Notes on building agents that touch the real world.

When your ad lands next to a live decision someone is working out with ChatGPT, the job of the creative changes. It has to be the next useful step, not an interruption and not a slogan. Break the conversation on the click and you paid to frustrate someone at the worst possible moment.

Paid search was built around a query. Social was built around an audience. The ads showing up inside ChatGPT are built around something else: a decision in progress. For real estate and lending, that's a moment the other two channels can't reach.

Your website can say you're the number one first-time-buyer lender in town. An AI treats that as marketing copy. What actually moves it is whether the rest of the web says something similar when you're not the one talking.

For two decades, marketing online meant ranking on a page of links. More people now ask an AI to just tell them who to call. The page of options collapsed into a short answer, and being on the page and being in the answer turn out to be different games.

The cheapest lead is usually the most expensive one. A form that's easy to fill out fills up with people who never buy, cost-per-lead is the metric that hides it, and the honest number lives one step deeper in the funnel.

Google and Meta are not two versions of the same thing. One meets people who are already looking. The other interrupts people who aren't. Judging them by the same number is how you misread both, and how good budgets get cut in exactly the wrong place.

Meta can generate leads, and Meta can retarget. Those are two different jobs, and most accounts lean on the wrong one. For real estate and lending, Meta usually earns its keep as a retargeting engine, not a cold lead machine, and understanding why saves a lot of wasted spend.

The last click gets all the credit and did almost none of the work. In real estate and lending, the click that closes is the last page of a story that started months and many touches earlier. Here is why last-click misreads the whole journey, and what it costs you to believe it.

The most underused move in business-to-consumer marketing is the one that shows up in a mailbox. Account-based marketing's oldest play was always physical, and it still works when it's coordinated, targeted, and timed to the same signals as your ads.

Most ad accounts are obsessed with who to show ads to. The bigger lever is usually who to stop showing them to, and the account that ignores it quietly pays to advertise to its own customers.

In real estate and lending, the deal is often half-decided before anyone talks price. It's decided by who called back first. A lead five minutes old and a lead an hour old are not the same lead, and the gap between them is where most of the ad budget quietly goes to waste.

This blog reads like it's about building AI agents. It isn't, not really. Every crash story and guardrail here was a piece of a marketing system I build for real estate and lending operators.

The ad platforms have a definition of a conversion, and for real estate and lending it's usually the wrong one. A form fill is not a sale. Here is how we move the finish line to where the business actually is, and what it costs to do it right.

For years the proof that tracking worked was 'the tag is in the page source.' That proof passes even when the tag never fires. So I stopped checking the HTML and started asserting the actual network beacon.

I built a command-line flag to skip a fair-housing warning. An automated review gate made me delete it and turn the warning into a rule no flag can switch off. Some boundaries should not have an override.

Most marketing reports are built to make the marketer look good, not to tell you the truth. The only question that matters is the one they skip: did this produce business? Here is how we report so the dashboard and the pipeline finally agree.

The worst marketing failures are silent. A pixel stops firing, a feed breaks, a campaign runs away, and nothing screams. You find out at month-end, when the report is empty or the bill is high. Here is why we look every single day, and what we look for.

A campaign is not a crockpot. Left alone, an ad account drifts, and it drifts in the platform's favor, not yours. Here is how that drift actually happens, and why we audit every account, every week.

Your account probably has a dozen things marked as conversions. The algorithm can only chase one of them well. Every conversion you let it optimize toward is a vote for the kind of customer you get more of, and most accounts vote for everything.

The smartest thing an anomaly detector can do is nothing, in the sense that it never touches a production account itself. It hands the finding to a table, and something else, under its own policy, decides whether to act.

For months I wrote about 'an agent framework' instead of naming one. That wasn't a style choice. It was cover for a decision I hadn't made: LangGraph, Google ADK, or PydanticAI, and which career each one actually bet on.

The design question that came out of a crashed orchestrator: how do you let an agent run unattended without ever giving it a decision to make? A closed decision table, four failed review rounds, and the line between orchestration and judgment.

Four fences is a lot to get right, and you do not get to get them right once. You get to get them right on every project, forever. So I stopped rebuilding the security and started inheriting it.

You can put three fences on the way in and still leak, because the agent legitimately fetched data it was allowed to and then said it to the wrong person. The breach is on the way out, and nothing inbound was ever going to catch it.

You can assume the agent is hostile and hand it only a small set of capabilities, and it will still try to read the wrong tenant's row. The fix is not a better prompt. It is three fences that sit below the agent, on the way in, none of which trust it.

For a while I answered every new jailbreak by hardening the prompt. That is a game the attacker moves last in. Capability security is how you leave it: make the agent's authority something it holds in a small, fixed amount, not something it can talk its way into.

I put a careful rule in the system prompt: never show one client's data to another. It felt like a wall. Then I remembered the agent reads untrusted text into the same context as my rules, and a prompt is the least trustworthy part of the system.

I planned to move my system off one agent framework and onto a newer one. I never finished, on purpose. Running both engines behind one seam, with a test that proves they match on every commit, turned a portability claim into a property I can check.

After an orchestrator crashed my machine, I came back to autonomous agents by running the whole loop myself, by hand. Two passes found seven guardrails I would never have specced from a whiteboard, starting with a static review that could not catch a runtime bug.

Every agent framework sells you the easy 80%: a graph, some tool-calling, a tidy demo. The remaining 20% is the part that decides whether your system survives contact with a real customer account. You are going to build all of it yourself.

I adopted Google's Agent Development Kit, shipped a feature on it, then pulled it out and replaced the agent with about 30 lines of plain Python. A field report on when an agent framework is the value and when it is just ceremony.

A hallucination is text a human can catch. A retry is an action that already happened, and it can happen twice. Here is the one seam that makes every external write idempotent, and why I chose to refuse a repeat rather than risk a duplicate.

A batch job took down the web service whose entire purpose is to answer requests. The fix was one afternoon. The 24 hours after the fix is the real story.

Before my marketing-data platform could send a single useful alert, I deleted six attribution models, a competitive-intelligence feature, and a tracking audit. They were not wrong. I had built the brain before the warehouse.

My test suite was green. Every test passed. Then an adversarial review pass failed the feature anyway, twice, for bugs the suite physically could not see. Here is why a green suite lies to you about your database.

I built an agent that answers questions about marketing data in plain English. Before it could answer a single real one, it had to pass 30 it had never seen. The hard part was never the model. It was writing down what a correct answer even is.

My first autonomous-agent orchestrator wrote 549 GB to disk in one night, exhausted memory, and triggered a kernel panic. Then it kept dispatching into the dying machine. That night taught me where guardrails actually belong.