AI agents can now handle media buying tasks that previously required a full trading desk. The risks are not hypothetical: budget overruns, deal record divergence, brand safety failures, and accountability gaps are already occurring in early deployments. This checklist gives buyers a practical working tool for evaluating whether their agentic setup has the controls in place before problems surface at scale.
TL;DR: The most common failures in early agentic advertising deployments are not caused by agents making incorrect decisions in isolation. They are caused by agents making decisions without sufficient constraints, against policies that were never translated into machine-readable terms, and in environments where no shared record exists to audit afterwards. Buyers who check these seven areas before scaling will avoid the category of failure that is hardest to recover from: the one that goes undetected until it has been running for weeks.
Does the agent have a written mandate with explicit boundaries? This is the first check because it is the most commonly skipped. A media buying agent requires a mandate: a structured document that defines what it is authorised to buy, at what price, on what inventory, against what audience, and within what budget ceiling. Without a mandate, the agent has no anchor for its decisions, and the buyer has no basis for auditing them.
The mandate should answer at least four questions. What is the daily or campaign spend cap? What inventory categories are permitted and explicitly excluded? What audience signals can the agent act on, and what signals require human approval before use? What happens if the agent hits a constraint: does it pause and request guidance, or does it attempt to resolve the constraint autonomously?
If those four questions do not have written answers, the mandate is incomplete. An incomplete mandate is not a safety net. It is a liability.
Is there a deal record that both buyer and seller can access? Deal record divergence is among the most common operational failures in early agentic deployments. The buyer's system records the deal at one price and on one set of terms; the seller's system records a different version. In traditional programmatic trading, the auction clears both sides simultaneously and the discrepancy rate is low. In agent-negotiated deals, where terms are agreed bilaterally over time rather than cleared in a single auction moment, the two records can diverge without either party noticing until reconciliation.
IAB Tech Lab's Advertising Agent Messaging Protocol (AAMP), currently in active development, addresses this directly: a compliant implementation requires both parties to reference a shared deal record that neither can modify unilaterally after agreement. Without that shared record, a buyer cannot audit what was actually agreed, only what their own system logged.
The practical check: take a recent agent-generated buy and ask whether you can pull a deal record that matches what your counterparty holds. If the answer requires a phone call or a reconciliation spreadsheet, the infrastructure is not ready for autonomous agent operations at volume.
Has your brand safety specification been translated into agent-readable terms? Brand safety documents written for human traders typically contain subjective language: "avoid controversial news", "premium publishers only", "family-friendly contexts". Agents cannot execute against subjective language. They require explicit signals: blocklist domains, permitted content categories by code, viewability thresholds expressed as numbers, adjacency rules as machine-readable exclusions.
The translation from human-readable brand safety policy to agent-readable configuration is a step most buyers have not completed. Buyers moving into agentic programmes who assume their existing brand safety documents will transfer directly to agent configuration are exposed to a class of failure where the agent follows the letter of what was configured, which diverges from what the policy intended.
The question to ask your trading desk or technology team: has every item in the brand safety policy been encoded as an explicit signal the agent can act on, or is the agent being asked to interpret general language? General language leaves interpretive decisions to the agent. Those decisions may not match what the policy intended.
Do you know who is liable when the agent makes a buying decision that violates policy? This question has not been definitively resolved in law in most jurisdictions, which means it falls to contract. The buying mandate, the platform terms of service, and any agency agreement all bear on the answer. Most buyers do not know which document governs in a specific failure scenario.
Two common liability gaps: the mandate does not specify who is responsible if the agent buys inventory that violates the brand policy because the policy was not encoded correctly. And the agency agreement was drafted before agentic buying existed and does not address agent-generated decisions at all.
Before an agent takes actions with material spend, the liability chain should be mapped and documented. Who is responsible if the agent buys inventory in an excluded category? Who resolves the dispute if the deal record differs from the invoice? These are not theoretical questions for programmes moving beyond pilot.
Can you reconstruct what the agent was instructed to do for any given buy? Audit trail completeness is the sleeper issue in agentic advertising. Human traders make decisions with context that is often undocumented: a conversation with a sales representative, a brief that was updated verbally, a relationship call that changed the direction of a campaign. Agents should, in principle, produce a more complete record, because their decision inputs are logged by default in a well-constructed system.
In practice, audit trail quality depends on implementation. If the agent's decision log records only outputs (what it bought, at what price) but not inputs (what signals it evaluated, what mandate conditions it checked before acting), the audit is incomplete. Compliance teams increasingly require the inputs, not just the outcomes.
The test: take a recent agent-generated buy and try to answer the question "why did the agent buy this specific impression?" If the answer is not available in the system logs without a lengthy investigation, the audit trail needs work before the programme scales.
Has the agent been tested against adversarial conditions? Agents behave predictably under normal conditions. They behave differently when the environment changes: a spike in CPMs the mandate did not anticipate, a publisher presenting inventory in a format the agent has not encountered, a consent signal arriving in an unexpected sequence. Buyers who have only tested agents under normal operating conditions do not know how the agent will behave when something goes wrong.
The minimum test set for a media buying agent should include budget exhaustion (what does the agent do when it hits the spend cap at 60% of the campaign flight?), inventory scarcity (what does the agent do when the permitted inventory pool shrinks substantially?), and consent edge cases (what does the agent do when the audience signal is absent or ambiguous?). If these scenarios have not been tested in a controlled environment, they will be discovered in production.
Can a human override the agent in real time, and does that override take effect quickly enough to matter? The answer to the first part of this question is almost always yes, technically. The harder question is whether the override takes effect in time to matter. In a system where agent decisions are executed at machine speed, a human override that takes four hours to propagate through the stack does not function as a meaningful real-time control.
The practical measurement: how long does it take between a human operator deciding to halt an agent's buying activity and the last buy the agent completes? If that gap exceeds the minimum deal execution time in your environment, the override mechanism is not functioning as a real-time control. It is a post-hoc correction.
IAB Tech Lab's AAMP framework defines a class of decisions as requiring pre-approval rather than real-time override: material deals above a threshold value, buys in a new inventory category not covered by the mandate, and any action that modifies the underlying mandate terms. Pre-approval architecture is more reliable than real-time override for high-stakes decisions because it does not depend on human reaction time outrunning machine execution speed.
The infrastructure question this checklist points to Running through these seven checks reveals a common dependency. Most of them require a shared deal record that both parties can access, a mandate framework that is version-controlled and auditable, and an approval mechanism that sits upstream of execution rather than downstream of it.
Alkimi's DealSheet is designed specifically around this set of requirements. It functions as the shared deal record for agent-negotiated transactions: bilaterally held, accessible to both buyer and seller, with mandate constraints enforced at the record level rather than interpreted by the agent. Approval routing for decisions above defined thresholds happens before execution, not after.
Buyers working through this checklist will find that most of the gaps it surfaces trace back to the same infrastructure question: where is the deal record, and who owns it?