Problem
Agencies want AI to look at every client’s leads, ads and SEO and say what to do next. The failure mode is an agent that narrates plausible-sounding advice without looking at the numbers, and the catastrophic one is an agent that acts on a client account it shouldn’t. Two structural problems, not prompt problems.
System
Agents per domain (leads, ads, SEO) run against a single tenant’s data, compute their metrics first (pipeline conversion by stage, cost per acquisition against baseline, open SEO issues by estimated traffic), and only then hand the numbers to a model to interpret. Findings come out ranked with confidence and severity: “only 25% of leads move from consultation booked to treatment planned, against 56% across other stages; 175 leads worth $494,720 have sat there 14+ days.” Proposed actions queue for approval, flagged when not reversible.
Worth knowing
Tenant isolation is structural: an agent instance is bound to one client and physically can’t query another’s rows. And the execution path can’t run an unapproved action, which is a property of the code rather than an instruction to the model. Those two properties are what make it something an agency could put in front of clients.