I'm Santosh Pradhan, a MarTech Solutions Architect in Munich, and the question I now hear most from marketing and architecture teams is no longer "which agent should we buy?" It is "what does our stack need before we let an agent act on it?" This post answers that question with a five-layer checklist.
Short answer: an agent-ready marketing stack serves fresh, resolved customer data in under a second, exposes tools through governed interfaces, gives every agent its own scoped identity, records why each piece of data may be used, and limits what an agent can commit the company to.
Why this is an architecture question now
In the week ending 29 September 2026, the marketing news was about agents entering the buying path. According to a weekly marketing agent roundup, OpenAI added Sponsored Agents to ChatGPT Ads, IAB Tech Lab published AAMP 3.0 (OpenProposal) for agent-to-agent buying in public comment, and Kana announced an agentic ad sales deployment at TIME.
The signal matters more than any single announcement. The unit of work is shifting from a generated asset to a delegated outcome, run by an agent that needs data, tool access, guardrails and an audit trail. Those are architecture concerns, and they stack in layers.
Layer 1: Data the agent can trust at the moment it asks
A batch CDP is forgiving: a segment refreshes at 02:00 and a stale attribute costs you a slightly off email. An agent reads the profile while a customer is typing and then says something about that customer in plain language.
A July 2026 Twilio comparison of CDPs for AI agents lists the requirements: sub-second profile access, identity resolution across email, phone, chat, web and purchase channels, streaming ingestion instead of batch, and APIs, SDKs or MCP-compatible endpoints agents can query directly. Treat that as a four-line acceptance test.
- Freshness. Streaming ingestion decides whether the agent knows about yesterday's purchase or this morning's chat.
- Identity. The agent receives whatever identifier the channel provides. Resolution must map any of them to one profile, or a returning customer is greeted as a stranger. The Golden Record Framework covers how to do this at field level.
- Latency. A mid-conversation lookup that takes seconds breaks the interaction.
- Access. The agent needs a governed interface to the profile, covered in layer 2.
CDP.com argues in "Identity resolution is table stakes in the AI era" that resolution is now standard and differentiation has moved to real-time reads, decisioning, native activation and feedback loops. I agree with the direction, with one caution: at agent scale, a few points of mismatch become thousands of wrong conversations. Measure match precision on your own data, per channel.
Layer 2: Tool access through MCP and A2A
Two protocols frame most enterprise agent designs, and they are complementary. MCP connects an agent to tools and data. A2A lets agents coordinate with each other. Both sit under Linux Foundation governance, and MCP lives in the Agentic AI Foundation, launched in December 2025 with Anthropic, OpenAI and Block as co-founders. The figures below come from this protocol comparison.
| Layer | Protocol | Job | Adoption signal |
|---|---|---|---|
| Infrastructure | MCP | Agent to tool and data connections | 10,000+ active servers, 97M monthly SDK downloads |
| Coordination | A2A | Agent to agent collaboration across boundaries | 150+ partner organizations, 3 SDK languages |
Sequence them. Standardize tool and data access through MCP first, exposing the CDP, CRM and ad platforms as MCP servers with scoped tools instead of raw tables. Add A2A only where agents cross team or organization lines. Standards like AAMP 3.0 imply your agents will eventually transact with a counterparty's agents, so approval thresholds and logging belong in the architecture, not in the prompt.
Layer 3: Agent identity and credentials
Agents need identities of their own. The same protocol comparison reports that 53% of MCP servers rely on static credentials instead of OAuth, and that CVE-2025-6514 exposed more than 437,000 installations to shell injection. Default to OAuth, least-privilege scopes per tool, short-lived tokens, and one identity per agent so every action is attributable.
Layer 4: Governance, consent lineage and action limits
Real-time access without scoped permissions turns a fast CDP into a fast leak. Governance has two separate questions: what data may the agent reason over, and what actions may it take on its own. The governance gap in agentic marketing goes deep on consent lineage and action tiering. The practical rule: no agent should execute an action that has no lineage trace for the data behind it and no tier for the action itself.
Brand exposure belongs here too. Six architectural patterns for agentic brand risk describes the failure modes that reach customers first.
Layer 5: Liability and the commitment surface
The last layer is the one most stacks skip. Once an agent speaks for the company, what it says can bind the company. The Commitment Surface examines what the Chevrolet and Air Canada cases mean for architects. Design for it explicitly: define which statements and transactions an agent may make, put hard limits on price, discount and policy claims, and route anything beyond them to a human.
A replay test you can run this week
- Pick ten real customers with multi-channel history, including at least two with duplicate or partial records.
- Give an agent one identifier per customer, varying the channel each time.
- Ask questions that need a purchase from yesterday and an interaction from the same morning.
- Record latency, correctness, and which identifiers the agent needed.
- Check what the agent was allowed to see and do. If it surfaced consent-restricted attributes or made an unapproved commitment, you have a governance gap, not a data gap.
What to fix first
If you have budget for one change, make it streaming ingestion for the two or three events agents ask about most, usually orders, support contacts and consent changes. Next, put each system an agent would touch behind an MCP server with OAuth and least-privilege scopes. Then add lineage tracing and action limits before any agent can commit spend or make a customer-facing promise. Revisit the CDP vendor question last: most "agent problems" I see are freshness and permission problems that a new platform would inherit.
FAQ
What does a marketing stack need before agents can act on it? Fresh resolved data, governed MCP access, agent identity, consent lineage with action limits, and a defined commitment boundary.
MCP or A2A first? MCP. Add A2A where agents cross organizational boundaries.
Do I need a new CDP? Usually not first. Fix freshness, identity coverage and permissions, then test your current platform with the replay method.
What is the main MCP security risk? Static credentials. Use scoped OAuth and least privilege by default.
