but it can't send, publish, or book. If you run a clinic, ask your privacy advisor what patient information may go to an outside AI service before you connect your inbox.
4. Add an approval step. Mainstream tools now have one built in. Zapier's Human in the Loop step pauses a workflow until a reviewer approves, declines, or edits the content. It needs a paid plan, and on the Professional plan requests can only go to yourself; sending them to a colleague takes a Team or Enterprise plan. In n8n, human review for tool calls means an agent's chosen action runs only after a person approves it.

Checks, limits, and a weekly review

Once drafts flow to a person, the next three steps keep them honest over time.

5. Write checks a rule can run. Block prices outside the list, the word "guarantee", and dates that aren't in the document, and set a length limit. Rules catch these every time, while a person catches tone.
6. Cap the loop and keep a log. Set a maximum number of attempts, and record every draft, every check result, and every approval. When something goes wrong, the log tells you which part failed.
7. Review the log weekly for a month. Loosen a permission only when the drafts have stopped needing edits, because each loosened permission is one less check on what goes out. Some tasks will never get there, and that's fine.

Evergreen content gets the same treatment

The same rules apply to blog posts and FAQ pages, with a different check. Google's guidance on generative AI content says AI can help with research and structure. However, it warns that producing many pages "without adding value for users" may break its spam policies, and it advises you to fact-check and review AI-generated content before publishing.

So a first draft from an agent is a starting point, not a post. The knowledge of your business is what makes the post worth reading, because nobody else has it.

Start with the system, not the tool

Most Canadian businesses haven't started. Statistics Canada reported in June 2026 that 19.2% of businesses had used AI to produce goods or deliver services in the previous 12 months, up from 12.2% a year earlier. Among those users, 19.8% used it for marketing automation. Two in five businesses (40.0%) said AI isn't relevant to them, and that rose to 41.4% among businesses with one to four employees.

There is no rush, then, to hand your inbox to an agent. The useful move is to look at your marketing as a system of websites, automations, and evergreen content first.

Some steps are rules that should already be automated. Others need reading and writing, and they're slow today because one person has to do all of them. An agent fits in the second group, inside a harness you control, with a person approving what goes out. This week, pick the enquiry type you answer most and write its one-page source of truth. That document is useful with or without an agent.

That is the difference between a system and a campaign. A campaign tries a new AI tool for a month and moves on. A system adds an agent to one step, checks its work every week, and keeps the rules that already work. Set up once. Then it runs. Then it compounds.