Software that runs a marketing operation unattended — publishing, auditing, drafting, reporting — inside rules you write, with every decision logged before you hear about it. Not a chatbot. Not a prompt in a spreadsheet. A policy envelope with deterministic guardrails around a model, and an assertion that fails loudly when the output is wrong rather than merely absent.
A model will happily write you a caption about the wrong product, quote a statistic it invented, or publish something your regulator would take an interest in. It will do all of that fluently, at three in the morning, and report success.
We know because it happened here. A caption for one Moldovan wine was published over a photograph of a different one — two real producers, two real products, one wrong join. Nothing in the pipeline caught it, because the pipeline only checked that something published, not that the right thing published.
That is the entire difficulty, and it is not solved by a better prompt. It is solved by putting the model inside something that can refuse it.
Every agent we build has the same four parts, and the model is only one of them.
A charter you control. Behaviour lives in a document, not in code — voice, cadence, spend limits, what it may never do. Edit the document and the behaviour changes on the next run. No deployment, no developer, no ticket.
Deterministic guardrails. A layer that runs before every single action with no model call and no judgement: blocked terms, spend caps, rate limits, channel health. If a check fails, the action does not happen. It cannot be talked round, because there is nothing there to talk to.
Adversarial self-review. Every piece of creative is handed to a second model instance whose only instruction is to find reasons it should not go out — tone drift, implied claims, generic filler. It fails closed: a review that cannot be parsed is a failed review.
An audit row per action. Everything it does is written down, with the reasoning attached, in a place you can read and reverse.
Both were built for our own businesses first. We do not sell an automation we have not had to live with.
Each of these exists because something went wrong without it.
A green deploy publishing the wrong caption looks identical to a green deploy publishing the right one. Every agent carries an assertion that fails on wrong output, not only on no output.
A check whose input could not be read reports unknown, never green. A monitor that answers "all fine" because its data source timed out converts an outage into a reassurance, and nobody looks again.
An agent that should have acted and did not is indistinguishable from one that cannot. Deploy health says nothing about it — a service can be running, scheduled and publishing nothing at all while every infrastructure signal is green.
No silent work. Every outbound action writes a row with its reasoning before you hear about it, and anything in that log can be reversed.
"Restarted it and it works" is a deferral wearing a fix's clothing. Reproduce, write the cause down, fix the class of problem, add the assertion, verify.
One concern at a time. We do not refactor an unrelated part of your stack while fixing a bug in this one.
Recent example, on our own properties. An audit of seventeen pages across two sites found Google Analytics and the Meta Pixel firing at page load, before any consent choice — while one of the privacy policies stated in writing that analytics cookies were only set after acceptance.
The remediation was Consent Mode v2 with storage denied by default, the cookie banner's own categories mapped onto it, and the pixel initialised in a revoked state. One detail mattered more than the rest: the Meta Pixel discards events sent while consent is revoked rather than holding them, so firing PageView at page load loses it permanently for every visitor, consenting or not. It now fires from the consent handler instead. The result is fewer sessions counted and every one of them lawfully collected.
That is the shape of the work. Not a policy document about AI governance — a specific defect, a mechanism, and a test that proves it is fixed.
Four stages. You can stop after any of them.
It can be made to refuse categories of thing outright, at a layer with no model in it, which no instruction and no approval can override. Beyond that: everything is logged and everything is reversible, and it runs in dry-run for as long as you want before it publishes anything at all.
No. You need to be able to read a document and tick a box. The charter is written in plain language because it is the thing you will actually maintain, and an automation that needs daily babysitting is a failed automation.
You will know, because it wrote down what it did. Then it gets a cause, a fix for the class of problem rather than the instance, and a test that fails without the fix. That is why there are 484 of them.
Not on our build. Cold outreach drafting is permanently capped below sending: two independent locks, one of them a human tick. UK GDPR and PECR are built into whether a message can render at all, not bolted on as a checkbox at the end.
The model writes and proposes. It does not decide whether an action is permitted, whether a claim is substantiated, whether the spend is within cap, or whether the picture matches the copy. Those are deterministic checks, and they are the reason the thing can be left alone.
Scoped per engagement, because a single-channel publishing agent and a full audit-and-outreach pipeline are not the same piece of work. The audit stage is quoted on its own so you can find out what is wrong before committing to anything larger.
Tell me your current spend and target, and I'll come back with what I'd change first — usually before we even get on a call.
Or write directly — office@sagorra.co.uk