{
    "version": "https://jsonfeed.org/version/1",
    "title": "Amir Mousavi — MarTech, analytics, and digital systems",
    "home_page_url": "https://www.amirmousavi.com",
    "feed_url": "https://www.amirmousavi.com/rss/feed.json",
    "description": "Practical notes on marketing technology, analytics, automation, SEO, customer data, and web architecture.",
    "icon": "https://www.amirmousavi.com/og-default.jpg",
    "author": {
        "name": "Amir Mousavi",
        "url": "https://www.amirmousavi.com"
    },
    "items": [
        {
            "id": "https://www.amirmousavi.com/articles/does-safari-27-block-your-marketing-tags",
            "content_html": "<p>In July, the Safari 27 beta write-ups agreed on a headline: Safari 27 blocks Bing UET and the LinkedIn Insight Tag by IP address, and first-party proxies will not save you. Safari 27 shipped on September 14, 2026. I found no one who had checked that claim against the stable release.</p><p>So I read the files. Safari’s tracker lists are downloaded into your user cache, not compiled into the browser. On October 9, 2026 I parsed the five that matter for marketing tags on my Mac (macOS 27.0.1, Safari 27.0.1) and checked the common martech hosts against them.</p><p>The short version: Bing UET and LinkedIn are on a list, but not the IP list. That list has five ranges, and none belongs to Microsoft or LinkedIn.</p><p><strong>Dated note, October 9, 2026:</strong> this is a reading of the lists and of Apple’s and WebKit’s documentation, not a browser test, so it says &quot;listed&quot;, not &quot;blocked&quot;. Apple updates the lists silently. A live Web Inspector test on Safari 27.0.1 will be added here with its date.</p><h2>Quick answer</h2><p>Safari 27’s own tracker lists do not put Bing UET or the LinkedIn Insight Tag on its IP list. As read on October 9, 2026 from a Mac running Safari 27.0.1, that list holds five ranges (Google, Adobe and three Criteo) and nothing from Microsoft or LinkedIn. <code>bat.bing.com</code> and <code>snap.licdn.com</code> are on a different list, of known fingerprinting scripts, which Safari has applied in all browsing by default since Safari 26. That protection limits what the scripts can read, such as query strings and the referrer, and no block rule in these files names either host. Bing’s click ID <code>msclkid</code> is on the link-stripping list, which Apple documents for Private Browsing and for links opened from Mail and Messages.</p><h2>Are these lists new in Safari 27?</h2><p>No.</p><table><thead><tr><th>File (what WebKit calls it)</th><th>Entries</th><th>Version stamp (inferred)</th><th>Current file created on this Mac</th></tr></thead><tbody><tr><td><code>FINGERPRINTING_SCRIPTS</code> (fingerprinting scripts)</td><td>217 hosts</td><td>January 8, 2026</td><td>January 11, 2026</td></tr><tr><td><code>QUERY_PARAM</code> (link filtering data)</td><td>37 entries (29 everywhere, 8 limited to specific sites)</td><td>October 6, 2026</td><td>October 8, 2026</td></tr><tr><td><code>TRACKING_SUBNETS</code> (tracker network addresses)</td><td>5 IP ranges</td><td>November 5, 2025</td><td>November 21, 2025</td></tr><tr><td><code>TRACKING_DOMAINS</code> (tracker domains)</td><td>628 domains, each with an owner</td><td>November 5, 2025</td><td>November 21, 2025</td></tr><tr><td><code>URL_FILTER</code> (tracker block list)</td><td>3,857 block rules across 180 domains</td><td>September 25, 2024</td><td>May 2, 2025</td></tr></tbody></table><p>A file can be replaced on update, so the last column is when the current copy was written, not when the list first existed. Even so, the fingerprinting list naming LinkedIn and Bing carries a January 2026 stamp and the IP list a November 2025 one. Safari 27 arrived on this Mac on September 18, 2026.</p><p>These are Apple’s current lists, not &quot;Safari 27 lists&quot;. Neither Apple’s Safari 27 release notes nor WebKit’s Safari 27.0 post (September 17, 2026) has a privacy or tracking section.</p><h2>Which Safari 27 tracking protection does each list feed, and when?</h2><p>Each list feeds a different protection. For most of them, the mode is decided by one setting, <strong>Use advanced tracking and fingerprinting protection</strong> under Safari &gt; Settings &gt; Advanced, which covers Private Browsing by default or all browsing if the user chooses. The fingerprinting limits and the Mail and Messages link cleaning are the exceptions.</p><table><thead><tr><th>List</th><th>Protection it feeds</th><th>Where Apple and WebKit document it by default</th></tr></thead><tbody><tr><td>Fingerprinting scripts</td><td>Advanced Fingerprinting Protection: listed scripts get unreliable answers from fingerprintable APIs and cannot read query parameters or the referrer</td><td><strong>All browsing</strong>, since Safari 26</td></tr><tr><td>Link filtering</td><td>Link Tracking Protection: listed parameters are removed before a cross-site navigation</td><td>Private Browsing, plus links opened from Mail and Messages</td></tr><tr><td>Tracker block list</td><td>Blocking network loads of known trackers</td><td>Private Browsing (see the caveat below)</td></tr><tr><td>Tracker domains and IP ranges</td><td>Blocking cloaked first-party subdomains that point at a known tracker; WebKit’s cookie and cache code also consults the same lookup</td><td>Private Browsing</td></tr></tbody></table><ul>\n<li><strong>Fingerprinting.</strong> Apple’s June 2025 macOS 26 announcement says Safari &quot;now offers advanced fingerprinting protection in all browsing by default.&quot; WebKit’s Safari 26.0 post lists the effects, including no reading of &quot;query parameters and <code>document.referrer</code>&quot;. WebKit’s current code adds the cookie and localStorage limit only with the advanced setting on.</li>\n<li><strong>Link Tracking Protection.</strong> Apple’s June 2023 announcement covers Messages, Mail and Private Browsing; WebKit’s Private Browsing 2.0 post (July 16, 2024) extends it to regular browsing when the advanced setting covers all browsing.</li>\n<li><strong>Block list.</strong> The same post describes &quot;an automatically enabled content blocker&quot; in Private Browsing; the URL file is a list of third-party block rules.</li>\n<li><strong>Tracker domains and IP ranges.</strong> WebKit’s code runs this check only with the advanced protections on <strong>and</strong> when a request goes to a different subdomain of the page’s own site, the first-party collection pattern WebKit calls &quot;cloaked&quot;.</li>\n</ul><p><strong>The caveat.</strong> WebKit’s current source also has a setting, on by default and not tied to Private Browsing, that loads the same block-rule list for every page. Its latest change landed on September 25, 2026, eleven days after Safari 27 shipped. Whether Safari 27.0.1 contains any version of it, I cannot tell from outside. Only a live test settles it.</p><p>Safari also hides IP addresses from known trackers by default (since Safari 15, per WebKit); Apple does not say which list defines them. And since its Safari 17 work, released from September 2023, it caps cookies from cloaked third-party IP addresses at seven days in all browsing, by heuristic, not list.</p><h2>Does Safari 27 block Bing UET or the LinkedIn Insight Tag?</h2><p>Not by IP, on the evidence of the lists.</p><table><thead><tr><th>Check, October 9, 2026</th><th>Bing UET</th><th>LinkedIn Insight Tag</th></tr></thead><tbody><tr><td>Fingerprinting scripts</td><td><code>bat.bing.com</code> listed</td><td><code>snap.licdn.com</code> listed</td></tr><tr><td>IP ranges</td><td>No Microsoft range. <code>bat.bing.com</code> resolved to 150.171.27.10 and 150.171.28.10, outside all five</td><td>No LinkedIn range. <code>px.ads.linkedin.com</code> and <code>snap.licdn.com</code> resolved outside all five</td></tr><tr><td>Tracker domains</td><td><code>bat.bing.com</code>, owner Microsoft</td><td><code>linkedin.com</code>, not <code>licdn.com</code></td></tr><tr><td>Block rules</td><td>None for <code>bat.bing.com</code>; the only Bing rule covers <code>bing.com/actionp/</code> pings</td><td>None for <code>snap.licdn.com</code> or <code>px.ads.linkedin.com</code>; the only LinkedIn rule covers a share-count endpoint</td></tr><tr><td>Link-stripping list</td><td><code>msclkid</code> listed</td><td>No LinkedIn parameter; <code>li_fat_id</code>, the click ID LinkedIn’s Conversions API documentation says to capture, is absent</td></tr></tbody></table><p>So the documented effect on both tags in regular browsing is the fingerprinting one: per Apple’s description, the script cannot reliably read the page’s query string or referrer, where a click ID and a traffic source live. Nothing in these files says the request itself is stopped, but I have not tested it, and the caveat above applies.</p><p>In Private Browsing, or with the advanced setting on all browsing, <code>msclkid</code> is on the list Safari’s documentation says it removes before the request, and the cloaked-subdomain check comes on. Neither is IP blocking of Microsoft’s servers.</p><h2>What did the July beta write-ups get wrong?</h2><p>TAGGRS, Stape and Hardal sell server-side tagging; PPC Land and Relevant Audience relay TAGGRS’s review. None has been updated for the stable release. Stape asks to be tested &quot;once a stable release is out&quot;, the right instinct, and Hardal calls its Safari 27 points unconfirmed.</p><table><thead><tr><th>Claim, as published</th><th>What the lists say on October 9, 2026</th></tr></thead><tbody><tr><td>&quot;The Bing UET endpoint is blocked at both domain level and by IP subnet.&quot; TAGGRS, July 6 (updated July 30)</td><td>No Microsoft range and no block rule for <code>bat.bing.com</code>. It is listed as a fingerprinting script and a tracker domain</td></tr><tr><td>&quot;Safari 27 blocks LinkedIn and Bing ad trackers by IP address.&quot; PPC Land headline, July 18</td><td>Neither has an IP range. (PPC Land’s body puts LinkedIn on the fingerprinting list; only the headline says IP)</td></tr><tr><td>IP blocking is new in Safari 27 (TAGGRS, PPC Land)</td><td>The current IP file carries a November 2025 stamp. WebKit described blocking cloaked requests to known trackers in July 2024</td></tr><tr><td>Tealium and &quot;Blueonic&quot; are on the fingerprinting list (TAGGRS, Stape, PPC Land)</td><td>Neither is. Both are on the block list, with 123 and 53 rules, which could explain Stape’s Private-mode Tealium result if the profile matches a rule</td></tr><tr><td>&quot;First-party subdomains and server-side proxies do not evade the block.&quot; Relevant Audience, July 19</td><td>A server-to-server call never passes through Safari. The IP check covers the browser’s own requests to a subdomain of your site</td></tr><tr><td>LinkedIn Insight and Segment are on the fingerprinting list</td><td>Correct</td></tr><tr><td>Threads, YouTube and X parameters were added to link stripping</td><td>They are on the list today (<code>xmt</code>, <code>si</code>, <code>twclid</code>, <code>cn</code>, <code>cxt</code>, <code>t</code>). Whether they were added in 27, I cannot see</td></tr></tbody></table><p>The write-ups found real list entries, then attached them to the wrong mechanism.</p><h2>Which tags in a typical martech stack are on which list?</h2><p>The table for a stack audit: listing only, as read on October 9, 2026. Many block rules target one script path, not the whole domain.</p><table><thead><tr><th>Vendor</th><th>Fingerprinting scripts</th><th>Block rules</th><th>Tracker domains</th><th>IP range</th><th>Link parameters</th></tr></thead><tbody><tr><td>Google (GTM, gtag, GA, Ads)</td><td>Legacy <code>ssl.google-analytics.com</code> and four ad and consent hosts</td><td>Yes: <code>gtm.js</code>, <code>gtag/js</code>, legacy GA, Ads conversion scripts</td><td>Yes</td><td>216.239.32.0/19</td><td><code>gclid</code>, <code>dclid</code></td></tr><tr><td>Adobe (Analytics, Launch, Audience Manager)</td><td>No</td><td>Yes: 216 for <code>omtrdc.net</code>, 133 for <code>2o7.net</code></td><td>Yes</td><td>63.140.32.0/19</td><td><code>s_cid</code></td></tr><tr><td>Microsoft (UET, Clarity)</td><td><code>bat.bing.com</code>, <code>www.clarity.ms</code></td><td>One ping rule</td><td><code>bat.bing.com</code></td><td>No</td><td><code>msclkid</code></td></tr><tr><td>LinkedIn</td><td><code>snap.licdn.com</code></td><td>One share-count rule</td><td><code>linkedin.com</code></td><td>No</td><td>No</td></tr><tr><td>Meta pixel</td><td>No</td><td>Yes: <code>fbevents.js</code>, <code>/tr/</code></td><td>Yes</td><td>No</td><td><code>fbclid</code></td></tr><tr><td>HubSpot</td><td><code>js.hubspot.com</code>, <code>js.hs-analytics.net</code>, EU host</td><td>Yes: analytics scripts</td><td>Yes</td><td>No</td><td><code>_hsenc</code> and four more</td></tr><tr><td>Marketo Engage</td><td>No</td><td>Yes, including <code>mktoresp.com/webevents/visitWebPage</code></td><td>Yes</td><td>No</td><td><code>mkt_tok</code></td></tr><tr><td>Salesforce</td><td><code>a.sfdcstatic.com</code>, <code>salesforceliveagent.com</code></td><td>Yes: Pardot <code>pd.js</code></td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Mailchimp</td><td>No</td><td>No</td><td>Yes</td><td>No</td><td><code>mc_eid</code></td></tr><tr><td>Segment</td><td><code>cdn.segment.com</code></td><td>Yes: <code>analytics.min.js</code></td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Tealium</td><td>No</td><td>Yes: 123</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Braze</td><td><code>js.appboycdn.com</code>, Braze’s Web SDK host</td><td>No</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Demandbase</td><td><code>tag.demandbase.com</code>, <code>scripts.demandbase.com</code></td><td>Three</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>6sense</td><td><code>j.6sc.co</code></td><td>No</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Criteo</td><td><code>static.criteo.net</code></td><td>Yes</td><td>Yes</td><td>Three ranges</td><td>No</td></tr><tr><td>TikTok</td><td>No</td><td>No</td><td>No TikTok host; five ByteDance-owned hosts</td><td>No</td><td>No <code>ttclid</code></td></tr></tbody></table><p><strong>Adobe</strong> is the row to read twice. Its first-party collection is a CNAME from your subdomain to Adobe, and the example target in Adobe’s setup documentation, <code>hiodsibxvip01.data.adobedc.net</code>, resolved inside the listed Adobe range from my machine, as did <code>edge.adobedc.net</code>. A first-party Adobe subdomain is the cloaked pattern the lookup would match. Google’s custom-domain target <code>ghs.googlehosted.com</code> resolved outside Google’s range; check from where your users are.</p><h3>What happens to email click tracking?</h3><p><code>mkt_tok</code> (Marketo), <code>mc_eid</code> (Mailchimp) and five HubSpot parameters, including <code>_hsenc</code>, are on the link-stripping list. Whether a token is actually removed is a separate question, and I have not tested it.</p><p>Apple says Link Tracking Protection cleans links opened in Mail. But email platforms typically route the reader through a tracking redirect and add the token there. Then the token is not in the link Mail opens, and in a regular window, where link stripping is off by default, it may survive. A token in the link itself may be removed.</p><p>The stake is identity, not the click count: Adobe’s Marketo documentation says <code>mkt_tok</code> is used by &quot;Marketo Landing Pages and Munchkin&quot; to track a person, and that a link without it is still tracked. Mailchimp says <code>mc_eid</code> &quot;identifies the recipient’s email address&quot;. Test with a real send (step Three) first.</p><h2>When is server-side tagging the answer, and when is it not?</h2><p>Server-side tagging moves the vendor call off the browser. Decide per tag, against the table.</p><p><strong>It helps when a listed script is the one reading your identifiers.</strong> Your own first-party code can still read the landing URL, if the parameter arrives, and send the conversion server to server: Microsoft’s offline conversions, LinkedIn’s Conversions API, Google’s enhanced conversions. That is a capture problem; a server-side endpoint is one answer, and your CRM or back end can make the same call.</p><p><strong>It helps when a vendor’s script or beacon is on the block list</strong> and your Private Browsing share matters. Check where your own endpoint resolves: a subdomain inside a listed range is the cloaked pattern.</p><p><strong>It does not help with Link Tracking Protection.</strong> Where it applies, Safari removes the listed parameter before the navigation leaves the device, so no server sees it, yours included. For email, identify the person on a form or login, not from a URL token.</p><p><strong>It does not help with tags on no list.</strong> That is buying infrastructure for a problem you do not have; measurement usually breaks earlier, as I wrote in <a href=\"https://www.amirmousavi.com/articles/why-analytics-implementations-fail\">why analytics implementations fail</a>.</p><h2>How to test it yourself in Safari 27’s Web Inspector</h2><p><strong>One. Read the lists on your own Mac.</strong></p><pre><code>cd &quot;$(getconf DARWIN_USER_CACHE_DIR)com.apple.WebPrivacy&quot;\nls -l\ntail -c +73 FINGERPRINTING_SCRIPTS.wplist | grep -E &#x27;bing|licdn|segment|hs-analytics&#x27;\ntail -c +73 TRACKING_SUBNETS.wplist\ntail -c +73 QUERY_PARAM.wplist\ndig +short smetrics.example.com\n</code></pre><p>Use your own collection subdomains in the last line and compare each address with the five ranges. Record the Safari version, window type and privacy settings with every result below.</p><p><strong>Two. Open the developer tools in a Private window.</strong> In Safari &gt; Settings &gt; Advanced, select &quot;Show features for web developers&quot; and note the advanced-protection and &quot;Hide IP address&quot; settings. In a Private window, choose Develop &gt; Show Web Inspector, open the Network tab and check <strong>Preserve Log</strong>.</p><p><strong>Three. Test link stripping.</strong> From a page on a <em>different</em> site, click a link to your landing page carrying <code>?gclid=test1&amp;msclkid=test2&amp;mkt_tok=test3&amp;utm_source=test4</code>. If Link Tracking Protection applied, the document request shows <code>utm_source</code> and none of the other three. Repeat in a regular window. Then repeat with a <strong>real tracked link</strong> from a test send of your email platform, opened from Apple Mail in a regular window, and check whether the token arrives on the landing request.</p><p><strong>Four. Test network blocking.</strong> In the Private window, then a regular one, load a page with your tags and filter the Network tab by vendor domain. A blocked load fails, and the Console logs a line beginning &quot;Blocked connection to known tracker&quot;.</p><p><strong>Five. Test the fingerprinting limits through the beacon.</strong> WebKit’s console logging for these limits is off by default, so a missing message proves nothing. Check whether your test click ID made it into the tag’s outgoing request, such as the call to <code>bat.bing.com</code>, and compare the same click in Chrome.</p><p>This is the Safari-specific part of the <a href=\"https://www.amirmousavi.com/resources/analytics-implementation-checklist\">analytics implementation checklist</a>’s &quot;test on real Safari&quot; line.</p><h2>My working take</h2><p>The mechanism is the whole decision. &quot;Blocked by IP&quot; means conversion data never leaves the browser and only a server-side path helps. &quot;Listed as a fingerprinting script&quot; means the tag may still fire but cannot read the click ID: a capture problem, with cheaper answers than a new hosting contract.</p><p>Three things in the lists matter more than the Bing and LinkedIn headline. Adobe and Google are the two analytics vendors with an IP range, and Adobe’s first-party CNAME is the textbook cloaked pattern. Email tokens from Marketo, HubSpot and Mailchimp are on the link-stripping list, and whether your sends lose them depends on how your platform builds links. And tags on no list, TikTok among them, need no Safari project at all.</p><p>What would change my take is the live test. If <code>bat.bing.com</code> fails to connect in a regular Safari 27 window with default settings, the lists are not the whole story, and I will say so here.</p><h2>Frequently asked questions about Safari 27 tracking protection and marketing tags</h2><h3>Does Safari 27 block the Bing UET tag?</h3><p>Not by IP address, on the lists Apple served to a Mac running Safari 27.0.1 on October 9, 2026: the IP list has no Microsoft range, and no block rule names <code>bat.bing.com</code>. The host is listed as a known fingerprinting script, which since Safari 26 limits what the script can read in all browsing, including the query string and referrer. <code>msclkid</code> is on the link-stripping list, which Apple documents for Private Browsing and links opened from Mail and Messages. No live test has been run yet.</p><h3>Is the LinkedIn Insight Tag blocked in Safari 27?</h3><p>It is listed, not shown to be blocked, as of October 9, 2026. <code>snap.licdn.com</code> is on Apple’s fingerprinting-scripts list, which restricts the script’s access to query parameters, the referrer and fingerprintable APIs. The lists hold no LinkedIn IP range and no block rule for the tag, and <code>li_fat_id</code> is not on the link-stripping list.</p><h3>Which parameters does Safari 27’s Link Tracking Protection remove?</h3><p>Apple’s list, read October 9, 2026, has 37 entries (34 distinct names), 29 applied everywhere and 8 only on specific sites. They include <code>gclid</code>, <code>dclid</code>, <code>fbclid</code>, <code>msclkid</code>, <code>twclid</code>, <code>yclid</code>, <code>mkt_tok</code>, <code>mc_eid</code>, <code>_hsenc</code> and four other HubSpot parameters, and <code>s_cid</code>. UTM parameters are not on it. Apple and WebKit document the protection for Messages, Mail and Private Browsing, and for regular browsing only when the user sets &quot;Use advanced tracking and fingerprinting protection&quot; to all browsing.</p><h2>How I read the lists</h2><p>The files sit in <code>com.apple.WebPrivacy</code> under the folder <code>getconf DARWIN_USER_CACHE_DIR</code> prints; Jeff Johnson of Lapcat Software documented it in June 2023, when the parameter file had 25 entries. On my Mac it held ten <code>.wplist</code> files, last rewritten October 8, 2026.</p><p>Each file is plain text after a 72-byte header. The first byte is a type number matching WebKit’s <code>WebPrivacySPI.h</code> (1 block list, 2 link filtering, 3 tracker domains, 4 tracker addresses, 9 fingerprinting scripts), which is how I mapped files to protections. Bytes 36 to 43 hold a millisecond timestamp I read as the version date. That is <strong>inferred</strong>: Apple does not document the format, but every value is a round minute, and for four files it precedes the current file’s creation by 1.6 to 16 days. Creation dates come from <code>stat</code>, DNS from this Mac’s resolver on October 9, and WebKit code from its main branch that day, which may differ from the 27.0.1 build. File hashes are in my working notes.</p><h2>Sources I used</h2><p>Verified at source: October 9, 2026.</p><ul>\n<li><a href=\"https://support.apple.com/en-us/149039\">Apple: &quot;Safari 27&quot;, released September 14, 2026</a></li>\n<li>Apple Developer release notes: <a href=\"https://developer.apple.com/documentation/safari-release-notes/safari-27-release-notes\">Safari 27</a>; <a href=\"https://developer.apple.com/documentation/safari-release-notes/safari-26-release-notes\">Safari 26</a></li>\n<li>WebKit blog: <a href=\"https://webkit.org/blog/18325/\">Safari 27.0 features, September 17, 2026</a>; <a href=\"https://webkit.org/blog/17333/webkit-features-in-safari-26-0/\">Safari 26.0 features</a>; <a href=\"https://webkit.org/blog/15697/private-browsing-2-0/\">&quot;Private Browsing 2.0&quot;, July 16, 2024</a>; <a href=\"https://webkit.org/blog/14445/webkit-features-in-safari-17-0/\">Safari 17.0 features</a></li>\n<li>Apple Newsroom: <a href=\"https://www.apple.com/newsroom/2025/06/macos-tahoe-26-makes-the-mac-more-capable-productive-and-intelligent-than-ever/\">macOS Tahoe 26, June 2025</a>; <a href=\"https://www.apple.com/newsroom/2025/06/apple-elevates-the-iphone-experience-with-ios-26/\">iOS 26, June 2025</a>; <a href=\"https://www.apple.com/newsroom/2023/06/apple-announces-powerful-new-privacy-and-security-features/\">privacy features, June 2023</a></li>\n<li>Apple Safari User Guide for macOS 27: <a href=\"https://support.apple.com/guide/safari/advanced-ibrw1075/27.0/mac/27\">Advanced</a>; <a href=\"https://support.apple.com/guide/safari/privacy-sfri35610/27.0/mac/27\">Privacy</a>; <a href=\"https://support.apple.com/guide/safari/use-the-developer-tools-in-the-develop-menu-sfri20948/27.0/mac/27\">Develop menu</a>; and <a href=\"https://webkit.org/web-inspector/network-tab/\">WebKit’s Network tab reference</a></li>\n<li>WebKit source, main branch, read October 9, 2026: <a href=\"https://github.com/WebKit/WebKit/blob/main/Source/WebCore/PAL/pal/spi/cocoa/WebPrivacySPI.h\">resource types</a>; <a href=\"https://github.com/WebKit/WebKit/blob/main/Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm\">list loading</a>; <a href=\"https://github.com/WebKit/WebKit/blob/main/Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm\">cloaking check</a>; <a href=\"https://github.com/WebKit/WebKit/blob/main/Source/WebCore/page/ScriptTrackingPrivacyCategory.cpp\">fingerprinting limits</a>; <a href=\"https://github.com/WebKit/WebKit/blob/main/Source/WebCore/contentextensions/ContentExtensionsBackend.cpp\">console message</a>; <a href=\"https://github.com/WebKit/WebKit/blob/main/Source/WebKit/UIProcess/WebProcessPool.cpp\">block list loaded per page</a></li>\n<li><a href=\"https://lapcatsoftware.com/articles/2023/6/2.html\">Lapcat Software (Jeff Johnson): &quot;Safari 17 Link Tracking Protection Details&quot;, June 2023</a></li>\n<li>Vendor documentation: <a href=\"https://experienceleague.adobe.com/en/docs/marketo/using/product-docs/email-marketing/general/functions-in-the-editor/disable-tracking-for-an-email-link\">Marketo <code>mkt_tok</code>, updated October 7, 2026</a>; <a href=\"https://experienceleague.adobe.com/en/docs/core-services/interface/administration/ec-cookies/cookies-first-party\">Adobe first-party CNAME</a>; <a href=\"https://mailchimp.com/developer/marketing/docs/e-commerce/\">Mailchimp <code>mc_eid</code></a>; <a href=\"https://learn.microsoft.com/en-us/linkedin/marketing/conversions/enabling-first-party-cookies\">LinkedIn Conversions API, <code>li_fat_id</code></a></li>\n<li>The July write-ups: <a href=\"https://taggrs.io/safari-27-tracking-protection/\">TAGGRS, July 6, updated July 30, 2026</a>; <a href=\"https://stape.io/news/safari-27-update-tracking-protection\">Stape, July 16</a>; <a href=\"https://ppc.land/safari-27-blocks-linkedin-and-bing-ad-trackers-by-ip-address/\">PPC Land, July 18</a>; <a href=\"https://www.relevantaudience.com/analytics/safari-27-blocks-ad-trackers-by-ip-address/\">Relevant Audience, July 19</a>; <a href=\"https://usehardal.com/blog/safari-2026-2027-could-your-measurement-setup-break-the-next-update\">Hardal, July 20</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/does-safari-27-block-your-marketing-tags",
            "title": "Does Safari 27 Block Bing UET and LinkedIn Tags?",
            "summary": "Safari 27’s tracker lists, read Oct 9, 2026: Bing UET and LinkedIn are listed as fingerprinting scripts, not on the IP list. What each list does to your tags.",
            "date_modified": "2026-10-13T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "Safari 27",
                "tracking prevention",
                "Link Tracking Protection",
                "Advanced Fingerprinting Protection",
                "server-side tagging",
                "martech stack audit"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/hubspot-credits-and-seats-what-changed",
            "content_html": "<p>On September 16, 2026, HubSpot changed one definition in its Customer Terms of Service. Alone, it looks like a tidy-up. Beside the knowledge-base article HubSpot updated the same day, it is the contract side of a default switch: whether an account that overruns its HubSpot Credits pays once, or for the rest of its term, now depends on when it purchased extra credits.</p><p>Two weeks later, on October 1, the pricing supplement for HubSpot’s flexible seats-and-credits model renamed and repriced its seats. On that model every marketing email is metered in credits, and most of what is written about HubSpot pricing is about AI agents instead.</p><p>This post also corrects one of mine. On September 8 I wrote that &quot;Pay-as-You-Go is the default overage setting.&quot; It was not. The terms, the catalog and the knowledge base live that day all treated auto-upgrade as the default. The sentence in <a href=\"https://www.amirmousavi.com/articles/what-does-an-ai-agent-action-cost\">what one AI agent action costs</a> now carries a dated correction.</p><p>I found both changes on October 9, 2026 by diffing HubSpot’s own documents against web-archive captures on either side of each change. <strong>Nothing below comes from administering a HubSpot account or from reading an invoice.</strong> Every figure is a published list price, or one times a published credit rate. Dollar figures are US-dollar prices from HubSpot’s global catalog, the one sold in Canada and the United States. Euro figures are the EMEA prices of the new seat model, which HubSpot publishes only in euros. I have not converted them: HubSpot does not set regional prices by exchange rate, so a converted figure would be a price nobody is quoted. This post covers billing mode, seats and email metering, not per-action AI costs.</p><h2>Quick answer</h2><p>For a Canadian or US account, the change that applies today is the September 16 one: extra HubSpot Credits bought on or after September 16, 2026 default to Pay-as-You-Go overages at $0.010 a credit; earlier purchases default to auto-upgrade, which raises the credit tier for the rest of the term. On the global catalog sold in North America, email sends use no credits.</p><p>The new GTM Seat is the full-access seat on HubSpot’s flexible seats-and-credits pricing, which HubSpot’s partner kit describes as the model for net-new EMEA customers from October 1, 2026. It is priced in euros. At EMEA list, GTM Seats start at €20 (Starter), €100 (Professional) and €175 (Enterprise) per seat per month, and Ops Seats at €50. On that model, every email except one-to-one email consumes credits: 15 per send in the first 10,000-send tier, €0.15 at €0.010 per credit. I found no HubSpot document that puts it on sale in Canada or the United States yet.</p><p><strong>Verified at source on October 9, 2026.</strong> These are living pages: the catalog and the supplement have both changed again since the captures cited below. Reopen them before you quote a figure in a negotiation.</p><h2>What changed in HubSpot’s credit billing on September 16, 2026?</h2><p><strong>The Customer Terms of Service.</strong> The live page reads &quot;Last Modified: September 16, 2026&quot;. HubSpot archives the previous version, dated April 14, 2026, so both sides are primary sources. The definition of &quot;Overages&quot; changed from this:</p><blockquote>\n<p>&quot;the additional fees incurred when you exceed your HubSpot Credits Limit, and configure your account to Pay-as-you-go and incur Overages instead of automatically upgrading.&quot;</p>\n</blockquote><p>to this:</p><blockquote>\n<p>&quot;the additional fees incurred on a Pay-as-You-Go basis when you exceed your HubSpot Credits Limit.&quot;</p>\n</blockquote><p>Wayback captures bracket the edit to within a day: 16:04 UTC on September 15 has the April text, 12:24 UTC on September 16 the new one. My diff of the General Terms found one other change: &quot;Commerce Hub&quot; became &quot;Revenue Hub&quot; in sections 3.1 and 3.2. ConductAtlas, which monitors terms of service, shows the same edits (five modified sentences) in its diff of the September 11 and 17 captures.</p><p><strong>The knowledge-base article.</strong> &quot;Manage HubSpot Credits&quot; reads &quot;Last updated: September 16, 2026&quot;. It now says that if you purchased additional credits before Sept. 16, 2026, &quot;auto-upgrade is the default setting&quot;, and on or after that date &quot;pay-as-you-go is the default setting.&quot; The previous version, last updated September 9 and captured September 14, said: &quot;By default, when you’ve purchased additional credits and reach your monthly credit limit, your account will automatically be upgraded&quot;. The same revision added an automatic account-level spend limit at 50% above your monthly credits once you buy extra ones, with alerts at 75%, 85% and 90%.</p><p><strong>The Product and Services Catalog.</strong> The catalog is undated; a web archive is its only history. The September 4 capture said &quot;your account will automatically be upgraded&quot; unless you turned on Pay-as-You-Go. By the September 20 capture, Pay-as-You-Go was listed first, auto-upgrade applied only &quot;if you configure this choice&quot;, and a new sentence said &quot;Included credits are applied to your usage before any paid credits&quot;. The same window renamed the rate-sheet row &quot;Execute one Breeze action in a workflow&quot; to &quot;Execute one AI action in a workflow&quot;, still 10 credits.</p><h2>What is the difference between auto-upgrade and Pay-as-You-Go?</h2><p>Both charge $0.010 a credit in the global catalog; what differs is how long you keep paying.</p><p><strong>Auto-upgrade</strong> &quot;automatically upgrades your account to the next HubSpot Credits capacity pack based on usage for the rest of your commitment term.&quot; HubSpot’s own example: an Enterprise account with 5,000 included credits and one 1,000-credit pack has 6,000 a month. Use 6,500 in one cycle and another pack is added, raising the limit to 7,000 &quot;for the remainder of your contract.&quot;</p><p><strong>Pay-as-You-Go</strong> charges each credit over the limit at the overage rate, invoiced monthly in increments of 10 credits, and the account returns to its original limit on the reset date.</p><p>My arithmetic on that example: a one-off spike of 500 credits costs $5 on Pay-as-You-Go, and an extra $10 pack every remaining month on auto-upgrade, $100 if ten months are left. Packs can only be cancelled or downgraded &quot;at the end of your contractual commitment term.&quot;</p><p>Section 3.1 of the terms already let fees rise mid-term through &quot;upgrades as a result of exceeding Limits&quot;, unchanged on September 16. What changed is where an account lands if nobody chooses. HubSpot does not say what happens to an account that bought extra credits both before and after that date.</p><p>Flexible seats-and-credits pricing has no auto-upgrade: usage beyond a pack is billed at the Pay-as-You-Go rate, and the limit &quot;will not automatically increase.&quot;</p><p>Neither mode applies until you buy extra credits; with only included credits, credit-using features pause until the next reset. A mode switch takes effect next period if credits were already used in this one.</p><h2>What do HubSpot’s GTM and Ops Seats cost since October 1, 2026?</h2><p>The second change is in the catalog’s Flexible Seats-and-Credits Pricing supplement, formerly HubSpot’s &quot;limited release pricing&quot; page (the redirect first appears in a September 20 capture). Between the September 27 capture and the October 1 capture at 19:14 UTC, its seat table was rewritten.</p><table><thead><tr><th>Edition</th><th>Seats until at least September 27, 2026</th><th>Seats from October 1, 2026</th></tr></thead><tbody><tr><td>Starter</td><td>Core Seat from €20, maximum 10 paid seats</td><td>GTM Seat from €20, maximum 10 paid seats</td></tr><tr><td>Professional</td><td>Core Seat from €60, Front Office Seat from €120</td><td>GTM Seat from €100, Ops Seat from €50</td></tr><tr><td>Enterprise</td><td>Core Seat from €90, Front Office Seat from €150</td><td>GTM Seat from €175, Ops Seat from €50</td></tr><tr><td>Included credits per month</td><td>5,000 / 10,000 / 15,000</td><td>5,000 / 10,000 / 15,000</td></tr></tbody></table><p>Prices are EMEA &quot;start at&quot; figures in euros, per seat per month. &quot;Each account must have at least one GTM Seat,&quot; and the seats knowledge-base article adds that &quot;Super Admins must have a GTM Seat.&quot; An Ops Seat covers reporting, dashboards, integrations, workflows, AI agents and user management, and is not available on Starter.</p><p>Do not map old seats to new ones one for one: a Core Seat granted &quot;core access&quot;, an Ops Seat grants &quot;select automation, reporting, and governance functionality&quot;. Different bundles, not new prices for the same ones.</p><p>The same rewrite made calling minutes (100, 250 or 500, previously 500, 3,000 or 12,000 per account) and conversational-context records (50, 250 or 350) per-GTM-Seat allowances, dropped the 100,000-record cap, replaced the free AEO trial with 2 credits per answer, and added Marketing Packs; a later edit opened the Growth and Scaled packs to every edition.</p><p><strong>Who it applies to.</strong> The supplement names no region for the GTM and Ops model; the only region it mentions is the Nordic pilot. HubSpot’s partner kit says it is &quot;designed for HubSpot Solutions Partners in EMEA working with net-new customers on the new pricing model,&quot; and lists an EMEA kickoff webinar on October 1. Accounts that bought flexible pricing before October 1 &quot;may have Core Seats and Front Office Seats&quot;, and Nordic pilot customers keep that table. I found no HubSpot document that puts this model on sale in Canada or the United States, where the global catalog still sells Core, Sales, Service and Revenue Seats in dollars.</p><p>That is the correction published coverage needs. Hacking Demand’s October 3 explainer of the EMEA launch prices Professional at €60 for a Core Seat and €120 for a Front Office Seat: the pilot prices, not the October 1 ones. Guides pricing Core Seats in US dollars describe the global model, which is still current.</p><h2>What does a marketing email cost in HubSpot Credits?</h2><p>On flexible pricing, the supplement is blunt: &quot;All emails sent in HubSpot, except for one-to-one emails sent from a connected or hosted inbox, will consume HubSpot Credits.&quot; The program’s knowledge-base article, updated October 1, includes transactional emails and meeting reminders, and says &quot;sending an email via a workflow action results in two separate credit charges&quot;.</p><p>These rates were already in the pilot supplement captured September 4; October 1 changed who buys at them. The global catalog meters neither email sends nor standard workflow actions; it caps sending at a multiple of your marketing-contact tier.</p><table><thead><tr><th>Metered unit (flexible pricing, as of October 9, 2026)</th><th>Credits</th><th>EMEA list cost at €0.010 per credit</th></tr></thead><tbody><tr><td>One email send, 1–10,000 sends</td><td>15</td><td>€0.15</td></tr><tr><td>One email send, 10,001–55,000</td><td>5</td><td>€0.05</td></tr><tr><td>One email send, 55,001–100,000</td><td>2</td><td>€0.02</td></tr><tr><td>One email send, 100,001+</td><td>0.5</td><td>€0.005</td></tr><tr><td>One workflow action, 1–10,000 actions</td><td>3</td><td>€0.03</td></tr><tr><td>One workflow action, 10,001–55,000 / 55,001–100,000 / 100,001+</td><td>2 / 0.5 / 0.1</td><td>€0.02 / €0.005 / €0.001</td></tr><tr><td>One email sent by a workflow, first tiers</td><td>15 + 3</td><td>€0.18</td></tr><tr><td>One Breeze workflow action (the supplement’s name; the global catalog now says &quot;AI action&quot;)</td><td>10</td><td>€0.10</td></tr><tr><td>One calling minute above the included allowance</td><td>10</td><td>€0.10</td></tr><tr><td>One AEO answer from a tracked prompt</td><td>2</td><td>€0.02</td></tr></tbody></table><p>Workflow actions exclude branches, delays and go-to actions.</p><p><strong>What the supplement does not say</strong> is how the tiers count. It gives no period for &quot;1 – 10,000 sends&quot;, though credits reset monthly. It also does not say whether the tiers are graduated, like tax brackets, or whether all sends are charged at the rate of the bracket your total falls in. The difference is large:</p><table><thead><tr><th>Sends in a month</th><th>Graduated reading</th><th>All-units reading</th><th>Email Sends Capacity Pack</th></tr></thead><tbody><tr><td>10,000</td><td>150,000 credits, €1,500</td><td>150,000 credits, €1,500</td><td>10,000 sends, €1,000</td></tr><tr><td>50,000</td><td>350,000 credits, €3,500</td><td>250,000 credits, €2,500</td><td>100,000 sends, €3,000</td></tr><tr><td>100,000</td><td>465,000 credits, €4,650</td><td>200,000 credits, €2,000</td><td>100,000 sends, €3,000</td></tr><tr><td>1,000,000</td><td>915,000 credits, €9,150</td><td>500,000 credits, €5,000</td><td>1,000,000 sends, €6,000</td></tr></tbody></table><p>Figures are list prices before included credits. The all-units reading has a cliff (10,000 sends cost 150,000 credits, 10,001 cost 50,005), which makes the graduated reading more plausible, but plausible is not written. At 100,000 sends, Pay-as-You-Go beats the pack under the all-units reading and costs about 55% more under the graduated one (€4,650 against €3,000). The choice flips on a rule HubSpot has not published.</p><p>For workflows, the €150 Growth pack of 500,000 actions a month pays for itself at 5,000 first-tier actions.</p><h2>What does the default spend limit do to your email?</h2><p>I would test this before signing, because the failure is an outage, not an invoice. The flexible-pricing credits article says that with included credits only, &quot;any features that use HubSpot Credits will pause when all included credits run out.&quot; On flexible pricing, email is one of those features. Read literally, an account with no capacity pack stops sending after about 333 first-tier emails a month on Starter, 666 on Professional and 1,000 on Enterprise.</p><p>Buying a capacity pack turns on overages and the automatic spend limit at 50% above the monthly total. A Professional account with 10,000 included credits and one 1,000-credit pack has 11,000 a month, so a default limit of 16,500 credits: 1,100 first-tier emails before credit-using features pause until the next reset.</p><p>Yet &quot;Manage HubSpot Credits&quot;, which describes the same automatic 50% limit, still says &quot;Credit limits aren’t turned on by default&quot; in its action-limit section. Settle that tension in writing before the first campaign.</p><p><strong>A worked example, at list.</strong> A Professional EMEA account has 3 GTM Seats and 2 Ops Seats, sends 20,000 emails a month and runs 30,000 workflow actions, none of which send email.</p><ul>\n<li><strong>Seats:</strong> €400 a month.</li>\n<li><strong>Pay-as-You-Go, graduated reading:</strong> 200,000 credits for email and 70,000 for workflows, minus 10,000 included: 260,000 credits, €2,600, so €3,000 in total. Overages need one 1,000-credit pack (€10) first; its credits offset its price. The spend limit must be raised to at least 270,000 credits or sending stops.</li>\n<li><strong>Pay-as-You-Go, all-units reading:</strong> 100,000 credits for email and 60,000 for workflows, minus 10,000 included: 150,000 credits, €1,500, for €1,900 in total.</li>\n<li><strong>Growth Marketing Pack (€1,300):</strong> it covers 10,000 sends, all the workflow actions and 40,000 credits. The other 10,000 sends cost either 50,000 credits, if they continue in the second tier, or 150,000, if they restart at the first. Assuming the pack’s 40,000 credits and the plan’s 10,000 included credits pool, which HubSpot does not say, the total is between €1,700 and €2,700 a month.</li>\n</ul><p>So the same account costs between €1,700 and €3,000 a month, depending on two counting rules nobody has written down.</p><h2>What should you check before a HubSpot renewal?</h2><p>For each item, record what is configured in the portal today and what is agreed in writing.</p><ol>\n<li><strong>Which pricing model you are on.</strong> Check the seat names under Users &amp; Teams: Core, Sales, Service and Revenue mean the global catalog; GTM and Ops the flexible supplement; Core and Front Office on flexible pricing a pre-October account or the Nordic pilot. For older flexible versions HubSpot &quot;may choose to move you to our then-current products,&quot; so ask whether a move is planned.</li>\n<li><strong>When you purchased extra credits, and what that did.</strong> Before September 16, 2026, the default was auto-upgrade. Record the Overage mode, get it confirmed in writing, and compare today’s credit limit with the one you bought: auto-upgrade packs stay until the term ends, so raise them before the renewal date.</li>\n<li><strong>Your spend limit and who gets the alerts.</strong> On flexible pricing, a paused feature can mean paused email.</li>\n<li><strong>The tier rules, in writing (flexible pricing).</strong> Ask over what period the tiers count, whether they are graduated, and whether sends above a pack restart at the first tier. Model twelve months of volume under both readings.</li>\n<li><strong>Workflow-sent email.</strong> Each of those sends is charged twice, so count them. The trigger, cadence and frequency-cap fields of a <a href=\"https://www.amirmousavi.com/resources/marketing-automation-planning-template\">marketing automation plan</a> are where that count comes from.</li>\n<li><strong>The seat mix.</strong> Super Admins need GTM Seats; check which operations users can work on an Ops Seat. Removing a seat changes billing only &quot;at the start of your next subscription term&quot;.</li>\n<li><strong>The renewal price.</strong> Section 3.2 of the terms lets HubSpot raise fees on renewal &quot;up to our then-current list price&quot;, with at least 30 days’ notice for most subscriptions. The terms set no lower ceiling, so a renewal cap has to be written into the Order Form.</li>\n<li><strong>Beta features.</strong> HubSpot aims to give 30 days’ notice before a beta feature starts consuming credits, but says &quot;this may not be possible given the rapid pace of beta development.&quot; Ask for a notice commitment.</li>\n</ol><p>Write each answer into the renewal file with the date you read it.</p><h2>My working take</h2><p>The September 16 change helps buyers: under Pay-as-You-Go a one-month spike stops costing money at the next reset. The problem is the split by purchase date. Two accounts on identical terms can behave differently because one bought a pack on September 15, and nothing in the Terms of Service tells you which you have; the knowledge base and the portal setting do.</p><p>The October 1 change matters more to marketing teams than the seat names suggest. Email becomes a metered line item whose counting rules are not written down. A European buyer comparing HubSpot with a platform priced per contact or per send should model it under both readings.</p><p>As far as HubSpot’s published documents show, this is not on sale outside EMEA yet. But HubSpot pilots first, as with the Nordic program, and the global terms already lean on Pay-as-You-Go. I would budget a North American renewal as if email metering might arrive, and ask the account team while there is still a term to negotiate.</p><p>As in <a href=\"https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack\">the stack guide’s lifecycle cost section</a>, state the result as a range. The <a href=\"https://www.amirmousavi.com/resources/martech-stack-assessment\">MarTech Stack Assessment</a> covers the architecture questions around it.</p><h2>Frequently asked questions about HubSpot credits and seats</h2><h3>What is the difference between a GTM Seat and an Ops Seat?</h3><p>The GTM and Ops seat types were introduced on October 1, 2026 on HubSpot’s flexible seats-and-credits pricing. A GTM Seat grants full access to marketing, sales and service tools and includes Ops Seat access. An Ops Seat grants &quot;select automation, reporting, and governance functionality&quot; and is not available on Starter. At EMEA list prices, the only ones HubSpot publishes for this model, Ops Seats start at €50 a month, and GTM Seats at €100 on Professional and €175 on Enterprise.</p><h3>How many HubSpot Credits does one email send use?</h3><p>On flexible seats-and-credits pricing, as of October 9, 2026, one email send uses 15 credits in the 1–10,000 tier, 5 in the 10,001–55,000 tier, 2 in the 55,001–100,000 tier and 0.5 beyond that. At the EMEA rate of €0.010 per credit, the first tier is €0.15 a send. One-to-one email from a connected or hosted inbox is exempt, a workflow-sent email is also charged for the action, and on the global catalog email sends use no credits.</p><h3>Is Pay-as-You-Go or auto-upgrade the default for HubSpot Credits?</h3><p>It depends on when the account purchased additional credits. HubSpot’s knowledge base, updated September 16, 2026, says auto-upgrade is the default for purchases before that date and Pay-as-You-Go for purchases on or after it. Auto-upgrade raises the credit limit for the rest of the term; Pay-as-You-Go bills one month’s overage and resets.</p><h3>Does HubSpot’s flexible seats-and-credits pricing apply in Canada or the US?</h3><p>Not as of October 9, 2026, as far as HubSpot’s published documents show. HubSpot’s partner kit describes the model as being for net-new EMEA customers, with a kickoff on October 1, 2026. The global catalog sold in North America still has Core, Sales, Service and Revenue Seats and does not meter email sends in credits.</p><h2>Sources I used</h2><p>Verified at source: October 9, 2026.</p><ul>\n<li><a href=\"https://legal.hubspot.com/terms-of-service\">HubSpot: Customer Terms of Service, &quot;Last Modified: September 16, 2026&quot;</a></li>\n<li><a href=\"https://legal.hubspot.com/archived-tos-4142026\">HubSpot: archived Customer Terms of Service, last modified April 14, 2026</a></li>\n<li><a href=\"https://knowledge.hubspot.com/account-management/understand-hubspot-credits-and-billing\">HubSpot Knowledge Base: Manage HubSpot Credits, last updated September 16, 2026</a></li>\n<li><a href=\"https://legal.hubspot.com/hubspot-product-and-services-catalog\">HubSpot: Product &amp; Services Catalog, HubSpot Credits section (undated)</a></li>\n<li><a href=\"https://www.hubspot.com/flexible-seats-and-credits-pricing-supplement\">HubSpot: Flexible Seats-and-Credits Pricing catalog supplement (undated)</a></li>\n<li><a href=\"https://knowledge.hubspot.com/account-management/understand-how-to-use-hubspot-credits\">HubSpot Knowledge Base: Understand how to use HubSpot Credits (Flexible Seats-and-Credits Pricing), last updated October 1, 2026</a></li>\n<li><a href=\"https://knowledge.hubspot.com/account-management/manage-seats-in-your-hubspot-account\">HubSpot Knowledge Base: Manage seats in your HubSpot account (Flexible Seats-and-Credits Pricing), last updated October 1, 2026</a></li>\n<li><a href=\"https://knowledge.hubspot.com/account-management/use-your-hubspot-subscription\">HubSpot Knowledge Base: Use your HubSpot subscription (Flexible Seats-and-Credits Pricing), last updated October 1, 2026</a></li>\n<li><a href=\"https://offers.hubspot.com/new-pricing-model-partners-2026\">HubSpot: Flexible Seats-and-Credits Pricing Partner Enablement Kit, EMEA kickoff webinar October 1, 2026</a></li>\n<li><a href=\"https://web.archive.org/web/20260904040522/https://legal.hubspot.com/hubspot-product-and-services-catalog\">Wayback Machine: Product &amp; Services Catalog, captured September 4, 2026</a></li>\n<li><a href=\"https://web.archive.org/web/20260914204331/https://knowledge.hubspot.com/account-management/understand-hubspot-credits-and-billing\">Wayback Machine: Manage HubSpot Credits, version of September 9, captured September 14, 2026</a></li>\n<li><a href=\"https://web.archive.org/web/20260927103008/https://www.hubspot.com/flexible-seats-and-credits-pricing-supplement\">Wayback Machine: flexible-pricing supplement with Core and Front Office seats, captured September 27, 2026</a></li>\n<li><a href=\"https://web.archive.org/web/20261001191454/https://www.hubspot.com/flexible-seats-and-credits-pricing-supplement\">Wayback Machine: flexible-pricing supplement with GTM and Ops seats, captured October 1, 2026</a></li>\n<li><a href=\"https://conductatlas.com/diff/hubspot/hubspot-terms-of-service/6680/6997/\">ConductAtlas: diff of HubSpot’s Terms of Service, captures of September 11 and 17, 2026</a></li>\n<li><a href=\"https://hackingdemand.com/blog/hubspot-seats-and-credits-pricing-emea\">Hacking Demand: HubSpot seats-and-credits pricing in EMEA, October 3, 2026</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/hubspot-credits-and-seats-what-changed",
            "title": "What Do HubSpot’s GTM Seats and Email Credits Cost?",
            "summary": "For Canadian and US accounts, HubSpot’s Sept. 16 Pay-as-You-Go default applies now. GTM Seats and per-email credits are EMEA-only so far, priced in euros.",
            "date_modified": "2026-10-09T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "HubSpot pricing",
                "HubSpot Credits",
                "consumption pricing",
                "martech procurement",
                "contract renewal",
                "seat-based pricing"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/how-to-check-a-martech-vendor-mcp-server",
            "content_html": "<p>One line of JSON is the reason this post exists. I fetched it this morning, from a marketing platform a lot of e-commerce teams already pay for.</p><pre><code>curl https://mcp.klaviyo.com/.well-known/oauth-authorization-server\n</code></pre><p>Among the ordinary endpoints in the response sits <code>&quot;client_id_metadata_document_supported&quot;: false</code>.</p><p>In plain terms: Klaviyo’s MCP server is telling every client that asks that it does not support the client registration mechanism the Model Context Protocol moved to seven weeks ago, and that clients should use the one the same revision deprecated. That is not a leak or a gotcha. It is a public, machine-readable statement of posture, and on September 16, 2026 it is the closest thing to a straight answer any of the three martech vendors I checked will give you before you authenticate.</p><p>I should say what this post is and is not. <strong>I have not connected a vendor’s MCP server to a client environment, and this is not a security assessment of anybody’s product.</strong> It is a procurement question with a procedure attached: which revision of the protocol is the vendor selling, and how do you find out before you sign. Everything below was verified at its primary source on September 16, 2026 — three vendor documentation pages, two specification pages, and unauthenticated requests I ran myself. Where a source disagreed with my notes, the source won. That happened twice.</p><p>The one thing I have first-hand is the other side of the counter. This site registers agent tools of its own, which is how I found out that the check below would not work on me either.</p><h2>Quick answer</h2><p>As of September 16, 2026, none of Braze, Klaviyo or HubSpot states in its documentation which revision of the Model Context Protocol its server implements, and none discloses one at its endpoint before authentication. The July 28, 2026 revision defines a direct way for a client to ask a server its version, but every endpoint I tested today answers with an authentication error first. The clearest signal available is Klaviyo’s own server metadata, which reports that it does not support the client registration mechanism that revision moved to, and offers the one it deprecated. So checking a vendor takes three unauthenticated commands and about a minute, and the right procurement question is not &quot;do you support MCP&quot; — it is which revision, and how you can verify it yourself.</p><p><strong>Every fact here has a verification date of September 16, 2026 and a shelf life measured in weeks.</strong> Vendor metadata documents change without a changelog entry, and two of the three pages below carry no usable published date at all.</p><h2>What changed in the MCP specification on July 28, 2026, and why should a buyer care?</h2><p>The Model Context Protocol shipped a revision on July 28, 2026 that retired the handshake, deprecated Dynamic Client Registration and set the protocol’s first formal deprecation policy. The announcement, by lead maintainers David Soria Parra and Den Delimarsky, describes a stateless core: &quot;we’ve officially retired the <code>initialize</code>/<code>initialized</code> exchange,&quot; and &quot;Each request now travels on its own, carrying its protocol version, client identity, and client capabilities in <code>_meta</code>.&quot; On Streamable HTTP, the versioning page adds, that value is &quot;also carried in the <code>MCP-Protocol-Version</code> header&quot;. So there is no handshake left to read a version from: either a version travels with the request, or nobody states one.</p><p>Registration moved in the same release: &quot;Dynamic Client Registration itself is now formally deprecated in favor of CIMD.&quot; The August post on <a href=\"https://www.amirmousavi.com/articles/what-ai-agents-can-do-in-your-martech\">what AI agents can do in your ad accounts and CRM</a> works through that mechanism in full, so I will not re-derive it here. What is new for a buyer’s timeline is a published clock: deprecated features &quot;remain in the specification for at least twelve months,&quot; with a ninety-day expedited-removal exception, and removal comes &quot;in a future version&quot; the announcement does not name.</p><p>Here is my first correction. My working note said the July 28 revision removed the handshake and therefore any way to read a server’s version. Wrong on the second half: the handshake was replaced by per-request metadata, not by nothing, and a separate <code>server/discover</code> RPC exists for clients that want to ask up front, though the versioning page adds that &quot;Calling it is optional&quot; for the client. The question did not become unanswerable; on these servers the answer sits behind the authorization wall, and a buyer running an evaluation does not yet have an account.</p><h2>Which revision do Braze, Klaviyo and HubSpot say they implement?</h2><p>None of them, in writing, anywhere I could find. Every cell below was read off a vendor page or an unauthenticated HTTP response on September 16, 2026.</p><table><thead><tr><th>Vendor</th><th>MCP endpoint</th><th>Doc states a revision?</th><th>Registration advertised</th><th><code>token_endpoint_auth_methods_supported</code></th><th>PKCE methods</th><th>Documented read-only switch</th><th>Regional endpoints</th><th>Usable doc date</th></tr></thead><tbody><tr><td>Braze</td><td><code>mcp.braze.com/mcp</code>, <code>mcp.braze.eu/mcp</code></td><td><strong>No</strong></td><td><code>registration_endpoint</code> on the US authorization server, <strong>none</strong> on the EU one</td><td><code>[&quot;none&quot;]</code> on both</td><td><code>S256</code></td><td>Not documented; access mirrors the dashboard user</td><td>US and EU</td><td>Release note July 23, 2026, &quot;Early access&quot;; &quot;General availability&quot; in the September 17, 2026 note</td></tr><tr><td>Klaviyo</td><td><code>mcp.klaviyo.com/mcp</code></td><td><strong>No</strong></td><td><code>registration_endpoint</code>, plus <code>client_id_metadata_document_supported: false</code></td><td><code>client_secret_basic</code>, <code>client_secret_post</code>, <code>none</code></td><td><code>plain</code>, <code>S256</code></td><td>Yes, <code>read-only=true</code> as a URL query parameter</td><td>Not documented</td><td>Connection page shows &quot;Updated 12 days ago&quot;; the overview page was restructured and shows &quot;Updated 1 day ago&quot;</td></tr><tr><td>HubSpot</td><td><code>mcp.hubspot.com</code></td><td><strong>No</strong></td><td>Neither mechanism, unchanged since August 21</td><td><code>[&quot;client_secret_post&quot;]</code></td><td><code>S256</code></td><td>Not documented</td><td>Not documented</td><td>None — the page’s <code>last-updated</code> meta tag holds the unrendered token <code>%2026-%0-%4</code></td></tr></tbody></table><p>Two columns need a warning. &quot;Doc states a revision&quot; means I searched each page for &quot;protocol&quot;, &quot;specification&quot;, &quot;version&quot; and &quot;2026-&quot; and found no sentence naming one. It does not mean the server fails to implement 2026-07-28, a negative nobody outside the vendor can prove and not the claim here. The metadata columns describe what an authorization server advertises, not what a client negotiates.</p><p>What each vendor does say is worth reading closely.</p><p><strong>Braze</strong> launched its remote server in the July 23, 2026 release note, labelled &quot;Early access&quot;. The documentation page describes &quot;a secure remote connection that lets AI tools like Claude and Cursor access non-PII Braze data,&quot; warns that &quot;Tools that expose user-level PII are not available,&quot; and answers the regions question with &quot;Either endpoint can reach any Braze cluster.&quot; No sentence states a protocol revision.</p><p><em>Updated October 9, 2026: Braze’s September 17, 2026 release note marks the remote server &quot;General availability&quot;, so it is no longer early access. The same note says access &quot;is limited by the signed-in user’s permissions and OAuth scopes&quot; and adds beta support for the Campaigns and Segments API and for Operator Connect, which lets an MCP client hand a brief to BrazeAI Operator to build campaigns, Canvases and segments in the dashboard (it cannot launch them). The documentation page still says &quot;Tools that expose user-level PII are not available.&quot; The Operator Connect page neither repeats nor contradicts that line: it says Operator Connect &quot;follows the same privacy and security model as BrazeAI Operator™&quot; and &quot;cannot perform actions the user could not perform directly.&quot; The PII line still describes the server’s own tools; whether a brief routed through Operator can reach profile data is a question to put to Braze in writing.</em></p><p><strong>Klaviyo</strong> publishes the most useful documentation of the three. Its connection page names the URL, the transport (&quot;Transport: Streamable HTTP&quot;) and, in the same block, &quot;Authentication method: OAuth (with dynamic client registration)&quot;. That is the only place any of the three describes its registration mechanism in prose, and it names the deprecated one. Klaviyo also documents six query parameters that shape the tool surface, including <code>read-only</code>, which &quot;disables any tools which can perform write actions on your Klaviyo account&quot;. No protocol revision appears.</p><p><strong>HubSpot</strong> still carries, today, the sentence &quot;Later in 2025, we will align with MCP specification requirements for OAuth 2.1 support.&quot; It is the closest thing on the page to a version commitment, and it names a year that ended eight months ago.</p><h2>How do you check a server yourself, in three commands?</h2><p>Three unauthenticated requests. About a minute, nothing touched, no account needed.</p><p><strong>One. Ask the endpoint what it protects.</strong></p><pre><code>curl https://mcp.braze.eu/.well-known/oauth-protected-resource\n</code></pre><p>This is RFC 9728 protected-resource metadata: the canonical resource identifier, the scopes the server recognises, and — the part people skip — which authorization server it delegates to.</p><p><strong>Two. Follow that pointer to the authorization server and read its metadata.</strong> I ran this command against HubSpot in August and wrote up what came back in that August post; this is the same check against two more vendors, after the specification moved under all of them. The one thing to know is that the document does not always live on the MCP host: <code>mcp.braze.com/.well-known/oauth-authorization-server</code> returns <code>404</code>, because Braze’s protected-resource document points somewhere else.</p><p><strong>Three. Send one unauthenticated request and read the rejection.</strong></p><pre><code>curl -i -X POST https://mcp.klaviyo.com/mcp \\\n  -H &#x27;Content-Type: application/json&#x27; \\\n  -H &#x27;MCP-Protocol-Version: 2026-07-28&#x27; \\\n  -d &#x27;{&quot;jsonrpc&quot;:&quot;2.0&quot;,&quot;id&quot;:1,&quot;method&quot;:&quot;server/discover&quot;}&#x27;\n</code></pre><p>The rejection is the finding. Braze returns <code>401</code> with <code>WWW-Authenticate: Bearer resource_metadata=&quot;https://mcp.braze.com/.well-known/oauth-protected-resource/mcp&quot;, scope=&quot;mcp:tools mcp:resources mcp:operator&quot;</code>, a textbook RFC 9728 challenge handing a client the discovery document and the exact scopes it needs. Klaviyo returns <code>401</code> with <code>error=&quot;invalid_token&quot;</code>, HubSpot <code>401</code> naming its own resource metadata, and not one of the four endpoints returned an <code>MCP-Protocol-Version</code> header. Sending <code>tools/list</code> with a deliberately impossible version of <code>1999-01-01</code> also returns <code>401</code>, not <code>UnsupportedProtocolVersionError</code>. Authorization is evaluated before version negotiation, which is correct behaviour and also why the buyer’s question has no pre-sales answer.</p><p>My second correction is to my own notes, not to a vendor. My probe from earlier today recorded HubSpot’s <code>/mcp</code> path returning <code>404</code>, which reads like a finding and is not one. HubSpot’s integration guide says to connect &quot;to the HubSpot MCP server at <code>https://mcp.hubspot.com</code>&quot; — the root, no path segment — and POSTing there returns <code>401</code> with a proper challenge. A <code>404</code> on an MCP probe almost always means you guessed the path.</p><p>The Braze result deserves its own table; it is the one thing here I did not expect.</p><table><thead><tr><th>Document fetched, September 16, 2026</th><th>Issuer</th><th>Token endpoint</th><th>Registration endpoint</th></tr></thead><tbody><tr><td><code>mcp.braze.com/.well-known/oauth-protected-resource</code></td><td>names <code>https://dashboard.braze.com</code></td><td>—</td><td>—</td></tr><tr><td><code>mcp.braze.eu/.well-known/oauth-protected-resource</code></td><td>names <code>https://dashboard.braze.com</code></td><td>—</td><td>—</td></tr><tr><td><code>dashboard.braze.com/.well-known/oauth-authorization-server</code></td><td><code>https://dashboard.braze.com</code></td><td><code>https://rest.iad-01.braze.com/oauth/token</code></td><td><code>https://rest.iad-01.braze.com/oauth/register</code></td></tr><tr><td><code>dashboard-01.braze.eu/.well-known/oauth-authorization-server</code></td><td><code>https://dashboard-01.braze.eu</code></td><td><code>https://rest.fra-01.braze.eu/oauth/token</code></td><td><strong>none</strong></td></tr></tbody></table><p>Read the first two rows again. Both the US and the EU MCP endpoints name the same authorization server, whose token endpoint is a <code>rest.iad-01.braze.com</code> host. A separate European authorization server exists at <code>dashboard-01.braze.eu</code> with a Frankfurt token endpoint, but nothing in the EU endpoint’s discovery document points a client at it.</p><p>Be exact about what that means, because this kind of finding gets repeated badly. An OAuth discovery and token exchange is not customer data. Braze’s documentation says tools exposing user-level PII are not available, and says &quot;Either endpoint can reach any Braze cluster.&quot; What I verified is a fact about a discovery chain: a client following the EU endpoint’s published metadata is directed to the US-branded dashboard. I have not established where customer data is stored or processed, and I am not characterising anyone’s regulatory exposure. It is a question to ask Braze, not an answer.</p><h2>What does a vendor’s registration posture tell you about the twelve-month clock?</h2><p>More than the protocol revision does. You cannot learn a server’s revision before you authenticate; you can learn its registration posture in one command, and registration is where the July 28 revision moved.</p><ul>\n<li><strong>Klaviyo advertises Dynamic Client Registration and explicitly denies the replacement.</strong> A live <code>registration_endpoint</code> at <code>mcp.klaviyo.com/register</code>, and <code>client_id_metadata_document_supported: false</code>. Publishing that field as <code>false</code> is a decision, not an oversight.</li>\n<li><strong>Braze advertises Dynamic Client Registration on one region and no registration mechanism on the other.</strong> Neither Braze metadata document contains a <code>client_id_metadata_document_supported</code> field at all.</li>\n<li><strong>HubSpot advertises neither</strong>, exactly as it did on August 21. That posture and its consequences are the subject of the August post, and I am not going to re-derive them here.</li>\n</ul><p>Now the clock, carefully. The floor is at least twelve months from deprecation, with a ninety-day expedited exception, and removal comes &quot;in a future version&quot; that nobody has named. The earliest ordinary date on which Dynamic Client Registration becomes eligible for removal is late July 2027. Nothing breaks this quarter or next.</p><p>That is the point. This is a maintenance-commitment question rather than a security or urgency question, and the cheapest one to ask during an evaluation: a vendor advertising a deprecated mechanism with no published position on its replacement is carrying migration work it has not scheduled in public. You are asking whether the team behind the endpoint tracks the specification, and that tells you what three years of integration maintenance will feel like.</p><p>Two smaller flags fall out of the same metadata and need proportion. Advertising <code>&quot;none&quot;</code> as a token endpoint auth method, as Klaviyo and both Braze servers do, is ordinary under OAuth 2.1 for public clients that cannot hold a secret. Klaviyo also advertises <code>&quot;plain&quot;</code> beside <code>&quot;S256&quot;</code> in <code>code_challenge_methods_supported</code>, which is not the same as using it, but it earns a line in a vendor questionnaire.</p><h2>What did registering agent tools on my own site teach me about asking this?</h2><p>That the honest version of this check has a hole in it, and I am standing in it. This site exposes tools to agents through WebMCP, registered in the browser with <code>document.modelContext.registerTool()</code>, and each tool carries <code>annotations: { readOnlyHint: true }</code>, the closest thing I ship to a public statement of what the surface can do. Now run this post’s procedure against me. There is no <code>.well-known/oauth-protected-resource</code> to fetch, because there is no OAuth in front of a browser-side tool. There is no endpoint to POST to. And nowhere do I state which revision of the protocol my tool definitions target. My tools only read pages that are already public in two formats, so the stakes are not the same, but the omission is: I am doing exactly what I spent this morning noting that three vendors do.</p><h2>Six questions to put in an RFP instead of &quot;do you support MCP?&quot;</h2><p>Ask these in order. Each names the failure it prevents.</p><ol>\n<li><strong>Which revision of the MCP specification does your server implement today, and where is that stated in writing?</strong> Fails because &quot;we support MCP&quot; names a protocol family, not a revision. A server built to an earlier revision and one built to 2026-07-28 are different integration projects wearing the same three letters.</li>\n<li><strong>Does your server implement <code>server/discover</code>, and is it reachable before authentication?</strong> Fails silently. The versioning page calls it &quot;a mandatory RPC&quot; for servers but adds that &quot;Calling it is optional&quot; for clients, and nothing obliges a server to answer it without a token: all four endpoints I probed today returned <code>401</code>. Get the revision in writing instead.</li>\n<li><strong>Which client registration mechanism does your authorization server advertise, and what is your published position on Client ID Metadata Documents?</strong> Fails when you inherit a deprecated path with no dated migration. Klaviyo’s metadata answers it with <code>client_id_metadata_document_supported: false</code>; most vendors will not have written the answer anywhere, which is itself the answer.</li>\n<li><strong>Which token endpoint authentication methods and PKCE methods do you advertise?</strong> Fails at integration time, not evaluation time, and on the client you already standardised on. Three vendors, three different lists, and a client that speaks only one of them cannot connect.</li>\n<li><strong>Which regional endpoints exist, and what does each endpoint’s discovery document name as its authorization server?</strong> Fails on the assumption that a regional endpoint keeps the whole flow regional. Both of Braze’s MCP endpoints name the same authorization server today, which deserves a written answer from the vendor rather than an inference from you.</li>\n<li><strong>Which read-only or tool-scoping controls exist, and are they enforced server-side or set by the client?</strong> Fails where nobody looks. Klaviyo’s <code>read-only=true</code> is a query parameter in a client’s configuration file, so whoever edits that file controls it, and Klaviyo’s documentation notes those parameters &quot;can’t be controlled with the listed Claude connector or the listed ChatGPT app&quot; — the safest configuration is only available through the more manual setup path.</li>\n</ol><p>Questions one, three and five are the three I would keep. The weighted scorecard in <a href=\"https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack\">how to plan a martech stack before buying tools</a> is where they belong on a real evaluation, the integration questions in <a href=\"https://www.amirmousavi.com/articles/cdp-crm-and-marketing-automation\">CDP vs. CRM vs. marketing automation</a> are their older cousins, and the <a href=\"https://www.amirmousavi.com/resources/martech-stack-assessment\">interactive martech stack assessment</a> covers the surrounding architecture.</p><h2>My working take</h2><p>The protocol revision is not the risk, whatever a post opening on a specification release invites you to assume. Nothing here is broken, nothing stops working this year, and Dynamic Client Registration is good for another ten months under the specification’s ordinary twelve-month floor.</p><p>The finding is the unanswerability. Seven weeks after the most disruptive revision this protocol has had, a buyer cannot determine which revision a martech vendor’s server speaks without an account, and the specification’s own mechanism for answering that is behind the login on every endpoint I tried. That is a reasonable engineering decision made independently by three teams, and its aggregate effect is that &quot;do you support MCP?&quot; has become an unfalsifiable question inside a procurement process. The fix is not on the vendors’ side of the table: it is to ask a question with a checkable answer. The question after posture is price, and the rate cards answer it even less stably than the documentation answers this one. I read them in <a href=\"https://www.amirmousavi.com/articles/what-does-an-ai-agent-action-cost\">what one AI agent action actually costs</a>.</p><p>What I do not know is whether any of these servers implements 2026-07-28. I would guess most do or soon will, since the Tier 1 SDKs shipped with the revision, but a guess is worth nothing here. Nor do I know whether Klaviyo’s <code>client_id_metadata_document_supported: false</code> reflects a decision or a library default. Only Klaviyo can say.</p><p>What would change my take is one vendor publishing a version line. If any of the three adds a sentence naming a revision, the table above gains a &quot;yes&quot;, and the interesting question becomes whether anyone keeps it current. That is a better problem than the one we have.</p><h2>Frequently asked questions about checking a vendor’s MCP server</h2><h3>Does Klaviyo’s MCP server support the 2026-07-28 MCP specification?</h3><p>Klaviyo does not say, as of September 16, 2026. Its documentation names the URL, the transport and the authentication method — &quot;OAuth (with dynamic client registration)&quot; — but no protocol revision. Its authorization server metadata declares <code>client_id_metadata_document_supported: false</code>, so it does not offer the registration mechanism that revision moved to. That is a statement about registration, not about the revision implemented.</p><h3>Which MCP protocol version does HubSpot’s MCP server use?</h3><p>Not stated on any HubSpot page I could find on September 16, 2026. The MCP overview page still says &quot;Later in 2025, we will align with MCP specification requirements for OAuth 2.1 support,&quot; a roadmap line about a year that has ended. The server’s authorization metadata advertises <code>[&quot;client_secret_post&quot;]</code> and PKCE <code>S256</code>, and an unauthenticated request to <code>https://mcp.hubspot.com</code> returns <code>401</code> with an RFC 9728 challenge and no protocol version header.</p><h3>Is Dynamic Client Registration still allowed after the July 2026 MCP revision?</h3><p>Yes. The 2026-07-28 authorization specification says it &quot;is deprecated and retained for backwards compatibility,&quot; and the release announcement says it &quot;continues to work for backward compatibility, but will be removed in a future version.&quot; The deprecation policy gives deprecated features at least twelve months, with a ninety-day expedited exception, so late July 2027 is the earliest ordinary removal eligibility. No named removal date exists today, and the maintainers’ August 22, 2026 roadmap post names none either.</p><h3>Can I tell which MCP revision a server speaks without an account?</h3><p>Not on the four martech endpoints I tested on September 16, 2026. The specification defines <code>server/discover</code> as &quot;a mandatory RPC that returns the server’s supported protocol versions, capabilities, and identity&quot;, though the same page adds that &quot;Calling it is optional&quot; for a client, and Braze, Klaviyo and HubSpot all return <code>401</code> to it unauthenticated. Sending a deliberately unsupported version also returns <code>401</code> rather than an <code>UnsupportedProtocolVersionError</code>. Authorization is evaluated first, so the answer exists only after you have an account.</p><h3>Does Braze’s EU MCP endpoint keep everything in Europe?</h3><p>As of September 16, 2026, that is not what I verified. Both <code>mcp.braze.com</code> and <code>mcp.braze.eu</code> publish protected-resource metadata naming <code>https://dashboard.braze.com</code> as their authorization server, whose token endpoint is <code>https://rest.iad-01.braze.com/oauth/token</code>; a separate <code>dashboard-01.braze.eu</code> server exists with a Frankfurt token endpoint. An OAuth exchange is not customer data, and Braze’s documentation says either endpoint can reach any cluster. Ask Braze about residency directly.</p><h2>Sources I used</h2><p>Verified at source: September 16, 2026.</p><ul>\n<li><a href=\"https://blog.modelcontextprotocol.io/posts/2026-07-28/\">Model Context Protocol: &quot;The 2026-07-28 Specification&quot;, July 28, 2026</a></li>\n<li><a href=\"https://blog.modelcontextprotocol.io/posts/mcp-roadmap/\">Model Context Protocol: &quot;The New MCP Roadmap&quot;, August 22, 2026</a></li>\n<li><a href=\"https://modelcontextprotocol.io/docs/2026-07-28/learn/versioning\">Model Context Protocol: versioning, deprecation policy and <code>server/discover</code>, revision 2026-07-28</a></li>\n<li><a href=\"https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization\">Model Context Protocol: authorization, revision 2026-07-28</a></li>\n<li><a href=\"https://www.braze.com/docs/user_guide/brazeai/mcp_server\">Braze: the Braze MCP server documentation page</a></li>\n<li><a href=\"https://www.braze.com/docs/releases/2026/7_23_26\">Braze: July 23, 2026 release notes, remote MCP server, &quot;Early access&quot;</a></li>\n<li><a href=\"https://www.braze.com/docs/releases/2026/9_17_26/\">Braze: September 17, 2026 release notes, remote MCP server, &quot;General availability&quot;, with Operator Connect in beta</a></li>\n<li><a href=\"https://www.braze.com/docs/user_guide/brazeai/mcp_server/operator_connect\">Braze: Operator Connect, &quot;currently in beta and is available to select customers&quot;</a></li>\n<li><a href=\"https://developers.klaviyo.com/en/docs/connect_to_the_klaviyo_mcp_server\">Klaviyo: connect to the Klaviyo MCP server, page shows &quot;Updated 12 days ago&quot; on September 16, 2026</a></li>\n<li><a href=\"https://developers.klaviyo.com/en/docs/klaviyo_mcp_server\">Klaviyo: Klaviyo MCP server overview, restructured, page shows &quot;Updated 1 day ago&quot; on September 16, 2026</a></li>\n<li><a href=\"https://developers.hubspot.com/ai-tools/mcp\">HubSpot: MCP servers overview, still carrying the &quot;Later in 2025&quot; OAuth 2.1 line</a></li>\n<li><a href=\"https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server\">HubSpot: integrate with the remote HubSpot MCP server, endpoint and PKCE requirements</a></li>\n<li><a href=\"https://mcp.klaviyo.com/.well-known/oauth-authorization-server\">Klaviyo authorization server metadata, fetched September 16, 2026</a></li>\n<li><a href=\"https://mcp.hubspot.com/.well-known/oauth-authorization-server\">HubSpot authorization server metadata, fetched September 16, 2026</a></li>\n<li><a href=\"https://mcp.braze.com/.well-known/oauth-protected-resource\">Braze US protected-resource metadata, fetched September 16, 2026</a></li>\n<li><a href=\"https://mcp.braze.eu/.well-known/oauth-protected-resource\">Braze EU protected-resource metadata, fetched September 16, 2026</a></li>\n<li><a href=\"https://dashboard.braze.com/.well-known/oauth-authorization-server\">Braze US authorization server metadata, fetched September 16, 2026</a></li>\n<li><a href=\"https://dashboard-01.braze.eu/.well-known/oauth-authorization-server\">Braze EU authorization server metadata, fetched September 16, 2026</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/how-to-check-a-martech-vendor-mcp-server",
            "title": "How Do You Check a Martech Vendor’s MCP Server?",
            "summary": "Braze, Klaviyo and HubSpot state no MCP protocol revision, and Klaviyo declares CIMD unsupported. The three-command check, verified at source September 16, 2026.",
            "date_modified": "2026-09-16T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "Model Context Protocol",
                "vendor evaluation",
                "martech RFP",
                "OAuth metadata",
                "AI agents",
                "marketing operations"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/what-does-an-ai-agent-action-cost",
            "content_html": "<p>On August 31, 2026, Salesforce replaced a legal pricing document it had already replaced thirteen days earlier. I only know because I downloaded every live version I could find this morning, twelve of them, and diffed the 2026 ones in order.</p><p>The document is the Flex Credits Rate Card, linked from the Agentforce rates page. It is the schedule your Order Form points at when it says your organisation consumes credits &quot;at the applicable multiplier rate based on the Usage Type identified below.&quot; Across 2026 it went from one page to three. A June revision added a resolved service conversation as a billable row, and the two August revisions added four more: a decisioning meter, a worked sales lead, and two grades of Slackbot action.</p><p>One note on reading it, because the claim that machines cannot read the card is wrong in a specific way: a plain <code>curl</code> returns 139,008 bytes of <code>application/pdf</code>, a naive text scraper I wrote returns nothing because the text is drawn as glyph runs from subset fonts, and macOS PDFKit resolves the same file in under a second. The card is machine-readable by anything that renders.</p><p>What this post is and is not. <strong>I have implemented Adobe Campaign, Adobe Experience Platform and enterprise analytics stacks for large financial-services and telecom organisations, but I have never negotiated an Agentforce or a HubSpot credit contract for a client, and I have never seen a client’s Digital Wallet report.</strong> Everything below was verified at its primary source on September 8, 2026, against every document listed in Sources I used. Where a live page disagreed with my notes, the page won and I say so.</p><h2>Quick answer</h2><p>At the rates published on September 8, 2026, one standard Agentforce action costs $0.10 (20 Flex Credits at Salesforce’s list $500 per 100,000), one resolved service conversation costs $2.00 on Salesforce Help Agent (400 credits, a row that first appeared on the June 17 card) and $0.50 on HubSpot Customer Agent (50 credits at $0.010 each), and one qualified lead costs $2.00 on Salesforce against $1.00 on HubSpot. Adobe publishes credits per agent job, 0 to 100, and no dollar rate per credit, so its column is honestly blank. What I do with this is stop comparing platforms and start comparing billable-unit definitions, because that is where the money is.</p><p><strong>Verified at source on September 8, 2026, and a snapshot, not a standing price list.</strong> The card says usage types, tiers and multipliers &quot;may be updated from time to time&quot;, and Dreamforce (September 15 to 17) and UNBOUND (September 16 to 18) both land next week. Reopen the PDFs before quoting any figure after that.</p><h2>What changed on Salesforce’s Flex Credits rate card in August 2026?</h2><p><strong>Twelve URLs for this document return a PDF from Salesforce’s servers right now, carrying ten distinct footer dates back to May 2025, six of them dated in 2026.</strong> The rates page links exactly one, alongside the older Conversations card, so the rest sit live and unlinked. I checked all twelve on September 8, 2026, and two carry an identical &quot;February 23, 2026&quot; footer at different byte counts, so a date does not reliably identify a file. Here is the 2026 chain I compared, with the &quot;Updated as of&quot; line each carries on its last page.</p><table><thead><tr><th>Card, as footered</th><th>Pages</th><th>What it added against the version before it</th></tr></thead><tbody><tr><td>February 3, 2026</td><td>1</td><td>Agentforce actions, voice actions and prompts, plus a single Speech Foundations row. No Data 360 section at all</td></tr><tr><td>February 23, 2026</td><td>2</td><td>The whole <strong>Data 360</strong> section and its volume tiers, plus Speech to Text and Text to Speech</td></tr><tr><td>April 21, 2026</td><td>2</td><td><strong>No multiplier changed.</strong> One new clarification, that the sandbox multiplier covers scratch orgs, plus four cosmetic rewordings</td></tr><tr><td>June 17, 2026</td><td>3</td><td>Service: <strong>Help Agent Resolutions 400</strong>, production only, no sandbox column yet. Customer 360 Platform: &quot;Salesforce Record Operation (CRUD)&quot; and &quot;Salesforce Process Invocation (Flows, APEX)&quot;, both <strong>TBA</strong>. The pilot, scratch-org and &quot;may be updated&quot; clauses move to page one</td></tr><tr><td>August 18, 2026</td><td>3</td><td>A sandbox column throughout: Help Agent Resolutions becomes <strong>400 / 0</strong>, prompts and speech rows gain sandbox values. Personalization Decisioning <strong>100 per 1,000 decisions</strong>. The two headless rows unchanged apart from &quot;APEX&quot; becoming &quot;Apex&quot;</td></tr><tr><td>August 31, 2026</td><td>3</td><td>Sales: <strong>Customer Engagement, Leads Worked 400 / 320</strong>. Slack Workspace: <strong>Slackbot Standard Action 40, Slackbot Advanced Action 200</strong>. The two headless rows collapse into one <strong>&quot;Headless Platform Interaction&quot;, still TBA</strong></td></tr></tbody></table><p>No existing multiplier moved. A standard or custom Agentforce action has been 20 credits in production and 16 in sandbox on all twelve cards, voice actions 30 and 24, prompts 2, 4 and 16, and every Data 360 tier is identical from February 23 to August 31. Salesforce is not repricing what it already sold. It is adding meters.</p><p>The headless row is the one I would flag in an architecture review. From June 17 the card named two usage types, record operations and process invocations, both &quot;TBA&quot;. On August 31 both were replaced by a single &quot;Headless Platform Interaction&quot;, also &quot;TBA&quot;. Within eleven weeks the unit Salesforce means to bill headless API traffic by changed name, changed granularity, and still has no price. If you are scoping a composable build on Headless 360 today, that is a line item you cannot put a number against.</p><p><em>Updated October 9, 2026: the August 31 card is still the newest I can find and still the one the rates page links, byte for byte the file I read in September, and &quot;Headless Platform Interaction&quot; still reads &quot;TBA&quot;. What changed is that Salesforce has now explained the meter. Help article 005360285, &quot;Understand AIforce Impact&quot;, published September 17, 2026, says Salesforce is targeting November for agent registration: admins give each external agent its own identity (Agentic Identity) instead of letting it act as the person it assists. Every successful call a registered agent then makes, &quot;whether it arrives over Model Context Protocol (MCP) or direct API&quot;, is metered as a Headless Platform Interaction. Nothing is metered yet, and &quot;Salesforce will provide 30 days’ notice when a numerical multiplier is added and metering begins.&quot; The article renders only in a real browser; a plain fetch returns an empty shell.</em></p><p>Slackbot is the other novelty. Its footnote reads &quot;Multipliers are per Slack Workspace&quot; rather than per environment, a different unit of account from everything above it on the page.</p><p>The expiry clause is word for word identical on all twelve, and it is the one I would read first: &quot;Flex Credits must be used before the Order End Date set forth in the Usage Details table on the Order Form, and no rollover will be permitted.&quot;</p><h2>How do you turn one credit into a dollar on each platform?</h2><p>Not from the rate card. The Flex Credits card is a table of multipliers with no currency in it anywhere. The price lives on a separate page.</p><p><strong>Salesforce.</strong> The Agentforce pricing page lists Flex Credits at &quot;$500 USD/Per 100k Credits&quot;, which is $0.005 per credit, alongside a separate Conversations model at &quot;$2 USD/Per conversation&quot;. It is the only place I found the multipliers and the money on one screen, it carries no date, and it says it &quot;is provided for information purposes only and is subject to change.&quot; The Help Center articles people cite for this rate both returned an empty JavaScript shell to me today, so I cite the static pricing page and the dated PDFs together instead.</p><p><strong>HubSpot.</strong> &quot;HubSpot Credits cost $0.010 USD per credit. You can choose to either purchase credits up-front in capacity packs of 1,000 credits for $10 USD or enable Pay-as-You-Go […]&quot; The default overage setting depends on when the account bought extra credits: auto-upgrade for purchases before September 16, 2026, Pay-as-You-Go on or after. The catalogue prices Pay-as-You-Go at &quot;$0.010 per credit, invoiced in increments of 10 credits&quot;. The per-feature counts sit in the HubSpot Credits Rate Sheet inside the Product and Services Catalog on legal.hubspot.com. <em>Corrected October 9, 2026: this paragraph said Pay-as-You-Go was the default overage setting. It was not. On September 8, HubSpot’s catalogue and knowledge base both made auto-upgrade the default, and HubSpot switched the default for new purchases on September 16. The details are in <a href=\"https://www.amirmousavi.com/articles/hubspot-credits-and-seats-what-changed\">what changed in HubSpot’s credits and seats</a>.</em></p><p><strong>Adobe.</strong> No rate. Adobe’s AI credit consumption page, last updated May 21, 2026, defines an AI credit as &quot;a usage-based metric that quantifies the execution of actions or jobs&quot;, publishes fifteen agent-job rows between 0 and 100 credits, prices CX Enterprise Coworker at &quot;25 AI credits per Input&quot; for a limited introductory period, and warns that consumption &quot;may vary depending on the number of steps executed and iterations per step.&quot; Anyone showing you Adobe dollars has invented them.</p><p>One structural difference matters more than any individual number. Salesforce dates its card and keeps old versions online, so you can diff it, which is the whole reason this post exists. HubSpot’s rate sheet is an undated section of a living page: HubSpot keeps no version to diff, so a change can only be bracketed between web-archive captures, unless HubSpot dates it elsewhere, as it did for the September 16, 2026 billing change in its terms and knowledge base. (This sentence updated October 9, 2026.) Adobe dates its page and publishes no price.</p><h2>What does one outcome cost, side by side?</h2><p>Every credit figure below is read off a vendor document dated in the source column. Every dollar figure is that credit figure times the platform’s published list rate, and nothing else.</p><table><thead><tr><th>Outcome</th><th>Platform</th><th>Billable unit, as the document words it</th><th>Units</th><th>Published rate</th><th>Dollars</th><th>Source date</th></tr></thead><tbody><tr><td>Resolved service conversation</td><td>Salesforce</td><td>Help Agent Resolutions</td><td>400 Flex Credits</td><td>$500 / 100k</td><td><strong>$2.00</strong></td><td>Aug 31, 2026</td></tr><tr><td>Resolved service conversation</td><td>HubSpot</td><td>&quot;Resolve one conversation (text-based channels)&quot;</td><td>50 credits</td><td>$0.010 / credit</td><td><strong>$0.50</strong></td><td>undated</td></tr><tr><td>Lead handed to a seller</td><td>Salesforce</td><td>Customer Engagement, Leads Worked</td><td>400</td><td>$500 / 100k</td><td><strong>$2.00</strong></td><td>Aug 31, 2026</td></tr><tr><td>Lead handed to a seller</td><td>HubSpot</td><td>&quot;Recommend outreach for one lead&quot;</td><td>100 credits</td><td>$0.010 / credit</td><td><strong>$1.00</strong></td><td>undated</td></tr><tr><td>One agent action</td><td>Salesforce</td><td>Standard Action / Custom Action</td><td>20</td><td>$500 / 100k</td><td><strong>$0.10</strong></td><td>Aug 31, 2026</td></tr><tr><td>One workflow action</td><td>HubSpot</td><td>&quot;Execute one Breeze action in a workflow&quot; (renamed &quot;Execute one AI action in a workflow&quot; between September 4 and 20, 2026)</td><td>10 credits</td><td>$0.010 / credit</td><td><strong>$0.10</strong></td><td>undated</td></tr><tr><td>One answer about one record</td><td>HubSpot</td><td>&quot;Generate response to one prompt for one record&quot;</td><td>10 credits</td><td>$0.010 / credit</td><td><strong>$0.10</strong></td><td>undated</td></tr><tr><td>One piece of content</td><td>HubSpot</td><td>&quot;Generate one piece of content&quot;</td><td>1,000 credits</td><td>$0.010 / credit</td><td><strong>$10.00</strong></td><td>undated</td></tr><tr><td>One advanced Slack bot action</td><td>Salesforce</td><td>Slackbot Advanced Action</td><td>200</td><td>$500 / 100k</td><td><strong>$1.00</strong></td><td>Aug 31, 2026</td></tr><tr><td>1,000 personalisation decisions</td><td>Salesforce</td><td>Personalization Decisioning</td><td>100 per 1,000</td><td>$500 / 100k</td><td><strong>$0.50</strong></td><td>Aug 31, 2026</td></tr><tr><td>One audience ideation job</td><td>Adobe</td><td>Audience Agent, audience / account ideation</td><td>50 AI credits</td><td>not published</td><td>—</td><td>May 21, 2026</td></tr><tr><td>One journey analysis job</td><td>Adobe</td><td>Journey Agent, journey analysis</td><td>50 AI credits</td><td>not published</td><td>—</td><td>May 21, 2026</td></tr><tr><td>One Coworker input</td><td>Adobe</td><td>CX Enterprise Coworker, per Input</td><td>25 AI credits</td><td>not published</td><td>—</td><td>May 21, 2026</td></tr></tbody></table><p>The three Adobe dollar cells are blank on purpose. Adobe publishes the consumption and not the rate, so a dollar there would be a number I made up.</p><p>A granular action costs $0.10 on both major platforms, from opposite directions: 20 credits at half a cent, or 10 credits at a cent. The divergence is at the outcome layer, where Salesforce is four times HubSpot on a resolved conversation and twice on a lead. That gap is not a discount argument. It is a scope argument.</p><h2>Why do the published comparisons disagree with the rate card?</h2><p>Because most of them price a different unit, and some price a two-year-old document.</p><p>Cross-vendor per-resolution comparisons exist and some are good. SaaStr’s Jason Lemkin, February 2026, lists Intercom Fin at $0.99 per resolution, Zendesk from $1.50, and Salesforce at &quot;Flex Credits at $0.10 per action&quot;. The independent reference site aiagentforcustomerservice.com opens on &quot;From $0.50 (HubSpot Breeze) to $2 per conversation (Salesforce Agentforce)&quot;. Its pricing tables are stamped &quot;Last verified July 2026&quot; while its footer reads &quot;Updated 7 September 2026&quot;, updated yesterday, nearly twelve weeks after the resolution row first appeared on the card, and the phrase &quot;Help Agent&quot; still appears nowhere on the page. SaaStr has the better excuse: it was published on February 17, 2026, months before the row existed.</p><p>So the correction is not that nobody has compared. It is that the $2.00 everyone quotes for Salesforce is per <em>conversation</em>, the $2.00 on the current card is per <em>resolution</em>, and they come from two different documents.</p><p>The per-conversation price is the Agentforce Conversations Rate Card, still linked from the same rates page today, whose last line reads &quot;Updated as of December 2024&quot; and whose entire table is one row: multiplier 1 per conversation, for ASA Messaging, Sales Coach and SDR. The per-resolution price is 400 Flex Credits on the August cards. Salesforce’s announcement of that model, dated June 25, 2026, sets the condition: &quot;If the customer asks for a human or walks away unhappy, there is no charge.&quot; It also says &quot;Both Data 360 and Agentforce are unmetered during the agent interaction&quot;, and puts Help Agent generally available in July 2026.</p><p>So the two identical figures buy different things. Two dollars per conversation is charged whatever happens. Two dollars per resolution is charged only when the agent finishes alone, with the underlying actions not separately metered during the interaction. A shop paying per action would spend the same $2.00 on twenty standard actions, closed case or not.</p><p>The single-vendor conversion is already covered, honestly. GAT Solutions published a Flex Credits in dollars page verified on August 19, 2026 against the August 18 card, converting Help Agent Resolutions to $2.00. It carries no Leads Worked row and no Slackbot row, because those landed twelve days later. Salesforce Dictionary’s Data 360 cost-control piece, updated on September 4, 2026, still works from the April 21 card. Both went stale because the source moved, the risk this post is betting against.</p><h2>What does your included allowance actually buy?</h2><p>This is the number I would put in front of a CFO, because it converts an allowance into work.</p><table><thead><tr><th>Plan, as published</th><th>Included allowance</th><th>List value</th><th>What that buys at the published outcome rate</th></tr></thead><tbody><tr><td>Salesforce Agentforce Max Editions (formerly Agentforce 1), from $550 user/month</td><td>2.75M Flex Credits per org per year</td><td>$13,750</td><td>6,875 Help Agent resolutions a year, about 570 a month. Or 137,500 standard actions</td></tr><tr><td>HubSpot Starter</td><td>500 credits per month</td><td>$5</td><td>10 resolved conversations</td></tr><tr><td>HubSpot Professional</td><td>3,000 credits per month</td><td>$30</td><td>60 resolved conversations, or 30 recommended leads, or 3 pieces of content</td></tr><tr><td>HubSpot Enterprise</td><td>5,000 credits per month</td><td>$50</td><td>100 resolved conversations</td></tr><tr><td>HubSpot Data Hub / Customer Platform</td><td>500 / 5,000 / 10,000 by edition</td><td>$5 / $50 / $100</td><td>up to 200 resolved conversations at Enterprise</td></tr><tr><td>Adobe</td><td>not published on the credit-consumption page</td><td>—</td><td>—</td></tr></tbody></table><p><em>Updated October 9, 2026: this row read &quot;Agentforce 1 Editions&quot; with 2.5M Flex Credits ($12,500, about 520 resolutions a month). On September 3, 2026, Salesforce replaced Agentforce 1 with Max Editions, which &quot;include 2.75 million Flex Credits&quot; at the same $550 per user per month, and its pricing page now lists &quot;2.75M Flex Credits per org per year&quot;. The same announcement says Max editions will later &quot;include an allocation for Headless 360 capacity&quot;, the meter described above.</em></p><p>The HubSpot allowances come from the Included Credits table in the catalogue, and HubSpot is blunt about their purpose: included credits let customers &quot;try AI-powered features&quot;.</p><p>Sixty resolved conversations a month is a pilot. Three pieces of content is an afternoon. Neither is a service desk. That is what an allowance is for, but it is arithmetic that belongs before the pilot rather than after it.</p><p>Both platforms forbid rollover, in different terms. HubSpot’s credits expire monthly. Salesforce’s expire at the Order End Date, the harsher of the two if your ramp is slower than your term, because unused credits from a multi-year commitment die at once. The <a href=\"https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack\">lifecycle cost section of my martech stack guide</a> argues for a three-year model expressed as a range. A metered line item is where that stops being theoretical: the same contract can produce a bill of $0 or of six figures, and both are failures for different reasons.</p><h2>What five things should a stack audit record for a metered line item?</h2><p>For every AI line item in an inventory, record five fields and quote the clause each comes from. Not a summary of the clause. The clause.</p><p><strong>1. The billable unit, in the vendor’s own words.</strong> HubSpot’s is &quot;Resolve one conversation (text-based channels)&quot;, which excludes voice by construction. Salesforce’s is &quot;Help Agent Resolutions&quot;, conditioned by an announcement rather than the card. Adobe’s is &quot;an agent job&quot;. Three vendors, three units, one word on the slide.</p><p><strong>2. Whether the meter runs during the outcome.</strong> Salesforce says Data 360 and Agentforce are &quot;unmetered during the agent interaction&quot; for Help Agent. That clause is the difference between 400 credits all-in and 400 credits plus twenty actions at 20 each, and it is not on the rate card.</p><p><strong>3. The overage rate and its granularity.</strong> HubSpot’s Pay-as-You-Go is &quot;$0.010 per credit, invoiced in increments of 10 credits&quot;. Salesforce’s card publishes no overage mechanism at all. Adobe publishes neither.</p><p><strong>4. The expiry term, quoted.</strong> &quot;Flex Credits must be used before the Order End Date set forth in the Usage Details table on the Order Form, and no rollover will be permitted.&quot; Identical on all twelve cards I read. Do not paraphrase it into &quot;credits expire annually&quot;, because an Order End Date is not a year.</p><p><strong>5. The usage report and the spending cap, by name.</strong> Salesforce names Digital Wallet on its pricing page. HubSpot describes a credits workspace with a global account limit, per-feature limits, alerts, and the ability to pause a feature. Adobe names no reporting surface. A meter you cannot read or cap is one you have to trust, and I would price that into the contract.</p><p>Those five belong in the inventory step of a stack audit. The <a href=\"https://www.amirmousavi.com/resources/martech-stack-assessment\">interactive MarTech Stack Assessment</a> covers the architecture questions around them, and the <a href=\"https://www.amirmousavi.com/resources/martech-glossary\">MarTech glossary</a> defines the vocabulary these rate cards assume you share. The same inventory row should record whether the vendor’s agent interface is even checkable, which is the subject of <a href=\"https://www.amirmousavi.com/articles/how-to-check-a-martech-vendor-mcp-server\">how to check a martech vendor’s MCP server</a>.</p><h2>What have I seen, and not seen, consumption pricing do?</h2><p>I have not negotiated one of these contracts, so I will be careful about which parts of my experience transfer.</p><p>The forecasting problem transfers. On a financial-services programme the work that mattered was getting data architects, DBAs, developers and external vendors to agree on the shape of the data before any of it moved, and the arguments were about row counts, event volumes and reprocessing. Those are exactly the billable units on the Data 360 half of the card. Unification is 75,000 credits per million rows at base tier and 15,000 at Tier 4, and the tiers &quot;reset on the first day of each calendar month&quot;, so the same million rows costs $375 or $75 depending on what else the org did that month. Procurement cannot answer that; the people who can are rarely in the room where the AI contract is signed. Which system owns which field, the question in <a href=\"https://www.amirmousavi.com/articles/cdp-crm-and-marketing-automation\">CDP vs. CRM vs. marketing automation</a>, is now a billing question too.</p><p>Smaller and more personal: I built an event ticketing marketplace end to end on per-request cloud billing and per-transaction payment fees. Modelling usage before launch taught the same lesson these cards teach. The unit definition is almost the whole thing, and you find out whether you got it right on the first invoice.</p><p>Then there is this site. Every article and resource here is published as Markdown as well as HTML, in both languages, because an agent should not have to render anything to read it. An answer engine that cannot render the PDF has to take its numbers from a page that already quoted it, which is how the April card’s figures were still circulating this month. Same failure mode, from the other side, in <a href=\"https://www.amirmousavi.com/articles/what-ai-agents-can-do-in-your-martech\">what AI agents can do in your ad accounts and CRM</a>: the number that matters sits in the document nobody opened.</p><h2>A checklist for pricing a metered AI line item</h2><ol>\n<li><strong>Open the rate card yourself and note its version line.</strong> Fails when you quote a comparison article instead: two careful pages I read today work from cards three weeks and four and a half months old.</li>\n<li><strong>Find the dollar rate, which lives on a different page from the multipliers.</strong> Fails silently on Salesforce, where the card carries no currency at all.</li>\n<li><strong>Write the billable unit as a full sentence in the vendor’s words, then ask what it excludes.</strong> Fails on &quot;resolution&quot;: HubSpot’s excludes non-text channels, Salesforce’s excludes escalated and unhappy interactions.</li>\n<li><strong>Ask in writing what else meters during the outcome.</strong> Fails when an all-in outcome price quietly sits on top of per-action metering nobody disclaimed.</li>\n<li><strong>Convert the included allowance into a monthly volume of the outcome you need.</strong> Fails as a pilot that succeeds and cannot scale: 3,000 HubSpot credits is 60 resolved conversations a month, 2.75M Flex Credits about 570 (<em>updated October 9, 2026: was 2.5M and 520 before Salesforce’s September 3 edition change</em>).</li>\n<li><strong>Quote the expiry clause into the decision record, and name the usage report and hard cap before signature.</strong> Fails at renewal, and after the first surprise invoice.</li>\n<li><strong>Flag every TBA row and refuse to design against it.</strong> Fails on Headless 360 today: an unpriced meter on a signed schedule is an open position.</li>\n</ol><p>Steps three and four are the ones I would not skip under deadline pressure.</p><h2>My working take</h2><p>The interesting number is not $2.00 against $0.50. It is that Salesforce added four billable rows to a legal schedule in thirteen days and the published comparisons had not noticed eight days later. Consumption pricing moves faster than the content that explains it, which makes any per-outcome comparison, including this one, a snapshot with a short half-life. A table without a verification date on it is decoration.</p><p>Advising a team choosing between these platforms this month, I would decide on document behaviour rather than the headline rate. The three postures above, dated and archived, undated and living, dated with no price, will still be true in six months when the multipliers are not.</p><p>What I do not know, and will not estimate, is what any of this costs in practice: every dollar here is list price times a published multiplier, and I have not seen an invoice for any of these products. One thing would change my mind fast: if Salesforce puts a multiplier on Headless Platform Interaction, metered API access becomes an architecture constraint rather than a footnote. That is the row I am watching.</p><h2>Frequently asked questions about AI agent action costs</h2><h3>How much does one Agentforce action cost?</h3><p>A standard or custom Agentforce action is 20 Flex Credits in production and 16 in sandbox, on every version of the rate card from February 23 through August 31, 2026. At the list rate on Salesforce’s pricing page, $500 per 100,000 credits, that is $0.10 per action, and a voice action is 30 credits, or $0.15.</p><h3>What does Salesforce charge per resolved conversation?</h3><p>The August 31, 2026 card lists Help Agent Resolutions at 400 credits in production and 0 in sandbox, which is $2.00 at list. That row first appeared on the June 17, 2026 card; the August 18 card added its sandbox value. Salesforce’s June 25, 2026 announcement adds the condition: &quot;If the customer asks for a human or walks away unhappy, there is no charge.&quot; A separate, older model still on sale charges $2 per conversation regardless of outcome.</p><h3>How do HubSpot credits compare to Salesforce Flex Credits?</h3><p>They are different sizes. A HubSpot credit is $0.010 and a Flex Credit $0.005 at list, so raw counts are not comparable. Normalised to outcomes on September 8, 2026: a resolved text conversation is 50 HubSpot credits ($0.50) against 400 Flex Credits ($2.00); a recommended lead is 100 credits ($1.00) against 400 ($2.00); one workflow or agent action is $0.10 on both.</p><h3>What does an Adobe AI credit cost in dollars?</h3><p>Adobe does not publish one. Its AI credit consumption page, last updated May 21, 2026, gives credits per agent job (0 for knowledge-based troubleshooting, 25 for most Audience and Journey Agent jobs, 100 for site modernisation, 25 per Coworker input) but no rate per credit, and warns consumption &quot;may vary depending on the number of steps executed and iterations per step.&quot;</p><h3>Do unused AI credits roll over?</h3><p>Not on either platform. Salesforce’s card, unchanged from February 3 through August 31, 2026, says Flex Credits &quot;must be used before the Order End Date set forth in the Usage Details table on the Order Form, and no rollover will be permitted.&quot; HubSpot’s credits page says included credits refresh monthly and &quot;Any unused credits simply expire at the end of the month and don’t carry over.&quot; Two very different risks.</p><h2>Sources I used</h2><p>Verified at source: September 8, 2026.</p><ul>\n<li><a href=\"https://www.salesforce.com/agentforce/rates/\">Salesforce: Agentforce &amp; Data 360 Rate Cards, the page that links the current card</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Flex-Credits-Rate-Card-08.31.2026.pdf\">Salesforce: Flex Credits Rate Card, &quot;Updated as of August 31, 2026&quot; (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Flex-Credits-Rate-Card-06.17.2026.pdf\">Salesforce: Flex Credits Rate Card, &quot;Updated as of June 17, 2026&quot; (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Flex-Credits-Rate-Card-08.18.2026.pdf\">Salesforce: Flex Credits Rate Card, &quot;Updated as of August 18, 2026&quot; (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Flex-Credits-Rate-Card-04.21.2026.pdf\">Salesforce: Flex Credits Rate Card, &quot;Updated as of April 21, 2026&quot; (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Flex-Credits-Rate-Card-as-of-02.23.26.pdf\">Salesforce: Flex Credits Rate Card, &quot;Updated as of February 23, 2026&quot; (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Flex-Credits-Rate-Card-02.23.2026.pdf\">Salesforce: Flex Credits Rate Card, a second live URL with the same &quot;February 23, 2026&quot; footer (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Flex-Credits-Rate-Card-02.03.2026.pdf\">Salesforce: Flex Credits Rate Card, &quot;Updated as of February 3, 2026&quot;, one page (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/Flex-Credits-Rate-Card-as-of-10.24.25.pdf\">Salesforce: Flex Credits Rate Card, &quot;Updated as of October 24, 2025&quot;, live and unlinked (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/white-papers/Rate-Card-Flex-Credits.pdf\">Salesforce: Flex Credits Rate Card, &quot;Updated as of May 2025&quot;, the oldest version still live (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Rate-Card-Agentforce.pdf\">Salesforce: Agentforce Conversations Rate Card, &quot;Updated as of December 2024&quot; (PDF)</a></li>\n<li><a href=\"https://www.salesforce.com/agentforce/pricing/\">Salesforce: Agentforce pricing — $500 per 100k credits, $2 per conversation</a></li>\n<li><a href=\"https://www.salesforce.com/news/stories/salesforce-simplifies-editions-2026/\">Salesforce: &quot;New Salesforce Editions Bundle Everything Businesses Need for Agentic Transformation&quot;, September 3, 2026, Max Editions with 2.75M Flex Credits</a></li>\n<li><a href=\"https://help.salesforce.com/s/articleView?id=005360285&amp;type=1\">Salesforce Help: &quot;Understand AIforce Impact&quot;, article 005360285, published September 17, 2026, renders only in a browser</a></li>\n<li><a href=\"https://www.salesforce.com/news/stories/agentforce-help-agent-announcement/\">Salesforce: Agentforce Help Agent announcement, June 25, 2026</a></li>\n<li><a href=\"https://www.hubspot.com/products/artificial-intelligence/credits\">HubSpot: HubSpot Credits — $0.010 per credit, monthly expiry</a></li>\n<li><a href=\"https://legal.hubspot.com/hubspot-product-and-services-catalog\">HubSpot: Product &amp; Services Catalog — the Credits Rate Sheet and Included Credits</a></li>\n<li><a href=\"https://www.hubspot.com/company-news/hubspots-customer-agent-and-prospecting-agent-now-you-pay-when-the-task-is-complete\">HubSpot: outcome-based pricing for Customer Agent and Prospecting Agent, updated April 13, 2026</a></li>\n<li><a href=\"https://experienceleague.adobe.com/en/docs/cx-enterprise-ai/experience-cloud-ai/overview/ai-credit-consumption\">Adobe: AI credits consumption, last update May 21, 2026</a></li>\n<li><a href=\"https://www.gatechsolutionsllc.com/insights/salesforce-flex-credits-rate-card\">GAT Solutions: Salesforce Flex Credits Rate Card in Dollars, verified August 19, 2026</a></li>\n<li><a href=\"https://salesforcedictionary.com/blogs/data-360-flex-credits-cost-control-2026\">Salesforce Dictionary: Data 360 Flex Credits cost control, last updated September 4, 2026</a></li>\n<li><a href=\"https://www.saastr.com/salesforce-now-has-3-pricing-models-for-agentforce-and-maybe-right-now-thats-the-way-to-do-it\">SaaStr, Jason Lemkin: Salesforce now has 3+ pricing models for Agentforce, February 2026</a></li>\n<li><a href=\"https://aiagentforcustomerservice.com/\">aiagentforcustomerservice.com: independent pricing reference, tables &quot;Last verified July 2026&quot;, footer &quot;Updated 7 September 2026&quot;</a></li>\n<li><a href=\"https://www.salesforce.com/dreamforce/\">Salesforce: Dreamforce, September 15–17, 2026</a></li>\n<li><a href=\"https://unbound.hubspot.com/\">HubSpot: UNBOUND, September 16–18, 2026, Boston</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/what-does-an-ai-agent-action-cost",
            "title": "What Does One AI Agent Action Actually Cost?",
            "summary": "Salesforce revised its Flex Credits rate card twice in 13 days. What one AI agent action costs on Salesforce, HubSpot and Adobe, verified September 8, 2026.",
            "date_modified": "2026-09-08T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "AI pricing",
                "consumption pricing",
                "Flex Credits",
                "martech procurement",
                "Agentforce",
                "HubSpot Credits"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/three-layers-ai-crawler-access",
            "content_html": "<p>I was a few paragraphs into a post about Cloudflare’s September 15 change when I stopped to check my own site, because writing &quot;here is what your edge does&quot; without looking at my own edge is how you end up issuing a correction in public.</p><p>Three commands.</p><pre class=\"language-bash\"><code class=\"language-bash\"><span class=\"token function\">dig</span> +short NS amirmousavi.com\n<span class=\"token function\">dig</span> +short amirmousavi.com\n<span class=\"token function\">curl</span> -sI https://amirmousavi.com <span class=\"token operator\">|</span> <span class=\"token function\">grep</span> -iE <span class=\"token string\">&quot;^(server|cf-|x-vercel)&quot;</span>\n</code></pre><p>The nameservers came back <code>vern.ns.cloudflare.com.</code> and <code>paige.ns.cloudflare.com.</code>, which is what I expected. The A records came back <code>64.29.17.1</code> and <code>216.198.79.1</code>, which is not what I expected: those are Vercel addresses, not Cloudflare addresses. The response headers came back <code>server: Vercel</code> and <code>x-vercel-id: yul1::…</code>, and nothing else. No <code>cf-ray</code>. No <code>cf-cache-status</code>. Not one Cloudflare header on the whole response.</p><p>Cloudflare runs my DNS and nothing else. Requests resolve through Cloudflare’s nameservers and then go straight to Vercel. Every AI bot control Cloudflare ships, including the categories everyone was writing about in August and the default that moves on September 15, sits at an edge my traffic never touches.</p><p>My robots.txt does not say that. It cannot: it is a text file about preferences, served by the same origin either way. The nameserver lookup does not say it either, and that is the trap, because nameservers tell you who <em>could</em> be in the path rather than who <em>is</em>. Only the second and third commands settle it.</p><p>That is the post, demonstrated on one domain: three different surfaces will each tell you a different story about who can read your site, and only one of them is in the request path.</p><h2>Quick answer</h2><p>Three layers decide whether an AI engine can read your site, and they do not agree with each other. <strong>robots.txt is advisory</strong>: Perplexity documents that its user-triggered fetcher &quot;generally ignores robots.txt rules,&quot; and Google documents the same behavior for its entire user-triggered fetcher class, including the <code>Google-Agent</code> token added on March 20, 2026. <strong>The CDN or edge is enforced</strong>: it returns a 403 regardless of what any bot promises, and a robots.txt-parsing checker structurally cannot see it. <strong>Web Bot Auth is cryptographic and experimental</strong>: Google’s own documentation says &quot;Not all Google user agents are using Web Bot Auth.&quot; What I do instead of trusting a checker: run <code>dig</code> and <code>curl</code> against my own hostname first, treat robots.txt as a published preference rather than a control, and keep <code>ai-input=yes</code> in my Content-Signal because being readable by answer engines is the point of the site.</p><h2>What did three commands tell me about my own edge?</h2><p>They told me which layer is real on my domain, and the answer took two of the three to reach.</p><p><code>dig +short NS amirmousavi.com</code> returns Cloudflare nameservers. On its own that sentence is compatible with two completely different architectures: a site proxied through Cloudflare’s network, and a site using Cloudflare only as an authoritative DNS host. The industry shorthand is orange cloud versus grey cloud, and it is invisible from outside the dashboard unless you look at what the record resolves to.</p><p><code>dig +short amirmousavi.com</code> is where it resolves. A proxied record answers with a Cloudflare anycast address from the ranges Cloudflare publishes at <code>cloudflare.com/ips-v4</code>. Mine answers <code>64.29.17.1</code> and <code>216.198.79.1</code>, which are not in that list. <code>www</code> resolves through <code>1c2f67713588e1c5.vercel-dns-017.com.</code> to <code>64.29.17.65</code> and <code>216.198.79.65</code>. That is a Vercel edge, reached directly.</p><p><code>curl -sI</code> confirms it from the other end. The apex returns <code>HTTP/2 308</code> to <code>https://www.amirmousavi.com/</code>, so I checked the destination as well; <code>www</code> returns <code>HTTP/2 200</code> with <code>server: Vercel</code>, <code>x-vercel-cache: HIT</code>, and <code>x-vercel-id: yul1::…</code>. A Cloudflare proxy adds <code>cf-ray</code> on essentially every response. There is no <code>cf-ray</code> here.</p><p>So the three layers, plus a fourth surface most people miss, and where each one lives:</p><table><thead><tr><th>Layer</th><th>What it controls</th><th>Advisory or enforced</th><th>Who honors it</th><th>Source and date</th></tr></thead><tbody><tr><td><code>robots.txt</code></td><td>Which paths a crawler <em>should</em> request, by user-agent token</td><td>Advisory. A file the client chooses to read</td><td>Search crawlers largely do. User-triggered fetchers largely do not: Perplexity-User &quot;generally ignores robots.txt rules&quot;; Google’s user-triggered fetchers &quot;generally ignore robots.txt rules&quot;</td><td><a href=\"https://docs.perplexity.ai/guides/bots\">Perplexity crawler docs</a> (read August 21, 2026) · <a href=\"https://developers.google.com/crawling/docs/crawlers-fetchers/google-user-triggered-fetchers\">Google user-triggered fetchers</a> (updated August 19, 2026)</td></tr><tr><td>CDN or edge bot rules</td><td>Whether the request gets a response at all, by category, IP, signature and user agent</td><td>Enforced. The decision happens in the request path</td><td>Nobody has to honour it. It is applied to them</td><td><a href=\"https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/\">Cloudflare: Block AI Bots</a> (updated July 1, 2026) · <a href=\"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html\">AWS WAF Bot Control rule group</a> (read August 21, 2026)</td></tr><tr><td><code>NOARCHIVE</code> / <code>NOCACHE</code> robots meta tag</td><td>Whether Microsoft uses an already-indexed page in Bing Chat answers and in model training</td><td>Advisory, and vendor-specific. Lives in the page <code>&lt;head&gt;</code>, not in a site-level file</td><td>Microsoft, for its own surfaces</td><td><a href=\"https://blogs.bing.com/webmaster/september-2023/Announcing-new-options-for-webmasters-to-control-usage-of-their-content-in-Bing-Chat\">Bing Webmaster Blog, Fabrice Canel</a> (September 22, 2023)</td></tr><tr><td>Web Bot Auth</td><td>Whether a bot can cryptographically prove it is who it claims, per request</td><td>Neither yet. It is an identity signal an edge may act on</td><td>Google is testing it; Cloudflare and AWS WAF can consume it</td><td><a href=\"https://developers.google.com/crawling/docs/crawlers-fetchers/web-bot-auth\">Google: Web Bot Auth (Experimental)</a> (updated May 4, 2026)</td></tr></tbody></table><p>Four rows for three layers: the Bing meta tag is a fourth surface rather than a fourth layer, and it is the one people are most surprised to find. Three of the four are invisible to a robots.txt audit. Google puts the edge row in its own documentation. Its page on AI features and your website, last updated December 10, 2025, lists among SEO best practices: &quot;Ensuring that crawling is allowed in robots.txt, and by any CDN or hosting infrastructure.&quot; That clause has been sitting in Google’s documentation for at least eight months and I have never once seen it quoted in a GEO checklist.</p><h2>Does robots.txt still control who reads your site?</h2><p>It never controlled anything. It declares, and the client decides. What changed in 2026 is who joined that class: a client that does not just fetch, but navigates and acts.</p><p>Perplexity’s crawler documentation splits its traffic in two. <code>PerplexityBot</code> is the indexing crawler, and Perplexity’s guidance is straightforward: &quot;To ensure your site appears in search results, we recommend allowing <code>PerplexityBot</code> in your site’s <code>robots.txt</code> file and permitting requests from our published IP ranges listed below.&quot; That second half is Perplexity pointing past robots.txt at the enforcement layer, in its own documentation. <code>Perplexity-User</code> is the fetcher that runs when someone asks a question. Of that one, Perplexity writes: &quot;Since a user requested the fetch, this fetcher generally ignores robots.txt rules.&quot; Not <em>may not apply</em>. Ignores.</p><p>Google documents an entire category the same way. Its user-triggered fetchers page, last updated August 19, 2026, states: &quot;Because the fetch was requested by a user, these fetchers generally ignore robots.txt rules.&quot; Nine fetchers are listed, and Google notes the list &quot;is not exhaustive.&quot; The newest one matters most. <code>Google-Agent</code> was added on March 20, 2026; the changelog entry describes it as rolling out &quot;over the next few weeks,&quot; to &quot;be used by Google agents hosted on Google infrastructure to navigate the web and perform actions upon user request.&quot; An agent that navigates and acts, in a class that ignores robots.txt, under a token most blocklists have never heard of.</p><p>I already published the full vendor roster for OpenAI, Anthropic, Meta and Google Search rather than reprint it here, in <a href=\"https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic\">how to measure AI search traffic</a> — including the exact sentences each vendor uses about robots.txt and where their tokens diverge. The short version, and it holds up on re-reading today: of the three assistant vendors in that roster, two — OpenAI and Meta — publish a robots.txt exemption for user-triggered fetches, and Anthropic publishes none. Treating them as a single &quot;AI bots&quot; bucket is the error underneath most blocklists in circulation.</p><p>Then there is the case where the declaration was honored and the request arrived anyway. On August 4, 2025, Cloudflare reported that &quot;Perplexity uses not only their declared user-agent, but also a generic browser intended to impersonate Google Chrome on macOS when their declared crawler was blocked,&quot; and that in response &quot;we have de-listed them as a verified bot and added heuristics to our managed rules that block this stealth crawling.&quot; Whatever you conclude about that specific incident, it establishes the general point cleanly: a rule written against a user-agent string is a rule written against a value the client chooses.</p><p>AWS has quietly encoded the same skepticism in its taxonomy. Its Bot Control rule group applies a label, <code>bot:user_triggered:verified</code>, for &quot;a bot that is similar to a verified bot, but that might be directly invoked by end users,&quot; and then says what it does with it: &quot;This category of bot is treated by the Bot Control rules like an unverified bot.&quot; A vendor writing a WAF has already decided that user-triggered means untrusted.</p><h2>What actually changes at the edge on September 15, 2026?</h2><p>Cloudflare classifies AI traffic by behavior — Search, Agent, Training — and from September 15, 2026 the legacy &quot;Block AI bots&quot; preset stops excluding mixed-purpose crawlers from that classification.</p><p>That sentence is the change. Cloudflare’s Block AI Bots documentation, last updated July 1, 2026, defines the three presets: <strong>Search</strong> is &quot;crawlers that collect or index your content to answer questions about it later&quot;; <strong>Agent</strong> is &quot;automated activity acting in real time on a person’s behalf, such as chat fetch bots and browser-use agents&quot;; <strong>Training</strong> is &quot;crawlers taking your content to train or fine-tune a model, including mixed-purpose crawlers that are used both for Training and for Search.&quot; Read that last clause twice. The reclassification is inside the definition of Training, not only inside a default that flips on a date.</p><p><strong>Re-checked at source on September 15, 2026, the day itself.</strong> Cloudflare’s Block AI Bots page still says &quot;Last updated Jul 1, 2026&quot;, its source file in the public docs repository has no commit after July 1, the section is still headed &quot;New defaults on September 15, 2026&quot; and still written in the future tense, the legacy preset is still labeled &quot;Block AI bots [Deprecating on September 15, 2026]&quot;, and the sentence &quot;Before September 15, all customers can opt out of these new defaults&quot; is still on the page. The newest entry in the bots changelog is still July 1. The July 1 blog post carries no visible note; its page metadata records a July 15 modification and nothing since. So the two pages I promised to re-read did not change on the day, and Cloudflare has published nothing that says the change landed, slipped, or was amended. What I did find is that the plan was amended on August 21, in a post about something else, and that the rule was reportedly being enforced well before the date. Both are below the table.</p><p>Two separate things were scheduled for September 15, and the coverage keeps welding them together.</p><table><thead><tr><th>Configuration</th><th>Behaviour before September 15, 2026</th><th>Behaviour after</th><th>Source</th></tr></thead><tbody><tr><td>Legacy &quot;Block AI bots&quot; preset, already enabled</td><td>Blocks training crawlers. &quot;This option excludes mixed-purpose bots that are used both for Training and for Search.&quot;</td><td>Mixed-purpose crawlers &quot;will also be blocked by all configurations to block AI training, including the legacy &#x27;Block AI bots&#x27; option.&quot; The preset is labeled &quot;Block AI bots [Deprecating on September 15, 2026]&quot;</td><td><a href=\"https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/\">Cloudflare docs, July 1, 2026</a></td></tr><tr><td>Any configuration that blocks Training</td><td>Single-purpose training crawlers blocked</td><td>&quot;Since the defaults will be enforced by the most restrictive applicable rules, multi-purpose crawlers such as Googlebot, Applebot, and BingBot will be blocked by customers who have selected to block Training&quot;</td><td><a href=\"https://blog.cloudflare.com/content-independence-day-ai-options/\">Cloudflare blog, July 1, 2026</a></td></tr><tr><td>A domain onboarding to Cloudflare after the date</td><td>Not applicable</td><td>&quot;For all new domains onboarding to Cloudflare, the categories of Training and Agent will be blocked by default on the pages that display ads, while Search will remain allowed by default.&quot;</td><td><a href=\"https://blog.cloudflare.com/content-independence-day-ai-options/\">Cloudflare blog, July 1, 2026</a></td></tr><tr><td>Existing domain, no new action taken</td><td>Current settings</td><td>Defaults are not restated for existing domains. &quot;Before September 15, all customers can opt out of these new defaults&quot;</td><td><a href=\"https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/\">Cloudflare docs, July 1, 2026</a></td></tr><tr><td>Training set to Disallow, the option introduced August 21, 2026</td><td>Not applicable; the July 1 option was Block</td><td>&quot;cooperating mixed-use crawlers who take the extra Transparency step can still access your content for search indexing&quot;; the rest are &quot;still blocked when you disallow training&quot;</td><td><a href=\"https://blog.cloudflare.com/bot-preference-sync/\">Cloudflare blog, August 21, 2026</a></td></tr><tr><td>A domain onboarding, as revised August 21, 2026</td><td>Not applicable</td><td>&quot;For the non-publisher case, new customers will not have any blocks or disallows added by default&quot;; selecting &quot;I monetize from pages with ads on this domain&quot; sets &quot;Training to Disallow as the default&quot;</td><td><a href=\"https://blog.cloudflare.com/bot-preference-sync/\">Cloudflare blog, August 21, 2026</a></td></tr></tbody></table><p>Note which row carries which quote. The docs page does not name Googlebot, Applebot or BingBot anywhere; that sentence is on the blog. I checked because a first draft of my own notes had it on the wrong URL, and a quote attached to the wrong source is a quote a reader cannot verify.</p><p>Now the correction I think matters most. A lot of secondary coverage describes the September 15 defaults as landing on &quot;new customers, new sites by existing customers, and all existing free customers.&quot; Cloudflare’s own post says &quot;all new domains onboarding to Cloudflare.&quot; I could not find the broader scope stated anywhere at source, so I am not repeating it. On August 21 Cloudflare replaced that default anyway, which the next section covers. The genuinely broad change for existing customers is the other one: the mixed-purpose rule, which reaches anyone who ever ticked the legacy toggle. Somebody who enabled &quot;Block AI bots&quot; in 2024 as a training opt-out made a decision whose meaning changes without them touching it. That is a better story than the one being told, and it is the one that is documented.</p><p>It is also worth knowing what stays allowed. Cloudflare’s verified bot categories page, updated July 1, 2026, still lists <code>OAI-SearchBot</code> under the legacy value &quot;AI Search&quot; and Googlebot under &quot;Search Engine Crawler,&quot; and notes that under the taxonomy introduced on July 1, 2026 both are treated as Search behavior, the legacy value being &quot;retained for backward compatibility with existing rules.&quot; Search-classified traffic remains allowed under the new defaults. The exposure is concentrated in crawlers that do two jobs with one token.</p><p>One structural note that surprised me: &quot;Each blocking option will block Verified bots classified with that behavior, plus additional unverified bots that fall under these classifications.&quot; Cloudflare’s own categories page confirms the shift in plain terms: &quot;Historically, Verified bots have been excluded in default bot configurations across all plans. Now, all customers have the option to configure AI bot policies to define their block vs. allow expectations.&quot; Verified status used to be a pass. It is now just a label the policy reads.</p><h3>What changed between the announcement and the date</h3><p><strong>August 21: Training becomes &quot;Disallow&quot;, and cooperating mixed-use crawlers keep indexing.</strong> On August 21, 2026, the day this post went up, Cloudflare published &quot;Say it once: Introducing Bot Preference Sync&quot;. It never mentions September 15, but it rewrites the Training option: &quot;For Search and Agent, the three options we announced on July 1 remain: Allow, Block on pages that serve ads, or Block everywhere. For Training, we’re refining the option to stop your content being used for training models with the Disallow option.&quot; Disallow writes a &quot;no training&quot; preference into robots.txt &quot;so that cooperating mixed-use crawlers who take the extra Transparency step can still access your content for search indexing&quot;, and &quot;your Search visibility for cooperating crawlers is unaffected.&quot; A mixed-use crawler earns that by meeting four requirements: respecting a &quot;no training&quot; preference in robots.txt, giving site owners &quot;a way to opt out of AI summaries&quot;, providing &quot;URL-level visibility into which pages were made available for training&quot;, and showing &quot;publicly that Disallowing Training does not hurt your traditional search results.&quot; The others get no benefit of the doubt: &quot;they’re still blocked when you disallow training.&quot; Cloudflare says the crawlers that qualify are tracked in the AI bot transparency section of Radar. That is a narrower rule than the July 1 sentence naming Googlebot, Applebot and BingBot, and it turns &quot;blocked&quot; into &quot;blocked unless the operator publishes enough to be verified&quot;.</p><p><strong>August 21: the new-domain default changed too.</strong> The July 1 plan was Training and Agent blocked by default on pages that display ads, for all new domains. The August 21 post replaces it with a choice at onboarding: a site that selects &quot;I monetize from pages with ads on this domain&quot; gets &quot;Training to Disallow as the default&quot;, and &quot;For the non-publisher case, new customers will not have any blocks or disallows added by default when they onboard a domain&quot;. The docs page still describes the July 1 version of both. Bot Preference Sync itself was promised &quot;in the coming week&quot;; as of September 15 there is no changelog entry for it, and the robots.txt setting page, last updated August 3, does not mention it.</p><p><strong>Before the date: the block was reportedly already live.</strong> On August 4, 2026, Search Engine Journal relayed a Reddit report that setting AI Training to Block returned 403s to Googlebot and Bingbot fetching a sitemap, and that turning it off restored access. On August 22, a site owner posted on Cloudflare’s community forum that verified Googlebot requests had been receiving 403s since early July, that Security Events attributed them to &quot;Block AI training crawlers&quot;, and that the fix was changing the setting so mixed-purpose crawlers stay allowed. A second site owner confirmed the same on September 2, and as of September 3 the thread records no response from Cloudflare. Two forum reports are not a measurement, and I cannot reproduce them because nothing of mine is proxied. But they match the reading above: the reclassification sits inside the definition of Training, which shipped on July 1, and a date attached to a default does not gate a definition.</p><p>Where that leaves September 15: the enforced behaviour was never observable from a documentation page, and on the day, the pages did not try. If you are proxied and you block Training, the questions are now what the Training control in your dashboard says today, Block or Disallow, and what your Security Events show for verified Googlebot. That is a look at your own zone, not at a blog post. If Cloudflare updates either page, I will note it here.</p><h2>Why can a robots.txt checker say yes while your edge says no?</h2><p>Because a checker fetches one text file and parses it, and an edge decision is made per request, against a user agent, an IP, and increasingly a signature. These are not the same measurement. A robots.txt-parsing tool cannot observe a WAF rule any more than reading a restaurant’s posted hours tells you whether the door is locked.</p><p>This is the same failure mode I wrote about in <a href=\"https://www.amirmousavi.com/articles/can-you-trust-ai-visibility-scores\">can you trust AI visibility scores</a>: a tool reports the thing it can measure, the buyer reads it as the thing they care about, and nobody checks the gap. A green check for &quot;AI crawlers allowed&quot; means the file permits them. It does not mean a request arrives.</p><p>There is a third place to look that almost no audit does, and it is not a file at all. Microsoft’s opt-out for generative answers is a robots <strong>meta tag</strong>, in the page head. Fabrice Canel published it on September 22, 2023: content tagged <code>NOARCHIVE</code> &quot;will not be included in Bing Chat answers, not be linked to in the answers,&quot; and &quot;we will not use the content for training Microsoft’s generative AI foundation models.&quot; Content with <code>NOCACHE</code> &quot;may be included in Bing Chat answers. We will only display URL/Snippet/Title in the answer.&quot; And the default, stated plainly: &quot;Content without NOCACHE tag and without NOARCHIVE tag may be included in Bing Chat answers … site content may be used in training our generative AI foundation models.&quot; Two caveats the page carries and most summaries drop: content tagged either way &quot;will still appear in our search results,&quot; and if both tags are present Microsoft treats it as <code>NOCACHE</code>. The post is from September 2023 and still says &quot;Bing Chat,&quot; a name Microsoft has since retired, which is worth weighing before treating it as current.</p><p>That control lives per page, in HTML, and a site-level robots.txt audit will never see it. A CMS template, a plugin, or a staging default can set it across thousands of URLs without anyone deciding to. If you inherited a site, this is a five-second check worth making, and it is the sort of thing I keep on the <a href=\"https://www.amirmousavi.com/resources/seo-architecture-checklist\">SEO architecture checklist</a> rather than in anyone’s memory.</p><h2>Is Cloudflare the outlier, or is everyone doing this?</h2><p>On the evidence I could verify today, Cloudflare is the outlier. It is the only one of the platforms I checked that moves a default on a calendar date.</p><p><strong>Vercel</strong>, which is my actual edge, states it about as clearly as a doc can. On its WAF managed rulesets page, last updated July 17, 2026: &quot;The ruleset is inactive by default. In the dashboard this is labeled <strong>Allow</strong>. Matching traffic is not evaluated and reaches your application.&quot; The available actions are Log and Deny, and you choose one. Nothing happens to AI traffic unless somebody turns it on.</p><p><strong>Netlify</strong> ships blocking as an installable extension. Its documentation, last updated February 13, 2026, describes &quot;The User Agent Blocker extension is built by Netlify&quot; which &quot;can block web requests from a preset list of common AI crawlers, SEO/Search crawlers that you choose from,&quot; implemented as &quot;a Netlify Edge Function.&quot; Opt-in by construction: an extension you install and configure.</p><p><strong>Fastly</strong> puts it behind a purchase and a config. ContentGuard requires that you buy Bot Management and &quot;deploy Bot Management using pre-cache inspection&quot; on each service, then write VCL snippets in <code>vcl_recv</code> against variables that &quot;all start with <code>fastly.bot.</code>&quot; — including <code>fastly.bot.category.is_ai_crawler</code>. Powerful, and nobody arrives there by accident.</p><p><strong>AWS WAF</strong> is the interesting one. I had it filed as unverified, so I went and read the rule group documentation myself. Bot Control is a managed rule group you add to a web ACL, and you are &quot;charged additional fees when you use this managed rule group.&quot; Inside it, one rule stands apart from the other fifteen category rules. <code>CategoryAI</code> &quot;inspects for artificial intelligence (AI) bots&quot; and, after a note in the source, &quot;applies the action to all matches, regardless of whether the bots are verified or unverified. Rule action: Block.&quot; Every other <code>Category*</code> rule applies &quot;only to unverified bots.&quot; AWS singled out AI traffic, and it did it inside a product you have to opt into and pay for.</p><p>I did not verify Akamai, so Akamai is not in this section. I would rather leave a gap than characterise a vendor’s default from a summary.</p><h2>What is Web Bot Auth, and is it ready to matter?</h2><p>It is the layer that would make the other two coherent, and it is not ready.</p><p>Google’s documentation for it was last updated on May 4, 2026, on a page headed &quot;Authenticate requests with Web Bot Auth (experimental).&quot; The idea is simple and overdue: instead of a bot asserting an identity in a header anyone can copy, it signs the request. &quot;Instead of relying solely on self-reported headers and IP addresses, Web Bot Auth allows agents to cryptographically sign their requests.&quot; Mechanically, participating requests carry a <code>Signature-Agent</code> header set to <code>g=&quot;https://agent.bot.goog&quot;</code>, you fetch the public keys from <code>https://agent.bot.goog/.well-known/http-message-signatures-directory</code>, and you verify against HTTP Message Signatures, RFC 9421.</p><p>Google is unusually direct about the state of it. &quot;Web Bot Auth is currently a draft specification developed by the IETF WBA Working Group, and it may change over time.&quot; &quot;Not all Google user agents are using Web Bot Auth.&quot; &quot;We don’t sign every request of a particular agent. Be sure that you fall back to the established methods of bot verification.&quot; And the operative instruction for anyone tempted to rebuild their access rules on it: &quot;We recommend that in addition to Web Bot Auth you continue relying on IP addresses, reverse DNS, and user-agent strings as we gradually roll out signed traffic.&quot;</p><p>The edge vendors are further along than that reads. Cloudflare has a Web Bot Auth reference page in its bot verification docs, last updated July 1, 2026, defining it as &quot;an authentication method that leverages cryptographic signatures in HTTP messages to verify that a request comes from an automated bot.&quot; AWS WAF’s Bot Control already emits labels for it: <code>web_bot_auth:verified</code>, <code>web_bot_auth:invalid</code>, <code>web_bot_auth:expired</code>, and <code>web_bot_auth:unknown_bot</code>, with a note that &quot;When the <code>web_bot_auth:verified</code> label is present, the <code>Category&lt;category_name&gt;</code> and <code>TGT_TokenAbsent</code> rules do not match, allowing verified WBA hosts to proceed.&quot;</p><p>I cannot tell from that documentation how the WBA exemption interacts with <code>CategoryAI</code>, given that <code>CategoryAI</code> is documented as applying &quot;to all matches, regardless of whether the bots are verified or unverified.&quot; AWS’s note uses the placeholder <code>Category&lt;category_name&gt;</code>, which on its face covers every Category rule including <code>CategoryAI</code>. Those two sentences are in tension and I am not going to resolve them by guessing. If you run AWS WAF and you care about the answer, test it rather than infer it.</p><p>Here is why I still think layer three is the one to watch. Layers one and two both spend most of their effort deciding whether to believe a user-agent string. Layer three ends the argument. When signing is ubiquitous, &quot;who is allowed to read this&quot; stops being a guess about user agents and becomes a policy about verified identities. We are not there. Google says so itself.</p><h2>How to audit your own edge</h2><p>Six steps, in order. Each one has a way it misleads, and the caveat is the point.</p><ol>\n<li>\n<p><strong>Read your nameservers.</strong> <code>dig +short NS example.com</code>. This tells you who runs your DNS. <strong>How it misleads:</strong> it does not tell you who is in the request path. Mine returns Cloudflare nameservers on a site with no Cloudflare proxy. If you stop here, you will spend an afternoon looking for a dashboard you do not have.</p>\n</li>\n<li>\n<p><strong>Resolve the record you actually serve.</strong> <code>dig +short example.com</code> and <code>dig +short www.example.com</code>. Compare the answers against <code>cloudflare.com/ips-v4</code> or your CDN’s published ranges. A proxied record answers with the CDN’s anycast address; a DNS-only record answers with your origin. <strong>How it misleads:</strong> apex and <code>www</code> are frequently configured differently. Mine differ.</p>\n</li>\n<li>\n<p><strong>Read the response headers on the hostname you actually serve.</strong> <code>curl -sI https://www.example.com</code>. Look for <code>server</code>, <code>cf-ray</code>, <code>x-vercel-id</code>, <code>x-amz-cf-id</code>, <code>x-served-by</code>. <strong>How it misleads:</strong> my apex returns a <code>308</code> redirect, so headers there describe the redirector, not the application. Follow to the destination. And absence of a header is weaker evidence than presence of one; some configurations strip them.</p>\n</li>\n<li>\n<p><strong>Request as a declared AI crawler and diff the result.</strong> <code>curl -A &quot;OAI-SearchBot/1.4&quot; -sI https://www.example.com</code>, then compare status code and <code>content-length</code> against your browser-user-agent request. <strong>How it misleads, and this is the important caveat:</strong> you are only testing user-agent string matching. Real bot rules verify IP ranges, reverse DNS, and increasingly signatures, none of which curl can satisfy or trigger. A 200 here does not prove the real OAI-SearchBot gets a 200. It proves nobody wrote a naive user-agent rule. On my domain both requests returned <code>HTTP/2 200</code> with an identical <code>content-length: 41843</code>.</p>\n</li>\n<li>\n<p><strong>Check for a page-level meta tag.</strong> <code>curl -s https://www.example.com/ | grep -i &#x27;name=&quot;robots&quot;&#x27;</code>. You are looking for <code>noarchive</code> or <code>nocache</code>, which is Microsoft’s generative-answer opt-out. <strong>How it misleads:</strong> one URL is not a site. Templates apply this unevenly, so check an article, a category page, and anything behind a different template before concluding.</p>\n</li>\n<li>\n<p><strong>Read robots.txt last, and read it as a declaration.</strong> <code>curl -s https://www.example.com/robots.txt</code>. <strong>How it misleads:</strong> it tells you what you asked for. It tells you nothing about what happened. Reading it first is how a perfectly correct file talks you out of investigating a 403 you are actually serving. Named user-agent groups fully override the <code>*</code> group, so a group you added for one crawler silently exempts it from every rule you wrote above it.</p>\n</li>\n</ol><p>If you are doing this before a launch rather than as a diagnosis, steps two through four belong on the <a href=\"https://www.amirmousavi.com/resources/website-launch-checklist\">website launch checklist</a> alongside the other things nobody remembers until the first week of traffic.</p><h2>My working take</h2><p>My site ships <code>Content-Signal: search=yes, ai-input=yes, ai-train=no</code> on every user-agent group in robots.txt, and the <code>ai-input=yes</code> is deliberate. It says answer engines may ground responses in this content. I get asked why I do not set it to <code>no</code>, usually by someone who reads it as a defensive posture. It is not one. Setting <code>ai-input=no</code> does not protect the content — the pages are public, the same crawlers fetch them, and the enforcement layer is not there anyway. All it does is ask to be left out of the answers. For a site whose entire llms.txt and Markdown-rendition work exists to be readable by machines, that would be a strange thing to ask for.</p><p>I hold two things at once and they are less contradictory than they sound. I want to be read, and I want to know who is reading. Those need different layers. <code>ai-input=yes</code> is a statement of intent at layer one. Knowing whether it is honored happens in logs, which is a measurement problem rather than an access problem. This whole post is about who can read your site; the mirror-image question, what an agent can write into your stack once you connect one, is <a href=\"https://www.amirmousavi.com/articles/what-ai-agents-can-do-in-your-martech\">in a separate post</a>.</p><p>What I do not know: whether any answer engine parses <code>Content-Signal</code> at all. I have not found a vendor that documents doing so, and I am not going to infer it from the absence of evidence. I ship it because it is a cheap, machine-readable statement of terms, and because I would rather have said it in public than not. If that turns out to be a file nobody reads, I will have lost fifty-eight lines of text.</p><p>I also do not have a Cloudflare edge to configure, which is why there is no dashboard walkthrough in this post. My September 15 exposure is zero, and I only know that because I checked instead of assuming. That is the transferable part. I do not know how many people writing about this change have run <code>dig</code> against their own apex. I know that I had not, until three paragraphs before I started this post, and that I was wrong about my own answer.</p><p>The boring conclusion, and I believe it is the right one: robots.txt is where you state a preference, the edge is where a decision gets made, and until Web Bot Auth is not experimental, anything you enforce is enforced against a string. Design accordingly. Audit the layer that is in the request path, not the one that is easiest to read.</p><h2>Frequently asked questions about AI crawler access</h2><h3>Does blocking AI training in Cloudflare block Googlebot?</h3><p>It can, and reportedly did before the date. Cloudflare’s July 1, 2026 blog post states that &quot;since the defaults will be enforced by the most restrictive applicable rules, multi-purpose crawlers such as Googlebot, Applebot, and BingBot will be blocked by customers who have selected to block Training,&quot; whether through the new category options or the legacy &quot;Block AI bots&quot; service, and two site owners reported verified Googlebot receiving 403s under that setting in July and August. On August 21 Cloudflare narrowed the rule: with Training set to Disallow, mixed-use crawlers that meet its four transparency requirements keep indexing, and the rest stay blocked. As of September 15 the documentation still describes the July 1 version. This applies only to sites actually proxied through Cloudflare, which is worth verifying before acting on it.</p><h3>Do I need to change anything now that September 15, 2026 has passed?</h3><p>Only if your traffic passes through Cloudflare’s proxy and you have a configuration that blocks Training, including the legacy toggle. Confirm the proxy first with <code>dig +short yourdomain.com</code> and a check for a <code>cf-ray</code> response header; Cloudflare nameservers alone do not confirm it. If you are proxied and blocking Training, open Security settings and read what the Training control says today, Block or Disallow, then check Security Events for verified Googlebot requests attributed to the AI training block. Decide deliberately whether you want mixed-purpose search crawlers included, because the reports say they already were.</p><h3>Can a robots.txt checker tell me whether AI crawlers are blocked?</h3><p>No, and the limitation is structural rather than a quality problem. A checker fetches <code>/robots.txt</code> and parses directives; an edge rule is evaluated per request against user agent, IP, and potentially a cryptographic signature. Nothing about the file’s contents reveals a firewall decision. The only tools that can observe it are ones that send real requests with crawler user agents and report the status code they receive.</p><h3>Which AI vendors say their fetchers ignore robots.txt?</h3><p>Perplexity’s documentation says of <code>Perplexity-User</code>: &quot;Since a user requested the fetch, this fetcher generally ignores robots.txt rules.&quot; Google says of its entire user-triggered fetcher class, which includes <code>Google-Agent</code>: &quot;Because the fetch was requested by a user, these fetchers generally ignore robots.txt rules.&quot; Vendor policies diverge more than the roundups suggest, and I compared them token by token in <a href=\"https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic\">how to measure AI search traffic</a>.</p><h3>Should I implement Web Bot Auth now?</h3><p>Not as a control you depend on. Google’s documentation, updated May 4, 2026, calls its implementation experimental, states that &quot;Not all Google user agents are using Web Bot Auth,&quot; and recommends continuing to rely on IP addresses, reverse DNS, and user-agent strings. If your CDN can already consume the signal, as Cloudflare and AWS WAF can, there is no reason to turn that off. Just do not build an access policy that assumes signatures are present.</p><h2>Sources I used</h2><p>Verified at source: August 21, 2026. Cloudflare pages re-checked September 8 and September 15, 2026.</p><ul>\n<li><a href=\"https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/\">Cloudflare: Block AI Bots (updated July 1, 2026)</a></li>\n<li><a href=\"https://blog.cloudflare.com/content-independence-day-ai-options/\">Cloudflare: Content Independence Day, new AI traffic options (July 1, 2026)</a></li>\n<li><a href=\"https://developers.cloudflare.com/bots/concepts/bot/verified-bots/categories/\">Cloudflare: verified bot categories (updated July 1, 2026)</a></li>\n<li><a href=\"https://blog.cloudflare.com/perplexity-is-using-stealth-undeclared-crawlers-to-evade-website-no-crawl-directives/\">Cloudflare, Cloudflare: Perplexity is using stealth, undeclared crawlers (August 4, 2025)</a></li>\n<li><a href=\"https://docs.perplexity.ai/guides/bots\">Perplexity: crawler and fetcher documentation</a></li>\n<li><a href=\"https://developers.google.com/crawling/docs/crawlers-fetchers/google-user-triggered-fetchers\">Google: user-triggered fetchers (updated August 19, 2026)</a></li>\n<li><a href=\"https://developers.google.com/crawling/docs/crawlers-fetchers/web-bot-auth\">Google: Web Bot Auth, experimental (updated May 4, 2026)</a></li>\n<li><a href=\"https://developers.google.com/crawling/docs/changelog\">Google: crawling infrastructure changelog, Google-Agent added March 20, 2026</a></li>\n<li><a href=\"https://developers.google.com/search/docs/appearance/ai-features\">Google: AI features and your website (updated December 10, 2025)</a></li>\n<li><a href=\"https://blogs.bing.com/webmaster/september-2023/Announcing-new-options-for-webmasters-to-control-usage-of-their-content-in-Bing-Chat\">Fabrice Canel, Bing Webmaster Blog: options for webmasters to control usage of their content in Bing Chat (September 22, 2023)</a></li>\n<li><a href=\"https://vercel.com/docs/vercel-firewall/vercel-waf/managed-rulesets\">Vercel: WAF managed rulesets (updated July 17, 2026)</a></li>\n<li><a href=\"https://docs.netlify.com/build/build-with-ai/block-ai-crawlers/\">Netlify: block AI crawlers (updated February 13, 2026)</a></li>\n<li><a href=\"https://www.fastly.com/documentation/guides/security/bot-management/about-contentguard/\">Fastly: about ContentGuard</a></li>\n<li><a href=\"https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/\">Cloudflare: Web Bot Auth reference (updated July 1, 2026)</a></li>\n<li><a href=\"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html\">AWS: WAF Bot Control rule group</a></li>\n<li><a href=\"https://blog.cloudflare.com/bot-preference-sync/\">Cloudflare: Say it once, introducing Bot Preference Sync (August 21, 2026)</a></li>\n<li><a href=\"https://developers.cloudflare.com/bots/changelog/\">Cloudflare: bots changelog (newest entry July 1, 2026, checked September 15, 2026)</a></li>\n<li><a href=\"https://github.com/cloudflare/cloudflare-docs/commits/production/src/content/docs/bots/additional-configurations/block-ai-bots.mdx\">cloudflare-docs on GitHub: history of the Block AI Bots page (last commit July 1, 2026)</a></li>\n<li><a href=\"https://www.searchenginejournal.com/report-that-cloudflare-ai-bot-blocking-prevents-googlebot-from-indexing-sites/584673/\">Roger Montti, Search Engine Journal: report that Cloudflare AI bot blocking prevents Googlebot from indexing sites (August 4, 2026)</a></li>\n<li><a href=\"https://community.cloudflare.com/t/googlebot-blocked-by-block-ai-training-crawlers-before-september-15/951410\">Cloudflare Community: Googlebot blocked by &quot;Block AI training crawlers&quot; before September 15 (August 22 to September 3, 2026)</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/three-layers-ai-crawler-access",
            "title": "Can AI Engines Read Your Site? Check Three Layers",
            "summary": "robots.txt is advisory, your CDN is enforced, and Web Bot Auth is experimental. Three commands that show which layer actually decides who can read your site.",
            "date_modified": "2026-08-21T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "AI crawlers",
                "robots.txt",
                "bot management",
                "CDN",
                "Web Bot Auth",
                "technical SEO"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/what-ai-agents-can-do-in-your-martech",
            "content_html": "<p>&quot;Agentic marketing&quot; is on every martech deck this quarter, and &quot;connect in one click&quot; is usually a couple of slides later. Neither slide says what the click grants.</p><p>So I went looking for the answer where it actually lives, which is the authorization server rather than the deck. One command against HubSpot’s, the way you would check a DNS record before believing a migration plan.</p><pre><code>curl https://mcp.hubspot.com/.well-known/oauth-authorization-server\n</code></pre><p>What came back had no <code>registration_endpoint</code>, no <code>client_id_metadata_document_supported</code>, and <code>&quot;scopes_supported&quot;: []</code>. In plain terms: an agent cannot register itself with HubSpot, and HubSpot’s metadata will not tell you in advance what permissions it is about to hand over. That is not a criticism of HubSpot. It is the shape of the thing being sold, and it took one command to find.</p><p>I should say up front what this post is and is not. <strong>I have never connected an AI agent to a client’s ad account or CRM, and I would not have written this if I had. The interesting part is what the documentation commits to, not what one integration happened to do on a Tuesday.</strong> Everything below comes from vendor documentation I opened, GitHub issues I read, registry and vulnerability databases I queried, and commands I ran, all on August 21, 2026. Where a source contradicted my notes, the source won and I say so.</p><p>The one thing I do have first-hand is the other side of the table. This site registers agent tools in production. I wrote the permission boundaries on them myself, and that is the part of this story I did not expect to be relevant.</p><h2>Quick answer</h2><p>As of August 21, 2026, Google’s Ads MCP server is strictly read-only (three tools, no writes) while Meta’s opened to any developer’s app on July 16, 2026 documenting campaign, ad set, ad and custom audience creation. HubSpot and Salesforce both write to CRM records and both inherit the authorising user’s existing permissions. The dangerous part is not the tool list, it is the grant: Google’s read-only server still requires <code>https://www.googleapis.com/auth/adwords</code>, the Google Ads API’s only OAuth scope, which is full management. What I do before authorising anything is read the scope the consent screen requests and ignore the tool list entirely, because the tool list is the vendor’s promise and the scope is the actual permission.</p><p><strong>Everything in this post was verified at its primary source on August 21, 2026.</strong> Treat it as a snapshot with a shelf life measured in weeks. A Google maintainer has already said write tools are coming, which flips the most important column in the table below.</p><h2>Which of these servers can actually change something?</h2><p>Here is the matrix I could not find published anywhere. Every cell was read off a vendor page or an API response on August 21, 2026.</p><table><thead><tr><th>Platform</th><th>Server</th><th>Read</th><th>Write</th><th>Tools documented</th><th>Client registration</th><th>Doc date</th><th>Published CVE</th></tr></thead><tbody><tr><td>Google Ads</td><td><code>googleads/google-ads-mcp</code>, self-hosted</td><td>Yes</td><td><strong>No</strong></td><td>3</td><td>Your own OAuth client</td><td>Updated Aug 19, 2026</td><td>None in NVD</td></tr><tr><td>Meta Ads</td><td><code>mcp.facebook.com/ads</code>, Meta-hosted</td><td>Yes</td><td><strong>Yes</strong></td><td>28 on the ad-creation page alone</td><td>Facebook Login or bearer token</td><td>Opened Jul 16, 2026</td><td>None for Meta’s own</td></tr><tr><td>HubSpot</td><td><code>mcp.hubspot.com</code>, HubSpot-hosted</td><td>Yes</td><td><strong>Yes</strong></td><td>32 named, in an undated list (count added Oct 9, 2026)</td><td><strong>Neither DCR nor CIMD</strong></td><td>GA Apr 13, 2026</td><td>None found</td></tr><tr><td>Salesforce</td><td>Salesforce-hosted MCP servers</td><td>Yes</td><td><strong>Yes</strong></td><td>Defined by your org</td><td>External Client App, pre-registered</td><td>GA Apr 29, 2026</td><td>None found</td></tr><tr><td>Microsoft Advertising</td><td><code>partner.api.bingads.microsoft.com</code></td><td>Not documented</td><td>Not documented</td><td>Not published</td><td>AAD app registration</td><td>ms.date Jul 22, 2026</td><td>None found</td></tr><tr><td><code>pipeboard-co/meta-ads-mcp</code>, third party</td><td>Community package</td><td>Yes</td><td>Yes</td><td>Not audited</td><td>Operator-supplied token</td><td>—</td><td><strong>CVE-2026-48039, CVSS 9.1</strong></td></tr></tbody></table><p>Two columns deserve a warning. &quot;Published CVE&quot; means I could not find one, not that none exists: a vendor-hosted server is patched silently and would never produce a CVE at all, so an empty cell there is close to meaningless for the four hosted rows. And &quot;Tools documented&quot; is what the vendor chose to publish, which for HubSpot and Salesforce is not a number.</p><p><em>Updated October 9, 2026: this cell read &quot;Not published as a count&quot; for HubSpot. HubSpot’s integration page now lists 32 named tools under &quot;Available tools&quot;, undated, and I counted them myself. They include write tools such as <code>manage_crm_objects</code>, <code>manage_campaign_objects</code>, <code>manage_marketing_email</code> and <code>manage_blog_post</code>, and three of the 32 are marked &quot;only available for select AI clients (Claude, ChatGPT, and Gemini)&quot;. HubSpot adds that &quot;Tool availability varies by HubSpot subscription, user permissions, and account configuration&quot;, so 32 is the published list, not what a given account gets. Salesforce’s cell is unchanged.</em></p><p>The last row is a different animal from the five above it, and telling them apart is most of the job.</p><h2>What can an AI agent actually do in Google Ads?</h2><p>Nothing that costs money. Google’s own page for the Ads MCP server, last updated August 19, 2026, states it plainly: &quot;This implementation is strictly read-only. It cannot modify bids, pause campaigns, or create new assets.&quot; The page lists mode as &quot;Read-only (current release)&quot; and documents exactly three tools: <code>list_accessible_customers</code>, <code>search</code>, and <code>get_resource_metadata</code>.</p><p>That is a real constraint, honestly documented, and it will not last. On June 4, 2026, in issue #84 on the <code>googleads/google-ads-mcp</code> repository, a maintainer wrote: &quot;We already have plans to add write access soon; each individual write tool will be configurable with the YAML file introduced in #82. Because of this, we won’t accept PRs adding write features. I won’t close this issue now to leave room for further discussion if needed.&quot; The proposal’s author closed it themselves half an hour later. So the read-only column in that matrix is a release note, not a policy.</p><p>Then there is the state of the thing. The repository has 876 stars and was created on October 3, 2025. It has zero releases and zero tags, and <code>pyproject.toml</code> on <code>main</code> still reads <code>version = &quot;0.0.1&quot;</code>. Issue #107, opened August 13, 2026, is titled &quot;Can we publish releases here?&quot; and is open. Issue #102, opened August 10, 2026, reports that <code>search</code>, one of the three tools, is unreachable because customer IDs are digit-only strings that MCP clients serialise as JSON numbers, which the generated Pydantic model rejects: &quot;No input both passes validation and is accepted by the API, so the tool is effectively unreachable.&quot; Also open.</p><p>I want to be careful about what that does and does not prove. It is a sample of the loudest users, not a defect rate. But if you are evaluating this for a client team, &quot;the read tool does not currently work&quot; is a different procurement conversation than &quot;read-only for now.&quot;</p><p>The genuinely uncomfortable fact is elsewhere, and it is in the README rather than the docs page. To run this server you must supply credentials carrying <code>https://www.googleapis.com/auth/adwords</code>. Google’s OAuth guide for the Ads API says: &quot;The scope for the Google Ads API is: <code>https://www.googleapis.com/auth/adwords</code>.&quot; One scope. There is no read-only variant. So the read-only server holds a token that can mutate every campaign in every account it can see. The restriction lives in the server’s Python, not in the grant, and the grant is what survives if the token leaks.</p><h2>What can an AI agent actually do in Meta Ads?</h2><p>Considerably more, and this is where I have to correct my own notes.</p><p>Meta’s announcement on July 16, 2026 says any app can now connect to the ads MCP server, and documents &quot;Create, edit, and delete campaigns, ad sets, and ads&quot; along with &quot;Create, update, and delete custom audiences.&quot; My working brief said Meta shipped this with no documented safety guardrails. That was wrong, and I found out by opening the tool reference instead of the launch post.</p><p>Meta’s ad creation and management page states: &quot;Write tools create entities in a paused state; your AI client asks for confirmation before activation.&quot; Each write tool repeats it: <code>ads_create_campaign</code> is described as &quot;Create a new ad campaign (paused),&quot; and the same parenthesis appears on <code>ads_create_ad_set</code> and <code>ads_create_ad</code>. A paused-creation default is real, it is documented, and anyone claiming otherwise (including me, two days ago) has read the blog post and not the docs.</p><p>Now read the same page for what it costs you. There are 28 tools on that page alone. One of them is <code>ads_activate_entity</code>: &quot;Change a paused campaign, ad set, or ad to active — starts spending budget.&quot; The safety net is a default that the agent has a tool to remove, and the confirmation is explicitly the <em>client’s</em> job, not the server’s. Meta’s sentence says &quot;your AI client asks for confirmation.&quot; Nothing in the protocol compels a client to ask. If you swap Claude Desktop for an unattended orchestrator you wrote yourself, you have kept the write tools and dropped the guardrail, and neither Meta nor the spec will stop you.</p><p>The second thing the tool reference tells you is that the launch post’s deletion claim has no dedicated tool behind it. There is no tool on that page that deletes a campaign, an ad set, or an ad. <code>ads_update_entity</code> updates fields, and the only delete tool is <code>ads_delete_custom_audience</code>. Whether deletion runs through that update tool’s status field is not documented either way. Both statements are Meta’s own. When a blog post and a tool reference disagree, the reference is the one your agent will actually call.</p><h2>What can an agent change in HubSpot and Salesforce?</h2><p>Both write, and both handle permissions better than the ad platforms do, which is the opposite of what I expected before I read them.</p><p>HubSpot’s remote MCP server went generally available on April 13, 2026. Its changelog splits the surface explicitly: it reads CRM records, marketing and content objects, and activities, and it creates and updates contacts, companies, deals, tickets, line items and products, plus calls, meetings, notes, tasks and emails. The permission model is the sentence that matters: &quot;All actions respect your existing HubSpot user permissions — users can only access or modify records they already have permission to view or edit.&quot;</p><p>Salesforce’s hosted MCP servers reached GA on April 29, 2026 with the same posture, stated harder: &quot;Your existing permissions automatically apply — CRUD, FLS, sharing rules, and all the other controls you’ve already mastered,&quot; and &quot;Every transaction runs as the authenticated user, without anonymous service accounts or a new security model to learn.&quot; Setup is an External Client App with <code>mcp_api</code> and <code>refresh_token</code> scopes, and Salesforce is explicit that &quot;A new OAuth scope provides access to MCP, but not our existing REST APIs.&quot;</p><p>Sit with that last clause, because it is the single best design decision on this whole board. Salesforce minted a scope that grants MCP and <em>only</em> MCP. Google reused a scope that grants everything. Same protocol, opposite answers to the same question, and you can only tell them apart by reading the consent screen.</p><p>Two more limits worth knowing, both from practitioners rather than vendors. On Salesforce, Agentforce will silently refuse to call a third-party MCP tool whose description has changed since you registered it. An answer on the Salesforce Stack Exchange thread from June 8, 2026 explains the mechanism: Agentforce saves a copy of the tool description at activation, compares it at runtime, and &quot;should any of the content be different, the tool is flagged as having a <code>description_mismatch</code> and excluded from the list of available tools. This is done to prevent rug-pull attacks.&quot; That is a deliberate defence against a server that ships one description to get approved and another to get used. It is also, in practice, a tool that stops working with no error your marketing team will ever see.</p><p>On HubSpot’s CMS, the boundary is architectural rather than security-driven. Issue #6 on <code>HubSpot/mcp-server</code>, opened May 22, 2026 and still open, works out the actual rule: MCP can edit a module’s content when the module is hard-coded into the template as <code>{% module &quot;instance_name&quot; %}</code>, because the instance name is addressable, and cannot when the module was drag-and-dropped into a <code>dnd_area</code> or <code>widget_container</code>, because those instances get auto-generated numeric IDs at placement time. Practically: your coded landing pages are agent-editable and the page marketing built in the drag-and-drop editor is not. That distinction is invisible from the marketing side of the tool, which is exactly the kind of seam I keep meeting in <a href=\"https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack\">how to plan a martech stack before buying tools</a>.</p><h2>What does connecting an agent actually grant?</h2><p>This is the question the vendor deck skipped, and it has a different answer than the tool list on every single row.</p><table><thead><tr><th>Platform</th><th>Scope or permission requested</th><th>What the tool surface exposes</th><th>The gap</th></tr></thead><tbody><tr><td>Google Ads</td><td><code>https://www.googleapis.com/auth/adwords</code>, the API’s only scope</td><td>3 read-only tools</td><td>Full mutate access, held but unused</td></tr><tr><td>Microsoft Advertising</td><td><code>https://ads.microsoft.com/msads.manage</code></td><td>No tool list published in the setup guide</td><td>A management scope for an undisclosed surface</td></tr><tr><td>Meta Ads</td><td><code>ads_mcp_management</code>, <code>ads_read</code>, <code>ads_management</code>, <code>catalog_management</code>, <code>business_management</code>, <code>pages_show_list</code>, <code>instagram_basic</code></td><td>28 ad tools, paused by default</td><td>A general Marketing API token; anything holding it can call the Graph API directly and skip the pause</td></tr><tr><td>HubSpot</td><td>Not advertised, <code>&quot;scopes_supported&quot;: []</code></td><td>Read plus create and update on core CRM objects</td><td>The metadata document does not enumerate it: read the consent screen</td></tr><tr><td>Salesforce</td><td><code>mcp_api</code> and <code>refresh_token</code></td><td>Flows, Apex actions, named queries, sObject reads</td><td>MCP only, and no access to the REST APIs</td></tr></tbody></table><p>The Microsoft row is the one I would put on a slide. Microsoft’s setup guide, dated July 22, 2026, tells you to configure the scope <code>https://ads.microsoft.com/msads.manage offline_access</code> and points at an endpoint carrying <code>?toolSetNames=OpenBeta</code>. The guide documents no tool list at all, and its two example prompts are both reads. So you are asked to grant a management scope to a surface that is not published. It may be entirely read-only today. The token does not care.</p><p>The Meta row is the sharper one operationally. The paused-creation default lives in Meta’s MCP tooling. The permissions you approve are <code>ads_management</code> and friends, ordinary Marketing API permissions. Any process holding that access token can call the Graph API directly, where no MCP tool descriptions and no paused defaults apply. The guardrail is at the MCP layer; the grant is at the API layer underneath it. That is the whole answer to &quot;what does connecting one actually grant,&quot; and it is why I stopped reading tool lists first.</p><h2>Why can my AI client connect to HubSpot but my automation platform cannot?</h2><p>Because the two clients authenticate to HubSpot’s token endpoint differently, and only one of them does it the way HubSpot accepts.</p><p>The MCP specification’s current revision, dated July 28, 2026, sets a priority order for client registration: use pre-registered credentials if you have them; otherwise use Client ID Metadata Documents if the authorization server advertises <code>client_id_metadata_document_supported</code>; otherwise use Dynamic Client Registration if it advertises a <code>registration_endpoint</code>; and otherwise, &quot;Prompt the user to enter the client information if no other option is available.&quot;</p><p>HubSpot’s metadata document, which I fetched this morning, advertises neither. So every client lands on step four. A desktop AI client handles step four gracefully: it shows you a form, you paste in a client ID and secret from an app you created yourself, and it works. An automation platform whose MCP credential was built around the first three steps does not.</p><p>That is not a hypothesis. On July 28, 2026, one reporter filed the same bug against n8n three times in under seven minutes (#35093, #35094 and #35096, the first two withdrawn within seconds as duplicates), all titled &quot;MCP OAuth2 API credential cannot authenticate with HubSpot Remote MCP Server.&quot; The reporter did the work I would have done: replaced the token URL with a webhook to capture the outgoing request, and diffed it against MCP Inspector, which authenticates against the same HubSpot application successfully. HubSpot returns <code>{&quot;status&quot;: &quot;BAD_CLIENT_SECRET&quot;, &quot;message&quot;: &quot;missing or invalid client secret&quot;, &quot;error&quot;: &quot;invalid_client&quot;}</code>. The cause is in the metadata I curled: HubSpot lists <code>&quot;token_endpoint_auth_methods_supported&quot;: [&quot;client_secret_post&quot;]</code> and nothing else, so the credentials must arrive in the request body, and n8n was sending an <code>Authorization: Basic</code> header. The working client also sends <code>resource=https://mcp.hubspot.com/</code>, which n8n had no field for.</p><p>The MCP spec revision is background here, not the subject, but it does explain the direction of travel: the July 28 revision deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, keeping DCR &quot;available for backwards compatibility with authorization servers that do not support Client ID Metadata Documents,&quot; under a minimum twelve-month deprecation window. HubSpot supports neither the deprecated mechanism nor its replacement. If you are picking the tool that will drive these connections, that is a live selection criterion, in the same family as the integration questions in <a href=\"https://www.amirmousavi.com/articles/cdp-crm-and-marketing-automation\">CDP vs. CRM vs. marketing automation</a>.</p><h2>What did registering agent tools on my own site teach me about this?</h2><p>More than reading the specs did, because writing the permission boundary is a different act from reading someone else’s.</p><p>This site registers four browser tools for agents, two of them in <code>AgentTools.jsx</code>. They are read-only and same-origin: one lists published content, one returns the Markdown rendition of a page. That is the write side of a question I took the read side of in <a href=\"https://www.amirmousavi.com/articles/three-layers-ai-crawler-access\">whether AI engines can read your site at all</a>. That is a deliberately small surface. Where I use agents in content work the interesting question is workflow rather than permissions, and I wrote that up separately in <a href=\"https://www.amirmousavi.com/articles/ai-agents-for-seo-content\">AI agents for SEO content</a>. Four decisions in this file map onto everything above.</p><p><strong>The path allowlist.</strong> <code>read_page_as_markdown</code> takes a path argument and validates it against <code>/^\\/(articles|resources|ressources)\\/[a-z0-9-]+$/</code> before it fetches anything. Without that regex the tool is a same-origin fetch proxy for whatever path an agent can be talked into passing. Tool arguments are attacker-influenced input: the model on the other end has read a web page, and the web page may have had opinions. I verified it rejects external URLs and <code>../</code> traversal. That check exists because the alternative is a tool whose real capability is much larger than its description, which is exactly the Google Ads scope problem written small.</p><p><strong>Revocation is the caller’s job, not the platform’s.</strong> The API has no <code>unregisterTool()</code> method; Chrome’s &quot;Unregister tools&quot; section removes a tool by <code>AbortSignal</code> instead, so you pass a signal when you register and fire it yourself on cleanup. Get it wrong and capability you believe you removed is still live on a page that no longer shows it. That is step eight of the checklist above, written small. Every grant in this post has the same property: someone has to own turning it off, and no consent screen will ever remind them.</p><p>The correct API is <code>document.modelContext.registerTool()</code>. A large share of the write-ups I read while building this quote <code>navigator.modelContext.provideContext()</code> instead, including tools that audit sites for agent-readiness. That shape is simply wrong, and it is a useful tell: a page repeating it has not run the code. The same tell works on the ad platforms. Anything describing Meta’s server without the paused-creation default is quoting the launch post.</p><p>Which brings me to the analogy I actually trust here, and it is not a technology one. On a financial services program, the work that made the difference was getting data architects, DBAs, developers and external vendors to agree on the shape of the data before any of it moved. Not a tool decision. A definition-of-done decision, made by the people who would own the consequences, before the first byte crossed a boundary. Granting an agent write scope to a CRM is the same class of decision wearing newer clothes, and it is being made in most organisations by whoever clicked Approve on a consent screen.</p><h2>A checklist before you authorise any agent integration</h2><p>Run this in order. Each step has a failure mode I can point at.</p><ol>\n<li><strong>Read the consent screen, not the tool list.</strong> Write down the exact scope string before approving. Fails when the tool list and the scope disagree: Google’s server is read-only and asks for <code>https://www.googleapis.com/auth/adwords</code>, the Ads API’s only scope, which is full management. The tool list is a promise. The scope is a permission.</li>\n<li><strong>Establish who publishes the server.</strong> Vendor-hosted, vendor-published open source, or a community package? Fails silently because the names collide: Meta’s server is <code>mcp.facebook.com/ads</code>, and <code>pipeboard-co/meta-ads-mcp</code> is an unaffiliated package that carried CVE-2026-48039. Same words, different blast radius.</li>\n<li><strong>Check whose credentials the server runs as.</strong> HubSpot and Salesforce run every transaction as the authenticated user and inherit that user’s permissions, so a restricted CRM user is a real control. A self-hosted server running on an operator’s environment variable is not, and that is the shape CVE-2026-48039 exploited.</li>\n<li><strong>Fetch the authorization server metadata before you commit to a client.</strong> One <code>curl</code> on <code>/.well-known/oauth-authorization-server</code>. Fails when you standardise on an automation platform first and discover the wall second. HubSpot advertises no <code>registration_endpoint</code>, no <code>client_id_metadata_document_supported</code> and <code>&quot;scopes_supported&quot;: []</code>, and the token endpoint accepts credentials only in the request body, which is where an automation platform sending an <code>Authorization: Basic</code> header fails. I have since run the same command against Braze and Klaviyo, after the spec revision, in <a href=\"https://www.amirmousavi.com/articles/how-to-check-a-martech-vendor-mcp-server\">how to check a martech vendor’s MCP server</a>.</li>\n<li><strong>Look up the namespace in the official MCP registry.</strong> Fails on a false sense of vetting: the registry’s own design principles state &quot;No built-in ranking, curation, or quality judgments&quot; and delegate source-code security to npm and PyPI. A listing is a name claim, not an audit.</li>\n<li><strong>Ask where the guardrail is enforced, server or client.</strong> Meta’s write tools create entities paused and &quot;your AI client asks for confirmation before activation.&quot; Fails the day you replace the client with your own orchestrator and keep the write scope.</li>\n<li><strong>Test against a sandbox or a deliberately restricted user first.</strong> Fails in ways nobody warns you about: Agentforce excludes third-party tools whose description changed with a <code>description_mismatch</code> and no user-visible error, and HubSpot’s MCP cannot edit modules placed in a <code>dnd_area</code> at all.</li>\n<li><strong>Write down the revocation path and the expiry, and put a date on the review.</strong> Fails by omission. Every fact in this post has a doc date inside the last five months, and a Google maintainer has already announced writes are coming. A permission decision made in August 2026 on August 2026 evidence needs a re-read in the autumn.</li>\n</ol><p>Steps one through three are the ones I would not skip under deadline pressure. If you want the wider version of this conversation, the <a href=\"https://www.amirmousavi.com/resources/martech-stack-assessment\">interactive martech stack assessment</a> covers the surrounding architecture, and the <a href=\"https://www.amirmousavi.com/resources/martech-glossary\">martech glossary</a> defines the vocabulary these vendor decks assume you already share.</p><h2>Is any of this actually dangerous?</h2><p>Once, verifiably, and not where the marketing conversation is looking.</p><p>CVE-2026-48039 was published on August 7, 2026 with a CVSS 3.1 base score of 9.1, critical, classified CWE-287. It affects <code>pipeboard-co/meta-ads-mcp</code> before version 1.0.109, a community package, not Meta’s hosted server. NVD’s description is worth reading closely, because the failure chain is ordinary rather than exotic: the auth middleware &quot;unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a <code>401</code> response, allowing any network-reachable caller to invoke MCP tools without authentication.&quot; With no per-request credential, handlers fall back to the operator’s <code>META_ACCESS_TOKEN</code>. And when the downstream Graph API call fails, the code &quot;serialises the raw <code>httpx</code> request URL — including the operator’s <code>access_token</code> as a query parameter — into the JSON-RPC response body, delivering the credential to the unauthenticated caller.&quot;</p><p>Three ordinary mistakes, stacked. A missing 401, a fallback credential, and an error handler that echoes a URL. The result is that a failed request hands your ad account token to whoever asked. CISA’s SSVC assessment on the same record marks exploitation as proof-of-concept, automatable, with total technical impact.</p><p>That package is listed in the official MCP registry, under the namespace <code>co.pipeboard</code>. So is the same publisher’s Google Ads server, published May 21, 2026. The version listed there today, 1.0.120, is past the 1.0.109 fix. The point is that the listing itself never told you either way. Listing is not endorsement, and the registry says so in its own design documents: &quot;No built-in ranking, curation, or quality judgments,&quot; &quot;Let consumers (MCP clients, aggregators) make their own curation decisions,&quot; &quot;Avoid features that require constant human intervention or moderation.&quot; It leans on npm and PyPI for source security, &quot;obviating the need to reinvent source code security.&quot; That is a defensible architecture for a metaregistry. It is not a safety signal, and the ecosystem is being read as though it were. For scale: a keyword search for &quot;mcp server&quot; in the National Vulnerability Database returned 288 entries (184 for the exact phrase) entries on August 21, 2026.</p><p>Then there is the finding I keep coming back to. The registry supports DNS and HTTP verification for domain namespaces such as <code>com.example.*</code>, and GitHub OAuth for <code>io.github.*</code>. I checked seven martech vendors. <strong><code>com.hubspot</code>, <code>com.salesforce</code>, <code>com.adobe</code>, <code>com.klaviyo</code>, <code>com.braze</code>, <code>com.twilio</code> and <code>com.segment</code> hold zero servers between them.</strong> Search the registry for HubSpot and you do get results; every one of them sits under somebody else’s namespace, mostly <code>io.github.*</code>. Google holds fifteen verified namespaces, every one of them <code>com.googleapis.*</code> (Compute, Firestore, Cloud Run, Monitoring and so on), and none for Ads or Analytics. Meanwhile <code>com.stripe/mcp</code> has been listed since October 28, 2025, pointing at <code>mcp.stripe.com</code>.</p><p>So this is not a capability gap. Stripe proves a vendor can claim its namespace when it decides the ecosystem matters. The martech vendors have shipped MCP servers and have not claimed theirs, which means an agent discovering a &quot;HubSpot&quot; server through the registry today is finding somebody else’s code with HubSpot’s name on it.</p><h2>My working take</h2><p>The read/write matrix is the least interesting thing on this page and it is the only thing most coverage reproduces. Read-only versus write is a release-note distinction that a maintainer comment can invalidate in a sprint. The scope is the durable fact. The next question after scope is price, and the rate cards answer it less stably than the tool lists do. I read them in <a href=\"https://www.amirmousavi.com/articles/what-does-an-ai-agent-action-cost\">what one AI agent action costs</a>.</p><p>If I were advising a marketing ops lead this week, the position would be narrow. Connect read tools freely; the value is real and the downside is a report you have to sanity-check, which is the same downside reporting always had. Treat any write scope as a change to your access model, not a productivity feature, and route it through whoever owns access to that system, the same people who would have to be in the room before data moved anywhere else. And prefer the platforms that scoped this properly: Salesforce minting an MCP-only scope and both CRMs inheriting the authorising user’s permissions are meaningfully better postures than a single all-powerful ads scope, and that ordering is not the one the marketing conversation assumes.</p><p>What I do not know is the operational failure rate. I have read the documentation carefully and I have written agent tools with permission boundaries on them, and neither of those tells me how often a write-capable agent does something expensive in a real ad account. Nobody I can find has published that, and I am not going to estimate it. The other thing I do not know is how much of this survives September. The most consequential sentence I read all week was a maintainer saying write access is coming soon, which is why the honest form of this post is a snapshot with the verification date printed on it, and why any version of it you read without one is not telling you something it should.</p><p>A boring conclusion: read the scope, not the tool list. I think it is the right one, and it will still be right after the tool lists change.</p><h2>Frequently asked questions about AI agents in ad accounts and CRM</h2><h3>Can an AI agent pause a Google Ads campaign?</h3><p>Not through Google’s official MCP server. Its documentation, last updated August 19, 2026, states: &quot;This implementation is strictly read-only. It cannot modify bids, pause campaigns, or create new assets.&quot; Only three tools are exposed: <code>list_accessible_customers</code>, <code>search</code> and <code>get_resource_metadata</code>. A maintainer confirmed on June 4, 2026 that write access is planned, so treat this as a current-release fact rather than a design commitment.</p><h3>Can an AI agent create Meta ads without approval?</h3><p>It can create them, and Meta’s documentation says they arrive paused: &quot;Write tools create entities in a paused state; your AI client asks for confirmation before activation.&quot; Confirmation is the AI client’s responsibility, not the server’s, and a separate tool called <code>ads_activate_entity</code> exists to switch a paused entity to active. A custom or unattended client keeps the write tools and loses the prompt.</p><h3>What permissions does connecting an AI agent to HubSpot grant?</h3><p>Whatever the authorising user already has. HubSpot’s GA changelog from April 13, 2026 states that &quot;All actions respect your existing HubSpot user permissions — users can only access or modify records they already have permission to view or edit.&quot; The server reads CRM records, marketing content and activities, and creates and updates contacts, companies, deals, tickets, line items, products and activities. Its authorization metadata returns <code>&quot;scopes_supported&quot;: []</code>, so you cannot enumerate the grant in advance: restrict the connecting user instead.</p><h3>Is the official MCP registry safe to install from?</h3><p>It is a directory, not a review board. Its published design principles state &quot;No built-in ranking, curation, or quality judgments&quot; and delegate source-code security to package registries such as npm and PyPI. A registry listing verifies a namespace claim, nothing more. <code>pipeboard-co/meta-ads-mcp</code>, which carried the critical CVE-2026-48039, is listed there.</p><h3>Do martech vendors publish official MCP servers in the registry?</h3><p>Not as of August 21, 2026. Checked directly against the registry API, the namespaces <code>com.hubspot</code>, <code>com.salesforce</code>, <code>com.adobe</code>, <code>com.klaviyo</code>, <code>com.braze</code>, <code>com.twilio</code> and <code>com.segment</code> hold zero servers, and Google’s fifteen verified namespaces are all <code>com.googleapis.*</code> with none for Ads or Analytics. <code>com.stripe/mcp</code> has been listed since October 28, 2025, so vendors clearly register when they choose to. Get your connection details from the vendor’s own documentation, not from a search result.</p><h2>Sources I used</h2><p>Verified at source: August 21, 2026.</p><ul>\n<li><a href=\"https://developers.google.com/google-ads/api/docs/developer-toolkit/mcp-server\">Google: Google Ads API MCP Server, updated August 19, 2026</a></li>\n<li><a href=\"https://developers.google.com/google-ads/api/docs/oauth/internals\">Google: OAuth internals for the Google Ads API — the single <code>adwords</code> scope</a></li>\n<li><a href=\"https://github.com/googleads/google-ads-mcp/issues/84\">googleads/google-ads-mcp issue #84, maintainer comment, June 4, 2026</a></li>\n<li><a href=\"https://github.com/googleads/google-ads-mcp/issues/102\">googleads/google-ads-mcp issue #102, &quot;search tool is unusable,&quot; August 10, 2026</a></li>\n<li><a href=\"https://developers.facebook.com/blog/post/2026/07/16/meta-ads-mcp-server/\">Meta: &quot;Meta’s ads MCP server is now available for developers,&quot; July 16, 2026</a></li>\n<li><a href=\"https://developers.facebook.com/documentation/ads-commerce/ads-ai-connectors/ads-mcp-server/ads-mcp-server-tools-ad-creation-and-management\">Meta: Ads MCP server — ad creation and management tools</a></li>\n<li><a href=\"https://developers.facebook.com/documentation/ads-commerce/ads-ai-connectors/ads-mcp-server/ads-mcp-server-get-started\">Meta: Ads MCP server — get started, permissions and endpoint</a></li>\n<li><a href=\"https://developers.hubspot.com/changelog/remote-hubspot-mcp-server-is-now-generally-available\">HubSpot: Remote HubSpot MCP server is now generally available, April 13, 2026</a></li>\n<li><a href=\"https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server\">HubSpot: integrate AI tools with the HubSpot MCP server, &quot;Available tools&quot;, 32 named, counted October 9, 2026</a></li>\n<li><a href=\"https://github.com/HubSpot/mcp-server/issues/6\">HubSpot/mcp-server issue #6, <code>dnd_area</code> limits, May 22, 2026</a></li>\n<li><a href=\"https://github.com/n8n-io/n8n/issues/35094\">n8n issue #35094, HubSpot MCP OAuth token exchange, July 28, 2026</a></li>\n<li><a href=\"https://developer.salesforce.com/blogs/2026/04/salesforce-hosted-mcp-servers-are-now-generally-available\">Salesforce: Salesforce Hosted MCP Servers Are Now Generally Available, April 29, 2026</a></li>\n<li><a href=\"https://salesforce.stackexchange.com/questions/439485\">Salesforce Stack Exchange: &quot;3rd Party MCP, description_mismatch error,&quot; June 8, 2026</a></li>\n<li><a href=\"https://learn.microsoft.com/en-us/advertising/guides/mcp-setup\">Microsoft: MCP Server Setup Guide, Microsoft Advertising API, ms.date July 22, 2026</a></li>\n<li><a href=\"https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration\">Model Context Protocol: client registration, revision 2026-07-28</a></li>\n<li><a href=\"https://modelcontextprotocol.io/specification/2026-07-28/changelog\">Model Context Protocol: changelog for revision 2026-07-28</a></li>\n<li><a href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-48039\">NVD: CVE-2026-48039, published August 7, 2026, CVSS 9.1</a></li>\n<li><a href=\"https://github.com/modelcontextprotocol/registry/blob/main/docs/design/design-principles.md\">MCP registry: design principles</a></li>\n<li><a href=\"https://developer.chrome.com/docs/ai/webmcp/imperative-api\">Chrome: WebMCP imperative API, updated August 20, 2026</a></li>\n<li><a href=\"https://developer.chrome.com/docs/ai/webmcp\">Chrome: WebMCP overview — origin trial from Chrome 149 and the local testing flag</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/what-ai-agents-can-do-in-your-martech",
            "title": "What Can AI Agents Do in Your Ad Accounts and CRM?",
            "summary": "Google's Ads MCP server is read-only. Meta's creates campaigns. What each connection's OAuth scope actually grants, verified at source August 21, 2026.",
            "date_modified": "2026-08-21T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "AI agents",
                "Model Context Protocol",
                "marketing operations",
                "OAuth scopes",
                "vendor risk",
                "CRM"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/can-you-trust-ai-visibility-scores",
            "content_html": "<p>I went looking for the paper behind the &quot;up to 40%&quot; figure because I kept meeting the figure without the paper. Finding it was easy. Reading it was the part that changed my mind, and not in the direction people usually point it.</p><p>Somewhere between 2024 and now, &quot;AI visibility&quot; became a product category. A dozen tools will sell you a score: how often ChatGPT mentions your brand, what share of Perplexity answers cite your domain, whether Gemini names you in your category. The dashboards look like rank trackers, because familiar things get budget.</p><p>So I spent part of 2026 reading the papers underneath those dashboards. There is a gap between what the research measures and what the category sells, and it is wider than I expected. The most-cited published result in this field concerns content that has already been retrieved. It is marketed as a way to become retrieved.</p><p>None of that means AI visibility does not matter. It means most of what is sold as a measurement of it is one sample of a probabilistic system, reported to two significant figures.</p><h2>Quick answer</h2><p>No, not as point estimates. AI visibility scores are single-run samples of a non-deterministic system, and a July 2026 survey of 45 studies found no technique with a stable, cross-platform causal effect on organic discoverability. What I do instead: run each prompt at least 30 times per surface, which is a floor below every published sampling threshold, report a confidence interval rather than a point estimate, and anchor to first-party citation data where an engine publishes it.</p><h2>Where does the &quot;40% improvement&quot; figure come from?</h2><p>It comes from a real, peer-reviewed paper, and it is almost always misread. &quot;GEO: Generative Engine Optimization,&quot; by Pranjal Aggarwal, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, Karthik Narasimhan and Ameet Deshpande, reached arXiv on November 16, 2023, was revised June 28, 2024, and was accepted to KDD 2024. The abstract states: &quot;we demonstrate that GEO can boost visibility by up to 40% in generative engine responses.&quot; The same paper introduced GEO-bench and warned that &quot;the efficacy of these strategies varies across domains.&quot;</p><p>Then I got to the method. The experiment modifies source documents already inside the generative engine’s context window, then measures how prominently they appear in the answer. Already inside. It studies what happens after retrieval, not whether you get retrieved.</p><p>I read that section twice, because an entire product category is sold on the other reading. Selling the first result as though it were the second is this category’s founding error, and every claim stacked on top of it inherits the error.</p><h2>Why do two AI visibility tools give different numbers?</h2><p>Because they sample, and what they sample is non-deterministic. Ronald Sielinski’s &quot;Quantifying Uncertainty in AI Visibility: A Statistical Framework for Generative Search Measurement&quot; (arXiv, March 9, 2026, revised June 9, 2026) opens with the reason: &quot;identical queries submitted at different times can produce different responses and cite different sources.&quot; He sampled Perplexity Search, OpenAI SearchGPT and Google Gemini across three consumer product topics, daily for nine days plus a run at ten-minute intervals over four hours.</p><p>This was the second paper I found, and it is the one that changed how I read a dashboard. Citation distributions &quot;follow a power-law form and exhibit substantial variability across repeated samples,&quot; and bootstrap confidence intervals showed that &quot;many apparent differences between domains fall within the noise floor of the measurement process.&quot; I had assumed the instability would sit at the top of the list, where a few large domains trade places. It does not. Rankings were unstable &quot;throughout the frequently cited domain set.&quot;</p><p>So when two vendors hand you two different numbers, you have not caught one of them lying. You have two draws from a heavy-tailed distribution. Run the same tool twice and you get the same disagreement for free.</p><h2>What does the research actually support?</h2><p>I found the survey last, and it is the most useful document I read this year. Olivier Martinez’s &quot;Optimizing Visibility in Generative Engines: A Critical Survey of Generative Engine Optimization (2023–2026)&quot; is an arXiv preprint submitted July 15, 2026. It has not been peer reviewed. I am not going to bury that in an article about evidence standards; I lean on it anyway because its claims are checkable against the corpus it lists, which makes it a paper you can argue with. It reviews 45 studies from a November 2023 to July 2026 window and finds that &quot;no reviewed technique shows a stable, longitudinal, cross-platform causal effect on organic discoverability or downstream behavior.&quot; On the KDD paper specifically, its &quot;widely cited gains are valid within its experimental setting but conditional on a source already being present in a fixed context; they establish neither organic discoverability nor durable traffic effects.&quot;</p><p>Two of its findings stayed with me, for opposite reasons. The comfortable one: &quot;topical relevance and context position are the most reproducible levers,&quot; while &quot;generic heuristics transfer poorly&quot; and &quot;competition can erode individual gains.&quot; Relevance and position. That is close to what I would have guessed, and agreeing with a paper is not evidence, but I will take the alignment.</p><p>The other finding I did not enjoy at all: &quot;citation-oriented rewrites can impair retrieval.&quot; Sit with that for a second. A large share of what this industry sells is citation-oriented rewriting, so its flagship product may be working against the retrieval step you had to clear first. Martinez also finds that commercial audits show &quot;low source overlap, substantial run-to-run variability, and persistent fidelity gaps.&quot;</p><p>Then there are the numbers everyone quotes about schema markup and AI citation rates. I tried to trace several of them. Every trail ended in an article citing an article, with no published methodology at the bottom, so I am not restating them here. I would rather leave a hole in this piece than launder someone’s unsourced statistic through my own site.</p><p>Philipp Götza named the problem in Search Engine Land on January 19, 2026: a ladder of misinference running statement, fact, data, evidence, proof, where &quot;to accept something as proof, it needs to climb the rungs of the ladder.&quot; Most GEO claims I meet sit on the first or second rung. A few never went near the ladder.</p><h2>Which tactics does Google’s own documentation contradict?</h2><p>Google’s guide on optimizing for generative AI features, updated July 10, 2026, is blunter than I expected a Google document to be. It forecloses three things this category sells. On schema: &quot;Structured data isn’t required for generative AI search, and there’s no special schema.org markup you need to add.&quot; On AI-specific files: &quot;You don’t need to create new machine readable files, AI text files, markup, or Markdown to appear in Google Search (including its generative AI capabilities), as Google Search itself doesn’t use them.&quot; On chunking: &quot;There’s no requirement to break your content into tiny pieces for AI to better understand it.&quot;</p><p>What Google does call a requirement is unglamorous: &quot;a page must be indexed and eligible to be shown in Google Search with a snippet, fulfilling the Search technical requirements.&quot; Its companion page on AI features, updated December 10, 2025, adds that &quot;there are no additional requirements to appear in AI Overviews or AI Mode, nor other special optimizations necessary.&quot; Google names retrieval-augmented generation over its core Search index as the mechanism, which means the retrieval layer is the index you have been working on for years — the <a href=\"https://www.amirmousavi.com/resources/seo-architecture-checklist\">SEO architecture checklist</a>, not a new file format. A boring conclusion, and I think it is the right one.</p><p>ChatGPT, Perplexity and Claude document their retrieval far less. That asymmetry limits what anyone can honestly claim about them, including me.</p><h2>A measurement protocol you can defend</h2><p>Here is what I would actually run. It is built for one moment: someone asks how you know, and the answer is a method instead of a vendor logo. It also decays the way an event specification decays when nobody owns it, which is the pattern behind <a href=\"https://www.amirmousavi.com/articles/why-analytics-implementations-fail\">why analytics implementations fail</a> and the <a href=\"https://www.amirmousavi.com/resources/analytics-implementation-checklist\">analytics implementation checklist</a>.</p><ol>\n<li><strong>Freeze a prompt set.</strong> Twenty to forty prompts a real buyer would type, in a versioned file: category, comparison and problem-first questions. Adding prompts mid-quarter makes trend lines meaningless, and mid-quarter is exactly when somebody will want to add prompts.</li>\n<li><strong>Fix the surfaces.</strong> Name the assistants and modes, plus account state: logged out, memory off, personalization off, one locale. Different surfaces are different populations. Never pool them, and if a dashboard is quietly summing them for you, it is wrong.</li>\n<li><strong>Set repetitions before you see any result.</strong> This is the step that gets cut first, usually on cost, and cutting it turns the whole exercise into decoration. For a 95% confidence interval spanning five percentage points on citation share, Sielinski reports roughly n ≈ 40–50 for Gemini, about n ≈ 100 for Perplexity and n ≥ 150 for SearchGPT. Thirty runs per prompt per surface is an absolute floor that clears none of those thresholds; if that is too costly, cut prompts rather than repetitions.</li>\n<li><strong>Record run-level rows, not aggregates.</strong> Timestamp, surface, prompt ID, whether your domain was cited, its position, and every cited domain. That last column turns a count into a share, and most vendor exports omit it. Ask to see one before you sign anything.</li>\n<li><strong>Report an interval, never a point.</strong> Bootstrap the runs: &quot;cited in 18% to 31% of runs, n = 30, week of July 20, 2026.&quot; (Those figures are a format example, not a measurement.) A single number implies precision the measurement does not have, and the single number is the one people remember.</li>\n<li><strong>Re-baseline on a fixed cadence and pre-register changes.</strong> Same prompts, surfaces and repetitions each month or quarter. Before a content change, write what you expect to move and by how much. This is the other step everyone skips, and it is the cheapest one here. A predicted movement is evidence; one noticed afterward is a story.</li>\n<li><strong>Anchor to a first-party denominator.</strong> Bing Webmaster Tools added Citation Share on June 16, 2026: your citations as a share of all citations shown for the same grounding query. Its AI Performance preview (February 10, 2026) adds Total Citations and Average Cited Pages. The full definition and the other three measurement layers are in <a href=\"https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic\">how to measure AI search traffic</a>.</li>\n</ol><h3>Claim, evidence, action</h3><table><thead><tr><th>Claim</th><th>What the evidence supports</th><th>What to do instead</th></tr></thead><tbody><tr><td>&quot;GEO lifts visibility up to 40%.&quot;</td><td>True for already-retrieved sources in a fixed context (Aggarwal et al., 2024).</td><td>Measure &quot;am I retrieved?&quot; and &quot;how am I presented?&quot; apart.</td></tr><tr><td>&quot;Add this schema and get cited more.&quot;</td><td>Google, July 2026: no special schema.org markup is needed.</td><td>Keep schema for what it does do.</td></tr><tr><td>&quot;Rewrite pages for citation.&quot;</td><td>Martinez, 2026: &quot;citation-oriented rewrites can impair retrieval.&quot;</td><td>Work on topical relevance and context position.</td></tr><tr><td>&quot;Your score is 42.&quot;</td><td>Single runs sample a power-law distribution with high variance (Sielinski, 2026).</td><td>Report a bootstrap interval with n and date.</td></tr><tr><td>&quot;Ship an llms.txt to reach AI answers.&quot;</td><td>Google: AI text files are not needed for Google Search.</td><td>Ship one if you want; do not book it as a tactic.</td></tr></tbody></table><h2>Does llms.txt do anything? What this site claims</h2><p>This site ships an <a href=\"https://www.amirmousavi.com/llms.txt\">/llms.txt</a>. I keep it because it is a cheap, honest table of contents describing my pages in my own words. Whether assistants read it, I do not know. I have no evidence it changes whether any of them cite me, and Google’s July 2026 guidance says such files are not needed. It costs one route file, so I keep it and I do not claim it works. Where I use AI in content work, the useful parts are research, briefs, metadata and QA rather than citation-chasing rewrites — the workflow in <a href=\"https://www.amirmousavi.com/articles/ai-agents-for-seo-content\">AI agents for SEO content</a>.</p><h2>My working take</h2><p>I am not against these tools. Sampling assistants at scale is real engineering, and I would rather someone else ran that infrastructure. What I object to is the number on the front of the dashboard, which is one draw from a high-variance distribution, printed like a fact.</p><p>If you are about to buy one, the useful questions are not about features. How many runs per prompt, per surface? Can I see the prompt set, edit it, and keep its version history? Does the export list every cited domain or only mine? A vendor who answers those is doing measurement. A vendor who answers with a score out of 100 has built a rank tracker for a system that does not rank.</p><p>The honest version of my position is less satisfying than a score. I do not know whether most GEO tactics work. Neither does anyone selling them, and that is the 2026 literature’s finding, not my opinion about it. What I do know is that the retrieval layer is the index, that improving it looks a great deal like the SEO work that already existed, and that a measurement you can defend in a meeting beats a number you cannot.</p><h2>Frequently asked questions about AI visibility scores</h2><h3>Can you trust AI visibility scores from commercial tools?</h3><p>Not as point estimates, no. Martinez’s July 2026 survey reports that commercial audits show &quot;low source overlap&quot; and &quot;substantial run-to-run variability.&quot; Ask a vendor for its sample size and prompt set, then compare intervals rather than numbers.</p><h3>How many times should you run a prompt to measure AI visibility?</h3><p>More times than you will want to. At least 30 runs per prompt per surface, and that floor clears none of the published thresholds. For a 95% confidence interval spanning five percentage points on citation share, Sielinski (2026) reports roughly n ≈ 40–50 for Gemini, about n ≈ 100 for Perplexity and n ≥ 150 for SearchGPT. If the budget will not stretch that far, measure fewer prompts properly instead of more prompts badly.</p><h3>Does the &quot;40% GEO improvement&quot; apply to my website?</h3><p>Only in the narrow sense the paper tested. Aggarwal et al. (KDD 2024) measured how sources already in a generative engine’s context can be modified to appear more prominently, and Martinez calls those gains &quot;conditional on a source already being present in a fixed context.&quot; If you are not retrieved in the first place, the finding has nothing to say about you.</p><h3>Does structured data improve AI citations?</h3><p>Google’s guidance updated July 10, 2026 says no special markup is required: &quot;there’s no special schema.org markup you need to add.&quot; I still ship schema, for the things schema actually does. The vendor statistics claiming large schema-driven citation lifts are exactly the ones I could not trace to a methodology.</p><h3>What is the most reliable AI visibility data available today?</h3><p>First-party engine data, and it is not close. Bing Webmaster Tools has reported Citation Share since June 16, 2026, calculated against all citations shown for the same grounding query. It is a denominator you did not have to estimate.</p><h2>Sources I used</h2><p>Verified at source: July 29, 2026.</p><ul>\n<li><a href=\"https://arxiv.org/abs/2607.14035\">Martinez, &quot;Optimizing Visibility in Generative Engines: A Critical Survey of Generative Engine Optimization (2023–2026),&quot; arXiv preprint, July 15, 2026</a></li>\n<li><a href=\"https://arxiv.org/abs/2311.09735\">Aggarwal et al., &quot;GEO: Generative Engine Optimization,&quot; arXiv 2023, KDD 2024</a></li>\n<li><a href=\"https://arxiv.org/abs/2603.08924\">Sielinski, &quot;Quantifying Uncertainty in AI Visibility: A Statistical Framework for Generative Search Measurement,&quot; arXiv, March 9, 2026</a></li>\n<li><a href=\"https://developers.google.com/search/docs/fundamentals/ai-optimization-guide\">Google: optimizing for generative AI features (July 10, 2026)</a></li>\n<li><a href=\"https://developers.google.com/search/docs/appearance/ai-features\">Google: AI features and your website (December 10, 2025)</a></li>\n<li><a href=\"https://blogs.bing.com/search/June-2026/New-AI-Visibility-Insights-in-Bing-Webmaster-Tools-Intents-Topics-Citation-Share-Compare\">Bing: New AI Visibility Insights, June 16, 2026</a></li>\n<li><a href=\"https://blogs.bing.com/webmaster/February-2026/Introducing-AI-Performance-in-Bing-Webmaster-Tools-Public-Preview\">Bing: AI Performance in Bing Webmaster Tools, February 10, 2026</a></li>\n<li><a href=\"https://searchengineland.com/geo-myths-lies-467617\">Götza, &quot;GEO myths: This article may contain lies,&quot; Search Engine Land, January 19, 2026</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/can-you-trust-ai-visibility-scores",
            "title": "Can You Trust AI Visibility Scores?",
            "summary": "AI visibility scores are single runs of a probabilistic system. What the 2026 research actually supports, and a measurement protocol you can defend.",
            "date_modified": "2026-08-03T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "AI visibility",
                "generative engine optimization",
                "AI search",
                "measurement",
                "SEO research"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic",
            "content_html": "<p>I went looking for one number and came back with four that do not add up.</p><p>The question behind it is ordinary. What share of a site’s traffic now comes from AI search? You will be asked some version of it in a meeting this year if you have not been already, and I wanted to know whether I could answer it honestly. On paper the timing looked good. Bing Webmaster Tools introduced an AI Performance report on February 10, 2026. Google Analytics 4 added an AI Assistant channel to its default channel group. Google Search Console began rolling out a generative AI performance report in June 2026. Three new reports inside one half-year, sitting on top of server logs, the oldest layer, which were always there and remain the one most teams never read. I assumed the answer was waiting in a console I had not opened yet.</p><p>It was not. I spent July 29, 2026 reading the documentation instead of the dashboards, and that is where it became obvious: the four do not measure the same thing. One counts HTTP requests, one impressions, one citations, one sessions. No honest arithmetic joins them. And the single system with &quot;AI&quot; in its name, GA4&#x27;s AI Assistant channel, cannot see the AI surface most people mean when they ask the question.</p><p>More reporting made the reporting worse. That surprised me, and on reflection it should not have.</p><p>So when a GA4 property is presented to me as measuring AI search, the first thing I check is not the number. It is which system produced it, and what that system cannot see.</p><h2>Quick answer</h2><p>Four systems now measure AI search, each in its own unit: server logs count crawler requests, Search Console’s generative AI report counts impressions, Bing Webmaster Tools counts citations, and GA4&#x27;s AI Assistant channel counts sessions. I report them separately, because they cannot be summed or reconciled. GA4&#x27;s AI channel explicitly excludes Google’s own AI Overviews and AI Mode, so it cannot see AI inside Google Search at all.</p><h2>Does GA4&#x27;s AI Assistant channel include AI Overviews?</h2><p>No, and Google’s own default channel group documentation, which I read on July 29, 2026 and again on October 10, says so plainly: &quot;AI Assistant is the channel by which users arrive at your site from sources like ChatGPT, Gemini, Deepseek, Copilot, or Grok. It excludes Google’s AI Overviews and AI Mode.&quot; The definition has two parts. The channel matches when &quot;The medium exactly matches &#x27;ai-assistant&#x27;,&quot; and GA4 sets that medium itself: &quot;The medium is set to &#x27;ai-assistant&#x27; and the campaign is set to &#x27;(ai-assistant)&#x27; if the referrer matches a list of AI Assistants.&quot; It is referrer detection over a list Google maintains — which is exactly why it cannot see a surface whose clicks carry an ordinary google.com referrer. The same page defines Organic Search as arrivals &quot;via non-ad links in organic-search results, including Google’s AI Overviews and AI Mode.&quot;</p><p><strong>A naming note, added October 10, 2026.</strong> When I first read the page, its definition sentence said &quot;AI Assistants&quot; while its own rules table said &quot;AI Assistant&quot;. Google has since aligned the definition to the singular: the Wayback Machine captures of July 31 and October 2, 2026 bracket the change. The matching rules did not change, so nothing about what the channel counts is different. I have updated the name throughout this post.</p><p>So the one channel GA4 built to represent AI is blind to the AI surface inside Google Search. I do not think that is a bug. The channel does exactly what its definition says it does. But the name will be misread by nearly everyone who sees it, and I would not blame a single one of them. AI Overviews and AI Mode sessions land in Organic Search, indistinguishable from ordinary blue-link clicks.</p><p>A slide presenting GA4&#x27;s AI Assistant number as &quot;our AI traffic&quot; is describing referral traffic from a few named chat assistants. If your dashboard is labelled that way, it overstates one thing while hiding another. I write the exclusion into the metric definition itself so it travels with the number, per my <a href=\"https://www.amirmousavi.com/resources/ga4-gtm-notes\">GA4 and GTM notes</a>.</p><h2>What does the Search Console generative AI report actually show?</h2><p>Impressions. I went looking for more and there is not much more.</p><p>Google’s Search Console Help page states that the report &quot;includes impressions for the following generative AI capabilities on Google Search: AI Overviews&quot; and &quot;AI Mode,&quot; grouped by page, country, date, and device. I read it in full on July 29, 2026: no clicks, no click-through rate, no position, no queries. It also excludes &quot;data from experiments in Search Labs.&quot;</p><p>The sentence that changed how I read this report is in a different document. Google’s AI features documentation, last updated December 10, 2025, states that &quot;sites appearing in AI features (such as AI Overviews and AI Mode) are included in the overall search traffic in Search Console&quot; and are reported &quot;within the &#x27;Web&#x27; search type.&quot;</p><p>That sentence does more work than its length suggests. AI clicks are already inside your Web totals, undifferentiated. The new report is an impressions-only breakout sitting on top of a click total you cannot decompose. Divide one by the other and you get a ratio with no referent, because there is no AI click figure to divide by and Google does not publish one.</p><h2>Why does Bing tell you more than Google?</h2><p>Because Microsoft chose to publish a smaller unit: the citation. Microsoft’s February 10, 2026 announcement introduced Total Citations — the &quot;total number of citations that are displayed as sources in AI-generated answers during the selected time frame&quot; — plus grounding queries, the &quot;key phrases the AI used when retrieving content that was referenced in AI-generated answers.&quot; On June 16, 2026 Microsoft added Intents, Topics, Compare, and Citation Share: &quot;the percentage of citations attributed to your site out of all citations shown across all sites for that same grounding query.&quot; Google publishes no equivalent.</p><p>Bing gives me more detail than the other three combined. I would still refuse to use it to describe Google. Microsoft calls Citation Share &quot;designed as an observational metric – not a ranking system or a competitive scoreboard,&quot; and the February preview says of grounding queries that &quot;The data shown represents a sample of overall citation activity.&quot; Different retrieval system, different query population, and the vendor itself calls the sample a sample.</p><h2>What can only server logs see?</h2><p>Crawlers. Nothing else observes them, and GA4 structurally cannot. GA4&#x27;s standard web collection is a client-side tag: something has to execute the page’s JavaScript for a measurement call to be sent, so a system that fetches your HTML without running scripts leaves no GA4 record at all. I could not find vendor documentation confirming which AI crawlers execute JavaScript, so I will not repeat the common claim that most do not.</p><p>Logs also show you something no dashboard will, which is whether the published commitments hold on your own domain. OpenAI documents four crawlers with different jobs: GPTBot for model training, OAI-SearchBot for ChatGPT search results, OAI-AdsBot for ad safety, and ChatGPT-User for user-triggered visits. Of the last, OpenAI says: &quot;Because these actions are initiated by a user, robots.txt rules may not apply.&quot; Meta is equally direct: &quot;The Meta-ExternalFetcher crawler may bypass robots.txt because it performs fetches that were requested by the user.&quot;</p><p>Vendors differ on robots.txt more than the listicles suggest, and I checked rather than assumed. Anthropic’s crawler documentation, dated April 7, 2026, describes ClaudeBot, Claude-User, and Claude-SearchBot. I went in looking specifically for a user-initiated robots.txt exemption and found none: &quot;Anthropic’s Bots respect &#x27;do not crawl&#x27; signals by honoring industry standard directives in robots.txt.&quot; Grouping Claude-User with ChatGPT-User and Meta-ExternalFetcher would make a tidier paragraph. Anthropic’s documentation does not support it, so I am not writing it.</p><p>Google documents its own tokens separately — Googlebot for Search, and Google-Extended as a standalone control for Gemini training and grounding that Google says does not affect Search inclusion or ranking. Only your logs show which of these commitments is actually kept on your domain. That is why I treat log retention as part of the site’s architecture rather than an operations detail, alongside the items in my <a href=\"https://www.amirmousavi.com/resources/seo-architecture-checklist\">SEO architecture checklist</a>.</p><h2>Which AI measurement system answers which question?</h2><p>Sort them by the question each one can actually answer and most of the confusion goes away.</p><p>Logs are a record of who fetched what: which AI systems pulled which URLs, how often, with what status code. Search Console tells you how often Google displayed your pages inside AI Overviews and AI Mode, then stops. Bing is the only one of the four that will name the pages it cited in Microsoft’s AI answers and give you a share figure against a grounding query. GA4? Sessions from assistant referrers, plus everything those people did next, which is genuinely valuable as long as nobody calls it the whole picture.</p><p>No single console holds all four. I have stopped waiting for one that does.</p><table><thead><tr><th>Layer</th><th>Unit it counts</th><th>What it cannot see</th></tr></thead><tbody><tr><td>Server logs</td><td>One HTTP request, by user agent and IP</td><td>Whether a human ever saw the answer; anything served from CDN cache</td></tr><tr><td>Search Console generative AI report</td><td>One impression in AI Overviews or AI Mode</td><td>Clicks, CTR, position, queries, Search Labs</td></tr><tr><td>Bing Webmaster Tools AI Performance</td><td>One citation, tied to a grounding query</td><td>Any Google surface; sessions; whether anyone read it</td></tr><tr><td>GA4 AI Assistant channel</td><td>One session, medium exactly matching <code>ai-assistant</code></td><td>AI Overviews and AI Mode, routed to Organic Search; crawlers that do not run JavaScript</td></tr></tbody></table><p>Never add server log requests, Search Console impressions, Bing citations, and GA4 sessions together. If your dashboard sums them, it is wrong, and the error is not a rounding error. One AI answer can produce a server log line (the fetch), a Search Console impression (the display), a Bing citation (the attribution), and zero GA4 sessions because nobody clicked. It can equally produce a GA4 session with none of the other three, because someone pasted your URL into a chat window days later. The intersections are overlapping and unmeasurable, so summing them double-counts an unknown amount and invents the rest.</p><h2>What about third-party AI visibility tools?</h2><p>Third-party AI visibility platforms sell a fifth unit: a prompt-sampling score built by querying assistants on your behalf and counting how often you appear. None of the four systems above produces that unit, and none of them can verify it. Before I put one in a client’s stack I want the sample size, the prompt set, and the run-to-run variance. Those three answers tell me more about a tool than its score ever will. I work through the variance problem, and the protocol I would ask a vendor for, in <a href=\"https://www.amirmousavi.com/articles/can-you-trust-ai-visibility-scores\">can you trust AI visibility scores</a>.</p><h2>How to set up a defensible baseline this quarter</h2><p>Write down which system answers which question before you build the dashboard. Not after. This is where it goes wrong in exactly the way described in <a href=\"https://www.amirmousavi.com/articles/why-analytics-implementations-fail\">why analytics implementations fail</a>: instrument first, define later, then discover the metrics disagree and argue about which one is lying.</p><ol>\n<li><strong>Turn on server log retention.</strong> Keep at least ninety days. Classify requests by the user agents each vendor documents, and recheck those pages quarterly, because the user-agent tokens change. Log evidence is the only defense against a &quot;we blocked them&quot; claim that was never true.</li>\n<li><strong>Connect the two vendor reports.</strong> Pull in the Search Console generative AI report and Bing’s AI Performance report, and store the exports separately. Never in the same table or on the same chart axis. Put the unit, impressions or citations, in the column header.</li>\n<li><strong>Annotate the GA4 channel.</strong> Make its definition travel with it: &quot;AI Assistant (referrals only: excludes Google AI Overviews and AI Mode).&quot; Then state openly that Google’s AI sessions live in Organic Search. My <a href=\"https://www.amirmousavi.com/resources/analytics-implementation-checklist\">analytics implementation checklist</a> covers agreeing definitions and naming an owner before launch.</li>\n<li><strong>Take a position on Google’s Search generative AI control.</strong> Google’s Help documentation states that for sites using it, &quot;You won’t receive any traffic or impressions from these features,&quot; and that it &quot;isn’t used as a ranking or inclusion signal affecting other parts of Search.&quot;</li>\n</ol><p>You will finish with four numbers and no total. I know that is a worse-looking slide than a single AI traffic percentage. It is also the only one you can defend when somebody asks where the number came from. If AI also produces the content you are measuring, the governance argument in <a href=\"https://www.amirmousavi.com/articles/ai-agents-for-seo-content\">AI agents for SEO content</a> applies here too.</p><h2>My working take</h2><p>If I could fix one thing this quarter, it would not be a dashboard. It would be log retention, because logs are the only layer nobody else can redefine on me. Google can change what the generative AI report contains. Microsoft can change what counts as a citation. Google wrote the GA4 channel definition and can rewrite it. Nobody edits my access logs.</p><p>Everything after that follows from one decision: report the four numbers and refuse to produce a fifth that combines them. I know that is the unpopular answer. A single AI traffic percentage is easy to present and impossible to defend, and the four-number version is the exact opposite on both counts.</p><p>The part I am least comfortable with is GA4, and it is a naming problem rather than a data problem. A channel called AI Assistant that excludes Google’s own AI will be misread by almost everyone who sees it, and the misreading is reasonable. Until the name changes, an annotation is carrying weight the name should be carrying.</p><p>And when someone asks what share of their traffic comes from AI search, my honest answer right now is that nobody can tell them. Not Google, not Microsoft, not a visibility vendor. I would rather say that in the first minute of the meeting than hand over a confident number that quietly means something narrower.</p><h2>Frequently asked questions about measuring AI search traffic</h2><h3>Does GA4 track AI Overviews traffic?</h3><p>Not under that label. Google’s default channel group documentation states that the AI Assistant channel &quot;excludes Google’s AI Overviews and AI Mode,&quot; and that Organic Search includes them. Once those sessions land in Organic Search, no dimension separates them again.</p><h3>Can I see clicks from AI Overviews in Search Console?</h3><p>No. The generative AI performance report gives impressions only, and Google’s AI features documentation states that AI feature traffic is &quot;included in the overall search traffic in Search Console&quot; — inside your Web totals, and not separable from them.</p><h3>Why do my AI traffic numbers never match across tools?</h3><p>They are counting different events: HTTP requests, impressions, citations, sessions. Report each separately.</p><h3>Does blocking AI crawlers in robots.txt actually work?</h3><p>Partially, and it depends entirely on the vendor. OpenAI documents that for user-initiated fetches, &quot;Because these actions are initiated by a user, robots.txt rules may not apply.&quot; Meta documents that Meta-ExternalFetcher &quot;may bypass robots.txt.&quot; Anthropic’s April 7, 2026 documentation offers no such exemption. Your logs are the only place you will find out which of those commitments held on your site. And robots.txt is only the first of three layers that decide the question: the CDN or edge is the one that actually enforces an answer, which is <a href=\"https://www.amirmousavi.com/articles/three-layers-ai-crawler-access\">where I audited my own</a>.</p><h3>Which AI measurement system should I start with?</h3><p>Server logs. They are the only layer that shows crawler behavior, and the only one nobody else can revoke or redefine. Search Console and Bing Webmaster Tools come next, both free and vendor-authoritative for their own surface. Treat GA4&#x27;s AI Assistant channel as what it is: a referral-traffic report with a narrow scope.</p><h2>Sources I used</h2><p>Verified at source: July 29, 2026. Default channel group page re-checked October 10, 2026.</p><ul>\n<li><a href=\"https://support.google.com/analytics/answer/9756891\">Google Analytics: Default channel group definitions</a></li>\n<li><a href=\"https://support.google.com/webmasters/answer/16984139\">Search Console: Generative AI performance report</a></li>\n<li><a href=\"https://support.google.com/webmasters/answer/16908024\">Search Console: Search generative AI control</a></li>\n<li><a href=\"https://developers.google.com/search/blog/2026/06/gen-ai-performance-reports\">Google Search Central: Introducing Search Generative AI performance reports in Search Console, June 3, 2026</a></li>\n<li><a href=\"https://developers.google.com/search/docs/appearance/ai-features\">Google Search Central: AI features and your website</a></li>\n<li><a href=\"https://developers.google.com/crawling/docs/crawlers-fetchers/google-common-crawlers\">Google Search Central: Google common crawlers</a></li>\n<li><a href=\"https://blogs.bing.com/webmaster/February-2026/Introducing-AI-Performance-in-Bing-Webmaster-Tools-Public-Preview\">Bing: AI Performance in Bing Webmaster Tools, February 10, 2026</a></li>\n<li><a href=\"https://blogs.bing.com/search/June-2026/New-AI-Visibility-Insights-in-Bing-Webmaster-Tools-Intents-Topics-Citation-Share-Compare\">Bing: New AI Visibility Insights, June 16, 2026</a></li>\n<li><a href=\"https://developers.openai.com/api/docs/bots\">OpenAI: Bots and crawlers</a></li>\n<li><a href=\"https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler\">Anthropic: Does Anthropic crawl data from the web?</a></li>\n<li><a href=\"https://developers.facebook.com/documentation/sharing/webmasters/web-crawlers\">Meta: Web crawlers</a></li>\n</ul><p>One sourcing note. I left out widely circulated AI-search statistics such as crawl-to-referral ratios and AI Overviews query-coverage percentages, because I could not reach their primary sources.</p>\n",
            "url": "https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic",
            "title": "How to Measure AI Search Traffic: Four Systems, Four Blind Spots",
            "summary": "Server logs, Search Console, Bing Webmaster Tools, and GA4 each measure AI search differently. Four units, four blind spots, and why they never add up.",
            "date_modified": "2026-07-29T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "AI search",
                "GA4",
                "Search Console",
                "Bing Webmaster Tools",
                "server logs",
                "measurement"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/ai-news-june-25-2026-chips-distillation-agents",
            "content_html": "<p>The most interesting AI news today is not a new model release. It is the stack around the models getting more serious: custom chips, model-security disputes, and agents moving into everyday tools.</p><p>That is why this briefing caught my attention. As someone who spends a lot of time thinking about MarTech, analytics, automation, and SEO systems, I feel like this is the part of AI that will matter most for real teams: not only what a model can say, but where it runs, how it is protected, and how it gets embedded into work.</p><p>This is a dated snapshot, written on June 25, 2026 and deliberately left as written. I have not gone back and adjusted the analysis to match what happened afterward, because a briefing that quietly revises itself is not a briefing. What I have added is a short section near the end listing which of these threads I have since followed up on, and where.</p><h2>Quick answer</h2><p>On June 25, 2026, the AI story I am watching is the move from model demos to operating systems for AI work. OpenAI and Broadcom announced Jalapeño, a custom LLM inference chip. Anthropic accused Alibaba-linked operators of a large-scale distillation campaign against Claude. Anthropic also launched Claude Tag for Slack, a persistent AI teammate that can be mentioned in channels and work with team context.</p><p>My short take: AI advantage is shifting from &quot;who has the newest model?&quot; to &quot;who controls the infrastructure, secures the model, and places agents inside real workflows?&quot;</p><h2>1. OpenAI’s Jalapeño shows inference costs are now strategic</h2><p>OpenAI and Broadcom announced <a href=\"https://openai.com/index/openai-broadcom-jalapeno-inference-chip/\">Jalapeño, OpenAI’s first Intelligence Processor</a>, built specifically for large language model inference. OpenAI says engineering samples are already running machine-learning workloads in the lab, including GPT-5.3-Codex-Spark, and that the platform is targeted for initial deployment by the end of 2026.</p><p>The important part for me is not the chip name, although I admit it is memorable. The important part is that OpenAI is trying to own more of the physical layer behind ChatGPT, Codex, the API, and future agentic products. The company says the chip was designed around LLM kernels, memory movement, networking, serving systems, and product needs rather than being a general-purpose accelerator adapted after the fact.</p><p>I would still be careful with any exact cost-saving claim until OpenAI publishes the technical report it says is coming. But the direction is clear: inference economics are becoming product strategy.</p><p>For builders, this matters because lower latency and lower unit cost can change what is practical. A coding agent that can take more steps, a customer-support assistant that can reason over longer histories, or a real-time personalization workflow on a website all depend on the cost and availability of inference.</p><p>It also reinforces a broader hardware race. <a href=\"https://www.reuters.com/world/asia-pacific/openai-unveils-custom-chip-it-designed-with-broadcom-boost-its-ai-infrastructure-2026-06-24/\">Reuters reported on the OpenAI-Broadcom custom chip announcement</a> as part of OpenAI’s push to expand infrastructure and reduce dependency on existing accelerator supply chains. I read that as a reminder that AI roadmaps are no longer only software roadmaps.</p><h2>2. The Anthropic-Alibaba allegation makes model security feel concrete</h2><p>The second story is more uncomfortable. According to <a href=\"https://www.wsj.com/tech/ai/anthropic-claims-alibaba-ran-brazen-campaign-to-access-its-claude-ai-model-69d7a392\">The Wall Street Journal’s report on Anthropic’s letter</a>, Anthropic accused Alibaba of running what it described as the largest known distillation attack against Claude. The reported allegation was nearly 25,000 fake accounts and about 29 million exchanges with Claude, focused on capabilities such as software engineering, agentic reasoning, and long-horizon tasks.</p><p>To be precise, this is an allegation reported from a letter. I would not write it as a court finding. But even at the allegation stage, the issue is serious.</p><p>Distillation means using the outputs of a stronger model to train or improve another model. In normal machine learning, distillation can be a legitimate technique. In this context, the concern is unauthorized extraction: using API access, fake accounts, or scripted querying to copy valuable behavior from a frontier model.</p><p>This is where I feel the industry is entering a harder phase. Public APIs are necessary for adoption, but they also expose powerful systems to abuse. The more agentic and commercially valuable a model becomes, the more incentive there is to reverse-engineer, imitate, or harvest its behavior.</p><p>The policy context matters too. The White House’s June 2, 2026 executive order on <a href=\"https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/\">advanced AI innovation and security</a> calls for a voluntary frontier-model framework and an AI cybersecurity clearinghouse. When I connect that with the Anthropic story, I see model security becoming a board-level and government-level topic, not just an abuse-monitoring issue inside a product team.</p><h2>3. Claude Tag is another step toward agents inside work</h2><p>The third story feels more practical for most teams. Anthropic launched Claude Tag for Slack, a Slack-native AI teammate that can be mentioned in channels, follow context, break down work, and respond inside team threads. <a href=\"https://www.itpro.com/software/meet-claude-tag-anthropics-new-ai-teammate-that-works-in-slack\">ITPro summarized the launch</a> as a shift from a simple Slack chatbot to a more persistent teammate with scoped channel memory, permissions, and administrative controls.</p><p>This is the agent pattern becoming more normal: the AI is not waiting in a separate chat window. It is sitting where decisions, handoffs, questions, and project context already live.</p><p>I have mixed feelings here. I am excited because this can reduce coordination drag. I also feel cautious because team chat contains messy, sensitive, and incomplete information. If an AI teammate can see channels, remember context, and connect to tools, then access control, retention, auditability, and data boundaries need to be designed from the beginning.</p><p>For teams experimenting with AI agents, the lesson is similar to what I wrote in <a href=\"https://www.amirmousavi.com/articles/ai-agents-for-seo-content\">AI agents for SEO content</a>: agents are most useful when the task is structured, reversible, and easy to check. They become risky when people skip ownership, permissions, and review.</p><h2>What this means for builders and MarTech teams</h2><p>Here is how I would translate today’s news into practical decisions.</p><p>First, do not evaluate AI products only by model names. Ask about latency, cost, uptime, data controls, and integration surfaces. Infrastructure is now part of the product.</p><p>Second, treat model access like a security boundary. If your team exposes internal data to an AI system, or exposes your own AI workflow to users, you need logging, rate limits, permissioning, and abuse detection. The Anthropic-Alibaba story is about frontier labs, but the pattern applies to smaller systems too.</p><p>Third, pilot agents inside one workflow before spreading them everywhere. A Slack agent that helps triage support tickets, summarize implementation blockers, or follow up on analytics QA can be useful. A loosely configured agent across every channel can create noise and governance risk.</p><p>Fourth, keep humans accountable for decisions. I like AI for summarizing, checking, routing, and drafting. I do not like pretending that an AI agent owns the business outcome. A person still needs to own the workflow, the data, and the final decision.</p><h2>My working take</h2><p>If I had to summarize June 25, 2026 in one line, I would say this:</p><p>AI is moving from model competition to system competition.</p><p>The winners will not only have strong models. They will have efficient inference, protected intellectual property, trusted deployment patterns, and agents that fit naturally into how people work.</p><p>That is why this news feels bigger than a normal product-update cycle to me. OpenAI’s Jalapeño points to infrastructure control. Anthropic’s allegation points to model security and geopolitical pressure. Claude Tag points to AI becoming part of everyday operations.</p><p>For my own work, the conclusion is simple: I want to design AI systems the same way I would design a durable MarTech stack. Start with the business process, the data flow, the owners, the risks, and the measurement plan. Then choose the model and tools.</p><p>The excitement is real. So is the operational work.</p><h2>What I have followed up on since</h2><p>Two of the threads in this briefing turned into their own pieces, and one of them changed my mind.</p><p>The agent thread held up. What I wrote here about agents being most useful when the task is structured, reversible and easy to check is the same rule I still apply, now written out as a workflow in <a href=\"https://www.amirmousavi.com/articles/ai-agents-for-seo-content\">AI agents for SEO content</a>.</p><p>The measurement thread did not hold up as neatly. I was treating AI visibility as something you could observe if you instrumented it properly. Reading the 2023–2026 research since has made me considerably less confident about the numbers the commercial tooling reports, and the practical version — measuring from first-party systems instead — is in <a href=\"https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic\">how to measure AI search traffic</a>.</p><p>The chip and model-security threads I have not followed up on, because I have nothing to add that the primary reporting does not already say better.</p><h2>Frequently asked questions about the June 25, 2026 AI news</h2><h3>What happened in AI news on June 25, 2026?</h3><p>The main AI news was about infrastructure, security, and agents. OpenAI and Broadcom announced the Jalapeño inference chip, Anthropic accused Alibaba-linked operators of a large-scale Claude distillation campaign, and Anthropic launched Claude Tag for Slack.</p><h3>Why does OpenAI’s Jalapeño chip matter?</h3><p>Jalapeño matters because inference cost and latency shape what AI products can do at scale. If custom chips make LLM serving cheaper and more reliable, developers may eventually be able to build more agentic, real-time, and high-volume AI workflows.</p><h3>What is an AI model distillation attack?</h3><p>An AI model distillation attack is an attempt to extract useful behavior from a powerful model by querying it at scale and using its outputs to train or improve another model. Distillation can be legitimate when authorized. The concern here is unauthorized extraction through fake accounts, scripted access, or terms-of-service violations.</p><h3>Why does Claude Tag matter for enterprise teams?</h3><p>Claude Tag matters because it moves AI from a separate chat interface into Slack, where work already happens. That can make agents more useful, but it also raises governance questions about permissions, memory, private data, and audit trails.</p><h3>What should teams do next?</h3><p>Teams should map one specific AI workflow, define the data the agent can access, assign a human owner, set measurable success criteria, and review security controls before expanding. I would rather see one well-governed AI workflow than ten vague pilots.</p><h2>Sources I used</h2><p>Verified at source: June 25, 2026, the day this was published. Consistent with treating the piece as a snapshot, I have not rechecked these links since, and the Anthropic-Alibaba item remains an allegation reported from a letter rather than a finding.</p><ul>\n<li><a href=\"https://openai.com/index/openai-broadcom-jalapeno-inference-chip/\">OpenAI: OpenAI and Broadcom unveil LLM-optimized inference chip</a></li>\n<li><a href=\"https://www.reuters.com/world/asia-pacific/openai-unveils-custom-chip-it-designed-with-broadcom-boost-its-ai-infrastructure-2026-06-24/\">Reuters: OpenAI unveils custom chip designed with Broadcom</a></li>\n<li><a href=\"https://www.wsj.com/tech/ai/anthropic-claims-alibaba-ran-brazen-campaign-to-access-its-claude-ai-model-69d7a392\">The Wall Street Journal: Anthropic claims Alibaba ran campaign to access Claude</a></li>\n<li><a href=\"https://www.businessinsider.com/anthropic-china-alibaba-exploiting-ai-models-distillation-attack-2026-6\">Business Insider: Anthropic accuses Alibaba of exploiting Claude models</a></li>\n<li><a href=\"https://www.itpro.com/software/meet-claude-tag-anthropics-new-ai-teammate-that-works-in-slack\">ITPro: Meet Claude Tag, Anthropic’s new AI teammate that works in Slack</a></li>\n<li><a href=\"https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/\">The White House: Promoting Advanced Artificial Intelligence Innovation and Security</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/ai-news-june-25-2026-chips-distillation-agents",
            "title": "AI News June 25, 2026: Chips, Distillation, and Agents",
            "summary": "My take on the June 25, 2026 AI news: OpenAI and Broadcom’s Jalapeno chip, Anthropic’s Alibaba distillation allegations, and Claude Tag in Slack.",
            "date_modified": "2026-06-25T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "AI news",
                "AI infrastructure",
                "AI agents",
                "model security",
                "OpenAI",
                "Anthropic"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack",
            "content_html": "<p>Nearly every stack rationalization I have been asked to run started with a renewal date. Somebody notices a large invoice, asks whether the platform is actually being used, and discovers that nobody in the building can answer the question. That is a poor moment to begin planning, and it is the moment most planning begins.</p><p>Planning a MarTech stack means designing the capabilities, data flows, responsibilities, controls, and measures that marketing needs <strong>before</strong> comparing products. The objective is not to collect the fewest tools or the most features. It is to build the smallest coherent system the organization can operate, govern, and change while producing measurable customer and business outcomes.</p><p>This guide is for marketing leaders, marketing operations teams, technology and data partners, procurement teams, and business owners preparing for a material platform decision or stack rationalization. It is considerably longer than anything else I publish, because the decision it covers is expensive, slow to reverse, and usually made once.</p><h2>Quick answer</h2><p>Decide in this order: business outcomes, use cases written as operating contracts, an audit of the capabilities you already own, data architecture and systems of record, then vendors — and price last. Most stacks I audit are failing at the third or fourth step rather than at vendor selection, which is why replacing a tool so rarely fixes the problem the tool was blamed for. Before signing anything, three things need names attached to them: who owns each system of record, who administers the platform after launch, and how you would leave. Everything below is the long version of that paragraph, in five phases.</p><aside class=\"not-prose my-8 rounded-2xl border border-teal-600/20 bg-teal-50/70 p-5 text-sm leading-6 text-teal-950 dark:border-teal-400/20 dark:bg-teal-400/10 dark:text-teal-100\"><p class=\"font-semibold\">Publication and evidence note</p><p class=\"mt-2 text-teal-900/80 dark:text-teal-100/75\">Originally published May 14, 2026. Substantially expanded and fact-checked June 29, 2026. Vendor capabilities, regulations, and market conditions can change; verify them before procurement.</p></aside><aside class=\"not-prose my-10 flex flex-col gap-4 rounded-2xl border border-teal-600/20 bg-teal-50/70 p-5 dark:border-teal-400/20 dark:bg-teal-400/10 sm:flex-row sm:items-center sm:justify-between sm:p-6\"><div><p class=\"font-semibold text-teal-950 dark:text-teal-100\"><p>Get your personalized MarTech planning path</p></p><p class=\"mt-1 text-sm leading-6 text-teal-900/75 dark:text-teal-100/70\"><p>Take the five-minute assessment to identify your next planning phase and\nhighest-priority actions.</p></p></div><a class=\"inline-flex shrink-0 items-center justify-center rounded-lg bg-teal-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-teal-700\" href=\"https://www.amirmousavi.com/resources/martech-stack-assessment\"><p>Take the assessment</p></a></aside><nav aria-label=\"In this guide\" class=\"not-prose my-10 rounded-2xl bg-zinc-50 p-5 ring-1 ring-zinc-200 dark:bg-zinc-800/40 dark:ring-zinc-700/60 sm:p-6\"><p class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">In this guide</p><ol class=\"mt-4 grid gap-x-8 gap-y-3 sm:grid-cols-2\"><li><a href=\"#why-plan\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">01</span><span>Why planning comes first</span></a></li><li><a href=\"#framework\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">02</span><span>The five-phase framework</span></a></li><li><a href=\"#align\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">03</span><span>1. Align outcomes and use cases</span></a></li><li><a href=\"#audit\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">04</span><span>2. Audit tools and capabilities</span></a></li><li><a href=\"#architect\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">05</span><span>3. Architect data and ownership</span></a></li><li><a href=\"#select\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">06</span><span>4. Select with evidence</span></a></li><li><a href=\"#operate\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">07</span><span>5. Operate and measure</span></a></li><li><a href=\"#checklist\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">08</span><span>Procurement-readiness checklist</span></a></li><li><a href=\"#faq\" class=\"group flex items-baseline gap-3 text-sm text-zinc-600 transition hover:text-teal-600 dark:text-zinc-400 dark:hover:text-teal-400\"><span class=\"text-xs font-semibold tabular-nums text-zinc-400 group-hover:text-teal-500 dark:text-zinc-500\">09</span><span>Frequently asked questions</span></a></li></ol></nav><h2 id=\"why-plan\">Why MarTech planning must come before purchasing</h2><p>The available technology is vast, but availability is not the same as value. Chiefmartec catalogued <strong>15,505 MarTech products in 2026</strong>. Gartner reports average capability utilization of <strong>49%</strong> in its 2025 MarTech survey. McKinsey found that <strong>47% of surveyed MarTech decision-makers</strong> identified stack complexity or integration challenges as obstacles to value.</p><p>These figures use different samples and methods, so they should not be combined into a universal benchmark. They point to the same operational problem: many organizations can acquire technology faster than they can integrate, adopt, govern, and measure it.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 sm:-mx-4 lg:-mx-12\"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">Evidence snapshot</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Three current signals explain why tool-first buying is a weak default.</p></div><div class=\"grid divide-y divide-zinc-200 dark:divide-zinc-700/60 sm:grid-cols-3 sm:divide-x sm:divide-y-0\"><div class=\"p-5 sm:p-6\"><p class=\"text-3xl font-bold tracking-tight text-teal-600 dark:text-teal-400\">15,505</p><p class=\"mt-2 text-sm font-medium leading-5 text-zinc-800 dark:text-zinc-200\">MarTech products catalogued in 2026</p><a href=\"https://chiefmartec.com/2026/05/2026-marketing-technology-landscape-supergraphic-peak-martech-achieved-maybe/\" class=\"mt-4 inline-block text-xs font-medium text-zinc-500 underline decoration-zinc-300 underline-offset-4 hover:text-teal-600 dark:text-zinc-500 dark:decoration-zinc-700 dark:hover:text-teal-400\">Chiefmartec, 2026</a></div><div class=\"p-5 sm:p-6\"><p class=\"text-3xl font-bold tracking-tight text-teal-600 dark:text-teal-400\">49%</p><p class=\"mt-2 text-sm font-medium leading-5 text-zinc-800 dark:text-zinc-200\">Average capability utilization reported in 2025</p><a href=\"https://www.gartner.com/en/marketing/topics/marketing-technology\" class=\"mt-4 inline-block text-xs font-medium text-zinc-500 underline decoration-zinc-300 underline-offset-4 hover:text-teal-600 dark:text-zinc-500 dark:decoration-zinc-700 dark:hover:text-teal-400\">Gartner, 2025</a></div><div class=\"p-5 sm:p-6\"><p class=\"text-3xl font-bold tracking-tight text-teal-600 dark:text-teal-400\">47%</p><p class=\"mt-2 text-sm font-medium leading-5 text-zinc-800 dark:text-zinc-200\">Cited complexity or integration as a value blocker</p><a href=\"https://www.mckinsey.com/capabilities/growth-marketing-and-sales/our-insights/rewiring-martech-from-cost-center-to-growth-engine\" class=\"mt-4 inline-block text-xs font-medium text-zinc-500 underline decoration-zinc-300 underline-offset-4 hover:text-teal-600 dark:text-zinc-500 dark:decoration-zinc-700 dark:hover:text-teal-400\">McKinsey, 2025</a></div></div></div><p>Buying without a plan usually creates several forms of debt at once:</p><ul>\n<li><strong>Capability debt:</strong> overlapping products exist, but important workflows remain incomplete.</li>\n<li><strong>Integration debt:</strong> every new endpoint creates mappings, credentials, monitoring, and failure paths.</li>\n<li><strong>Data debt:</strong> identifiers, lifecycle stages, events, and consent states mean different things in different systems.</li>\n<li><strong>Operating debt:</strong> no team owns administration, documentation, quality, enablement, or renewal decisions.</li>\n<li><strong>Financial debt:</strong> subscription price hides implementation, integration, labor, support, migration, and exit costs.</li>\n<li><strong>Experience debt:</strong> disconnected systems produce mistimed, repetitive, or contradictory customer interactions.</li>\n</ul><p>Several of these surface as vocabulary problems before they surface as technical ones — the same word meaning different things to different teams in the same meeting. The <a href=\"https://www.amirmousavi.com/resources/martech-glossary\">MarTech glossary</a> defines the terms this guide uses.</p><h3>A stack is an operating system, not a shopping list</h3><p>“Marketing operating system” is a useful metaphor, not a formal technical standard. It emphasizes that value comes from the interaction of strategy, data, technology, process, and people. McKinsey similarly argues that MarTech must become an integrated operating model rather than a patchwork of disconnected platforms.</p><p>A healthy stack translates a business objective into a decision, obtains trustworthy and permissioned data, activates an action, observes the result, and feeds the learning back into the next decision. The products are replaceable components inside that system.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 \"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">Do you actually need another tool?</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">A “no” at any gate means the next investment should be in clarity, process, data, or ownership—not software.</p></div><ol class=\"divide-y divide-zinc-200 dark:divide-zinc-700/60\"><li class=\"p-5 sm:p-6\"><div class=\"flex gap-4\"><span class=\"flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-teal-50 text-xs font-semibold text-teal-700 ring-1 ring-teal-600/20 dark:bg-teal-400/10 dark:text-teal-300 dark:ring-teal-400/20\">1</span><div class=\"min-w-0 flex-1\"><p class=\"font-semibold text-zinc-900 dark:text-zinc-100\">Is the business problem measurable?</p><div class=\"mt-4 grid gap-3 sm:grid-cols-2\"><p class=\"rounded-xl bg-zinc-50 p-3 text-sm leading-6 text-zinc-600 dark:bg-zinc-800/60 dark:text-zinc-400\"><span class=\"block text-xs font-semibold uppercase tracking-wide text-zinc-800 dark:text-zinc-200\">If yes</span>Define the baseline and target outcome.</p><p class=\"rounded-xl bg-amber-50 p-3 text-sm leading-6 text-amber-900 dark:bg-amber-400/10 dark:text-amber-200\"><span class=\"block text-xs font-semibold uppercase tracking-wide text-amber-800 dark:text-amber-300\">If no</span>Stop and clarify the decision or customer behavior that must change.</p></div></div></div></li><li class=\"p-5 sm:p-6\"><div class=\"flex gap-4\"><span class=\"flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-teal-50 text-xs font-semibold text-teal-700 ring-1 ring-teal-600/20 dark:bg-teal-400/10 dark:text-teal-300 dark:ring-teal-400/20\">2</span><div class=\"min-w-0 flex-1\"><p class=\"font-semibold text-zinc-900 dark:text-zinc-100\">Can an existing licensed capability support it?</p><div class=\"mt-4 grid gap-3 sm:grid-cols-2\"><p class=\"rounded-xl bg-zinc-50 p-3 text-sm leading-6 text-zinc-600 dark:bg-zinc-800/60 dark:text-zinc-400\"><span class=\"block text-xs font-semibold uppercase tracking-wide text-zinc-800 dark:text-zinc-200\">If yes</span>Test configuration, adoption, training, and process fixes first.</p><p class=\"rounded-xl bg-amber-50 p-3 text-sm leading-6 text-amber-900 dark:bg-amber-400/10 dark:text-amber-200\"><span class=\"block text-xs font-semibold uppercase tracking-wide text-amber-800 dark:text-amber-300\">If no</span>Document the capability gap.</p></div></div></div></li><li class=\"p-5 sm:p-6\"><div class=\"flex gap-4\"><span class=\"flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-teal-50 text-xs font-semibold text-teal-700 ring-1 ring-teal-600/20 dark:bg-teal-400/10 dark:text-teal-300 dark:ring-teal-400/20\">3</span><div class=\"min-w-0 flex-1\"><p class=\"font-semibold text-zinc-900 dark:text-zinc-100\">Are the required data and integrations ready?</p><div class=\"mt-4 grid gap-3 sm:grid-cols-2\"><p class=\"rounded-xl bg-zinc-50 p-3 text-sm leading-6 text-zinc-600 dark:bg-zinc-800/60 dark:text-zinc-400\"><span class=\"block text-xs font-semibold uppercase tracking-wide text-zinc-800 dark:text-zinc-200\">If yes</span>Validate identity, consent, latency, and quality assumptions.</p><p class=\"rounded-xl bg-amber-50 p-3 text-sm leading-6 text-amber-900 dark:bg-amber-400/10 dark:text-amber-200\"><span class=\"block text-xs font-semibold uppercase tracking-wide text-amber-800 dark:text-amber-300\">If no</span>Repair the foundation before adding another destination.</p></div></div></div></li><li class=\"p-5 sm:p-6\"><div class=\"flex gap-4\"><span class=\"flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-teal-50 text-xs font-semibold text-teal-700 ring-1 ring-teal-600/20 dark:bg-teal-400/10 dark:text-teal-300 dark:ring-teal-400/20\">4</span><div class=\"min-w-0 flex-1\"><p class=\"font-semibold text-zinc-900 dark:text-zinc-100\">Is there an owner, budget, and success measure?</p><div class=\"mt-4 grid gap-3 sm:grid-cols-2\"><p class=\"rounded-xl bg-zinc-50 p-3 text-sm leading-6 text-zinc-600 dark:bg-zinc-800/60 dark:text-zinc-400\"><span class=\"block text-xs font-semibold uppercase tracking-wide text-zinc-800 dark:text-zinc-200\">If yes</span>Move into structured evaluation.</p><p class=\"rounded-xl bg-amber-50 p-3 text-sm leading-6 text-amber-900 dark:bg-amber-400/10 dark:text-amber-200\"><span class=\"block text-xs font-semibold uppercase tracking-wide text-amber-800 dark:text-amber-300\">If no</span>Establish operating readiness before procurement.</p></div></div></div></li></ol></div><h2 id=\"framework\">The five-phase tool-last planning framework</h2><p>The framework below consolidates the planning work into five phases. It is sequential, but not strictly linear: evidence discovered during an audit may change the use cases, and a proof of value may expose a data or operating-model gap. What matters is that tool selection does not outrun the work that makes a tool useful.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 sm:-mx-4 lg:-mx-12\"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">The tool-last planning sequence</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">A vendor shortlist appears only after the organization understands the outcome, gap, architecture, and operating requirements.</p></div><ol class=\"grid gap-px bg-zinc-200 dark:bg-zinc-700/60 sm:grid-cols-5\"><li class=\"bg-white p-5 dark:bg-zinc-900\"><span class=\"text-xs font-semibold tracking-widest text-teal-600 dark:text-teal-400\">01</span><h4 class=\"mt-2 text-base font-semibold text-zinc-900 dark:text-zinc-100\">Align</h4><p class=\"mt-2 text-sm leading-5 text-zinc-600 dark:text-zinc-400\">Outcomes, journeys, decisions, use cases</p><p class=\"mt-5 border-t border-zinc-100 pt-3 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\"><span class=\"font-semibold text-zinc-700 dark:text-zinc-300\">Output:</span> Use-case portfolio</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><span class=\"text-xs font-semibold tracking-widest text-teal-600 dark:text-teal-400\">02</span><h4 class=\"mt-2 text-base font-semibold text-zinc-900 dark:text-zinc-100\">Audit</h4><p class=\"mt-2 text-sm leading-5 text-zinc-600 dark:text-zinc-400\">Tools, adoption, overlap, contracts, gaps</p><p class=\"mt-5 border-t border-zinc-100 pt-3 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\"><span class=\"font-semibold text-zinc-700 dark:text-zinc-300\">Output:</span> Current-state map</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><span class=\"text-xs font-semibold tracking-widest text-teal-600 dark:text-teal-400\">03</span><h4 class=\"mt-2 text-base font-semibold text-zinc-900 dark:text-zinc-100\">Architect</h4><p class=\"mt-2 text-sm leading-5 text-zinc-600 dark:text-zinc-400\">Data, identity, consent, integrations, owners</p><p class=\"mt-5 border-t border-zinc-100 pt-3 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\"><span class=\"font-semibold text-zinc-700 dark:text-zinc-300\">Output:</span> Target-state blueprint</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><span class=\"text-xs font-semibold tracking-widest text-teal-600 dark:text-teal-400\">04</span><h4 class=\"mt-2 text-base font-semibold text-zinc-900 dark:text-zinc-100\">Select</h4><p class=\"mt-2 text-sm leading-5 text-zinc-600 dark:text-zinc-400\">Requirements, scoring, proof, TCO, exit</p><p class=\"mt-5 border-t border-zinc-100 pt-3 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\"><span class=\"font-semibold text-zinc-700 dark:text-zinc-300\">Output:</span> Investment decision</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><span class=\"text-xs font-semibold tracking-widest text-teal-600 dark:text-teal-400\">05</span><h4 class=\"mt-2 text-base font-semibold text-zinc-900 dark:text-zinc-100\">Operate</h4><p class=\"mt-2 text-sm leading-5 text-zinc-600 dark:text-zinc-400\">Implementation, adoption, governance, value</p><p class=\"mt-5 border-t border-zinc-100 pt-3 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\"><span class=\"font-semibold text-zinc-700 dark:text-zinc-300\">Output:</span> Operating roadmap</p></li></ol></div><p>Each phase produces a decision artifact:</p><ol>\n<li><strong>Align:</strong> a prioritized portfolio of measurable use cases.</li>\n<li><strong>Audit:</strong> a verified view of tools, capabilities, adoption, contracts, integrations, and risks.</li>\n<li><strong>Architect:</strong> a target-state blueprint for data, identity, consent, integrations, and ownership.</li>\n<li><strong>Select:</strong> an evidence-backed investment decision with a proof of value and full cost model.</li>\n<li><strong>Operate:</strong> a roadmap for implementation, adoption, governance, measurement, and improvement.</li>\n</ol><h2 id=\"align\">Phase 1: align business outcomes and use cases</h2><p>Begin with a business outcome, not a product category. “We need a CDP,” “we need AI,” or “we need better personalization” describes a proposed solution or aspiration. It does not define what must improve.</p><p>A useful outcome statement contains:</p><ul>\n<li>a baseline condition;</li>\n<li>a measurable target;</li>\n<li>an affected customer or business process;</li>\n<li>a time horizon;</li>\n<li>an accountable owner;</li>\n<li>the constraints that cannot be violated.</li>\n</ul><p>Examples include reducing campaign launch time from ten business days to five, improving accepted sales opportunities from high-intent accounts, reducing preventable churn, or raising the percentage of customer records with a valid consent state.</p><h3>Map the journey around decisions and friction</h3><p>Journey mapping for stack planning is not a decorative poster. It identifies where a customer or employee decision fails because information, timing, coordination, or measurement is weak.</p><p>For each important journey moment, ask:</p><ol>\n<li>What is the customer trying to accomplish?</li>\n<li>What decision must the organization make?</li>\n<li>What data is needed and when?</li>\n<li>What action should follow?</li>\n<li>Which team owns the outcome?</li>\n<li>What evidence will show that the experience improved?</li>\n</ol><p>This prevents a common category error: buying a messaging platform when the actual constraint is missing lifecycle definitions, unreliable product data, weak approval processes, or a sales handoff that nobody owns.</p><h3>Write use cases as operating contracts</h3><p>A good use case is specific enough to test. It identifies an audience, a decision, required data, an action, timing, an owner, a measurable result, and important privacy or operational constraints.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 \"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">Completed use-case canvas</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">A concrete use case is a better buying input than a broad request for “better personalization.”</p></div><dl class=\"grid gap-px bg-zinc-200 dark:bg-zinc-700/60 sm:grid-cols-2\"><div class=\"bg-white p-4 dark:bg-zinc-900 sm:p-5\"><dt class=\"text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-500\">Business outcome</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-800 dark:text-zinc-300\">Increase qualified pipeline without adding lead volume</dd></div><div class=\"bg-white p-4 dark:bg-zinc-900 sm:p-5\"><dt class=\"text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-500\">Audience</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-800 dark:text-zinc-300\">Known accounts showing high buying intent</dd></div><div class=\"bg-white p-4 dark:bg-zinc-900 sm:p-5\"><dt class=\"text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-500\">Decision</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-800 dark:text-zinc-300\">Which account should sales contact next?</dd></div><div class=\"bg-white p-4 dark:bg-zinc-900 sm:p-5\"><dt class=\"text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-500\">Required data</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-800 dark:text-zinc-300\">Account fit, recent behavior, lifecycle stage, consent</dd></div><div class=\"bg-white p-4 dark:bg-zinc-900 sm:p-5\"><dt class=\"text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-500\">Action</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-800 dark:text-zinc-300\">Create and route a prioritized CRM task</dd></div><div class=\"bg-white p-4 dark:bg-zinc-900 sm:p-5\"><dt class=\"text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-500\">Timing</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-800 dark:text-zinc-300\">Within 15 minutes of the qualifying behavior</dd></div><div class=\"bg-white p-4 dark:bg-zinc-900 sm:p-5\"><dt class=\"text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-500\">Owner</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-800 dark:text-zinc-300\">Revenue operations</dd></div><div class=\"bg-white p-4 dark:bg-zinc-900 sm:p-5\"><dt class=\"text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-500\">Success measure</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-800 dark:text-zinc-300\">Accepted opportunities per routed account</dd></div></dl></div><p>When the use case is an automated program — a welcome series, a recovery sequence, a renewal reminder — the <a href=\"https://www.amirmousavi.com/resources/marketing-automation-planning-template\">marketing automation planning template</a> turns the same contract into the six sections an automation tool needs, with every field shown completed for a real program.</p><h3>Prioritize before defining the target stack</h3><p>Do not let every stakeholder’s request become a “must-have.” Compare use cases using four dimensions:</p><ul>\n<li><strong>Impact:</strong> expected effect on revenue, cost, risk, customer experience, or employee effort.</li>\n<li><strong>Evidence:</strong> confidence based on observed behavior, research, operational data, or a tested hypothesis.</li>\n<li><strong>Effort:</strong> implementation, integration, migration, enablement, and ongoing administration.</li>\n<li><strong>Risk:</strong> privacy, security, deliverability, customer harm, dependency, and reversibility.</li>\n</ul><p>RICE—reach, impact, confidence, and effort—is useful when reach can be estimated consistently. An impact/effort workshop is faster for early alignment. Use MoSCoW later to control the scope of an approved initiative, not to decide whether every proposed initiative deserves investment.</p><p>The phase-one deliverable is a short portfolio of use cases with explicit sequencing and dependency assumptions. If everything is a priority, the stack is still being planned as a wishlist.</p><h2 id=\"audit\">Phase 2: audit tools and capabilities</h2><p>Audit what the organization can actually do, not only what appears on invoices or architecture diagrams. A licensed feature is not a working capability when the required data, process, skill, integration, or owner is absent.</p><h3>Build a usable tool inventory</h3><p>For each product, capture at least:</p><ul>\n<li>vendor, product, edition, contract term, renewal date, price, seats, and usage-based charges;</li>\n<li>business owner, technical owner, administrators, primary users, and support path;</li>\n<li>use cases and business processes supported;</li>\n<li>capabilities used, available but unused, and duplicated elsewhere;</li>\n<li>active users, workflow volume, feature adoption, and training status;</li>\n<li>data collected, created, transformed, exported, and deleted;</li>\n<li>upstream and downstream systems, sync direction, latency, and failure handling;</li>\n<li>security, privacy, access, retention, and residency considerations;</li>\n<li>known issues, manual workarounds, customizations, and migration difficulty;</li>\n<li>business value, operating cost, and credible alternatives.</li>\n</ul><p>The inventory should use data where possible: sign-in logs, workflow counts, campaign volume, connector health, support tickets, contract records, and stakeholder interviews. A product can be business-critical with few users, so logins alone are not an adoption measure. The <a href=\"https://www.amirmousavi.com/resources/martech-audit-checklist\">MarTech audit checklist and stack inventory template</a> turns this list into a step-by-step audit and a template you can download.</p><h3>Map capabilities independently of vendors</h3><p>Vendor categories overlap and change. A capability map creates a more stable view of what the business needs to accomplish.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 sm:-mx-4 lg:-mx-12\"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">Capability map by business function</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Map capabilities before products. One platform may cover several capabilities, and one capability may depend on several platforms.</p></div><div class=\"grid gap-px bg-zinc-200 dark:bg-zinc-700/60 sm:grid-cols-2 lg:grid-cols-3\"><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Reach and acquisition</h4><p class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Advertising · SEO · Social publishing · Lead capture</p><p class=\"mt-4 border-t border-zinc-100 pt-4 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\">Can demand be acquired and attributed with reliable consent signals?</p></section><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Content and experience</h4><p class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">CMS · DAM · Personalization · Experimentation</p><p class=\"mt-4 border-t border-zinc-100 pt-4 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\">Can teams create, approve, deliver, and learn without avoidable handoffs?</p></section><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Relationship and lifecycle</h4><p class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">CRM · Marketing automation · Email · Service · Loyalty</p><p class=\"mt-4 border-t border-zinc-100 pt-4 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\">Can the organization coordinate messages and actions across the lifecycle?</p></section><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Customer data and identity</h4><p class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Collection · Identity · Profiles · Consent · Activation</p><p class=\"mt-4 border-t border-zinc-100 pt-4 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\">Are records connected with explicit rules, permissions, and ownership?</p></section><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Intelligence and measurement</h4><p class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Analytics · BI · Attribution · Forecasting</p><p class=\"mt-4 border-t border-zinc-100 pt-4 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\">Can decision-makers trace metrics to governed definitions and source data?</p></section><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Operations and trust</h4><p class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Workflow · Integration · Data quality · Access · Governance</p><p class=\"mt-4 border-t border-zinc-100 pt-4 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\">Can the stack be changed safely, observed, documented, and supported?</p></section></div></div><p>For every capability, classify its state:</p><ul>\n<li><strong>Present:</strong> a licensed product claims to provide it.</li>\n<li><strong>Usable:</strong> people, process, data, and integration make it operable.</li>\n<li><strong>Adopted:</strong> intended users consistently use it correctly.</li>\n<li><strong>Effective:</strong> it improves an agreed outcome.</li>\n<li><strong>Governed:</strong> ownership, access, standards, quality, risk, and change are controlled.</li>\n</ul><p>This distinction exposes “paper capabilities”—features that exist contractually but cannot produce value in the current environment.</p><h3>Find overlap without assuming consolidation is always better</h3><p>Look for duplicate email senders, form builders, audience tools, landing-page systems, content libraries, journey engines, identity stores, reporting layers, experimentation tools, and AI assistants. Then examine why the overlap exists.</p><p>Consolidation is valuable when it removes cost and coordination without weakening an important capability. It is harmful when it forces specialized work into a broad platform that users cannot operate effectively. The decision must include migration risk, data portability, contract timing, and the value of local autonomy.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 \"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">Choose an action for every tool</h3></div><dl class=\"grid gap-px bg-zinc-200 dark:bg-zinc-700/60 sm:grid-cols-2\"><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-teal-700 dark:text-teal-400\">Keep</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Distinct value, healthy adoption, clear owner, acceptable cost</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-teal-700 dark:text-teal-400\">Optimize</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Right tool, but configuration, training, data, or process is weak</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-teal-700 dark:text-teal-400\">Consolidate</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Another platform can cover the capability without unacceptable loss</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-teal-700 dark:text-teal-400\">Replace</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Capability is essential, but the product no longer fits</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-teal-700 dark:text-teal-400\">Retire</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Low value, low use, redundant, risky, or ownerless</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-teal-700 dark:text-teal-400\">Repair process first</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">The tool is not the primary constraint</dd></div></dl></div><p>The audit deliverable is a current-state map plus an action for every tool. It should clearly distinguish technical replacement from configuration, adoption, data, or process remediation.</p><h2 id=\"architect\">Phase 3: architect data, integrations, and ownership</h2><p>A MarTech stack works when the right data reaches the right decision or action, at the required time, under the correct permission, with observable quality. A connector logo proves almost none of that.</p><p>For each material data flow, document:</p><ol>\n<li>source and purpose;</li>\n<li>fields or events involved;</li>\n<li>customer, account, device, campaign, or product identifiers;</li>\n<li>consent state or other applicable authority;</li>\n<li>validation, transformation, and matching rules;</li>\n<li>authoritative system and downstream copies;</li>\n<li>transfer method and required latency;</li>\n<li>retention, correction, deletion, and portability behavior;</li>\n<li>monitoring, retry, reconciliation, and incident ownership.</li>\n</ol><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 sm:-mx-4 lg:-mx-12\"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">A plain-language customer data flow</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">The useful question is not “what integrates?” but “what data moves, under which permission, how quickly, and who responds when it fails?”</p></div><ol class=\"grid gap-px bg-zinc-200 dark:bg-zinc-700/60 sm:grid-cols-2 lg:grid-cols-3\"><li class=\"bg-white p-5 dark:bg-zinc-900\"><div class=\"flex items-center gap-3\"><span class=\"text-xs font-semibold text-teal-600 dark:text-teal-400\">01</span><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Sources</h4></div><p class=\"mt-3 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Website, app, CRM, commerce, service</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><div class=\"flex items-center gap-3\"><span class=\"text-xs font-semibold text-teal-600 dark:text-teal-400\">02</span><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Collection and consent</h4></div><p class=\"mt-3 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Events, forms, tags, preferences, legal basis</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><div class=\"flex items-center gap-3\"><span class=\"text-xs font-semibold text-teal-600 dark:text-teal-400\">03</span><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Identity and quality</h4></div><p class=\"mt-3 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Identifiers, validation, deduplication, matching</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><div class=\"flex items-center gap-3\"><span class=\"text-xs font-semibold text-teal-600 dark:text-teal-400\">04</span><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Authoritative records</h4></div><p class=\"mt-3 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">CRM, warehouse, CDP, commerce, consent system</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><div class=\"flex items-center gap-3\"><span class=\"text-xs font-semibold text-teal-600 dark:text-teal-400\">05</span><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Decision and activation</h4></div><p class=\"mt-3 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Segments, journeys, ads, sales and service actions</p></li><li class=\"bg-white p-5 dark:bg-zinc-900\"><div class=\"flex items-center gap-3\"><span class=\"text-xs font-semibold text-teal-600 dark:text-teal-400\">06</span><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Measurement loop</h4></div><p class=\"mt-3 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Outcomes, experiments, errors, cost and learning</p></li></ol></div><h3>Assign systems of record deliberately</h3><p>“Single source of truth” is often used too casually. Different domains usually need different authoritative systems: CRM for sales relationships, commerce for orders, a consent platform for preferences, a product system for catalog data, and a warehouse for governed historical analysis.</p><p>A CDP may collect events, resolve identities, build profiles, and activate audiences, but it should not be purchased merely because the existing data is messy. Undefined identifiers, ungoverned schemas, missing consent logic, and unclear use cases will be reproduced inside a new platform. The boundaries between a <a href=\"https://www.amirmousavi.com/articles/cdp-crm-and-marketing-automation\">CDP, CRM, and marketing automation platform</a> should be defined before a shortlist is created.</p><h3>Choose integration patterns from the operating need</h3><ul>\n<li><strong>API request:</strong> useful when a system needs a response or action on demand.</li>\n<li><strong>Webhook:</strong> useful when a system must notify another system that something changed.</li>\n<li><strong>Batch or ETL:</strong> appropriate for scheduled, high-volume movement and historical analysis.</li>\n<li><strong>Reverse ETL:</strong> moves governed warehouse models into operational tools.</li>\n<li><strong>Event streaming:</strong> supports high-volume, low-latency behavioral signals when the organization can operate it.</li>\n<li><strong>Manual file transfer:</strong> sometimes acceptable for low-frequency, controlled work, but it must be documented and protected.</li>\n</ul><p>“Real time” is not automatically better. It increases cost and operational complexity. Define the maximum acceptable delay for the use case and design to that requirement.</p><h3>Treat privacy and security as architecture inputs</h3><p>Consent is not only a banner, and privacy review is not a final procurement checkbox. The architecture needs to represent purposes, data minimization, consent or other applicable authority, access, correction, retention, deletion, and transfers to service providers.</p><p>Google’s current Consent Mode documentation explains how Google tags adjust behavior based on consent signals; it does not replace the organization’s consent solution or legal analysis. Canadian organizations should start from the <a href=\"https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/\">Office of the Privacy Commissioner of Canada</a> and the applicable provincial regulator. Security teams can use the <a href=\"https://csrc.nist.gov/pubs/sp/1300/final\">NIST Cybersecurity Framework 2.0 supply-chain guidance</a> as one input to vendor due diligence.</p><h3>Design the operating model with the architecture</h3><p>Every major capability needs a business owner, technical owner, administrators, users, support process, change path, and value-review cadence. Clarify who can create fields, events, segments, workflows, integrations, accounts, and access policies; who reviews quality and risk; and who responds when a flow fails.</p><p>The phase-three deliverable is a target-state blueprint that marketing, data, IT, privacy, security, sales, service, finance, and procurement can review together.</p><h2 id=\"select\">Phase 4: define requirements and select with evidence</h2><p>Vendor evaluation becomes useful only when requirements can be traced to prioritized use cases and architectural constraints.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 sm:-mx-4 lg:-mx-12\"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">Requirements register</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Write testable requirements from several perspectives. A long feature wishlist is not a requirements strategy.</p></div><dl class=\"grid gap-px bg-zinc-200 dark:bg-zinc-700/60 sm:grid-cols-2 lg:grid-cols-3\"><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Business</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Outcome, baseline, target, time horizon</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">User</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Role, task, frequency, skill and acceptable effort</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Functional</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Action the system must perform and under what conditions</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Data</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Fields, events, identifiers, history, quality and retention</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Integration</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Sources, destinations, direction, latency and failure handling</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Security</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">SSO, permissions, audit logs, encryption and incident process</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Privacy</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Purpose, consent, minimization, access, deletion and residency</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Reporting</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Metric definition, grain, source, owner and freshness</dd></div><div class=\"bg-white p-5 dark:bg-zinc-900\"><dt class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Commercial</dt><dd class=\"mt-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Pricing drivers, support, service levels, renewal and exit</dd></div></dl></div><p>Write requirements so they can be demonstrated or tested. “Easy to use,” “AI-powered,” “real time,” and “integrates with our CRM” are not testable. Better requirements specify the user, action, data, conditions, response time, control, and acceptance criterion.</p><p>For example:</p><blockquote>\n<p>A marketing operations user must be able to build an audience from account fit, recent web behavior, lifecycle stage, and consent state; preview the eligible count; publish it to the CRM; and receive a visible error report for rejected records within 15 minutes.</p>\n</blockquote><h3>Weight the scorecard before demonstrations</h3><p>A vendor demonstration is optimized for the vendor’s strongest path. Provide a demonstration script based on your use cases and representative constraints. Set weights before seeing products so presentation quality and novel features do not silently redefine the decision.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 sm:-mx-4 lg:-mx-12\"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">Example weighted vendor scorecard</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Set weights before demonstrations. Score only against evidence: documentation, a tested workflow, references, or contract terms.</p></div><div class=\"overflow-x-auto\"><table class=\"w-full min-w-[720px] border-collapse text-left text-sm\"><thead class=\"bg-zinc-50 dark:bg-zinc-800/60\"><tr><th scope=\"col\" class=\"border-b border-zinc-200 px-5 py-3 font-semibold text-zinc-900 dark:border-zinc-700/60 dark:text-zinc-100\">Criterion</th><th scope=\"col\" class=\"border-b border-zinc-200 px-5 py-3 font-semibold text-zinc-900 dark:border-zinc-700/60 dark:text-zinc-100\">Weight</th><th scope=\"col\" class=\"border-b border-zinc-200 px-5 py-3 font-semibold text-zinc-900 dark:border-zinc-700/60 dark:text-zinc-100\">Evidence to request</th></tr></thead><tbody class=\"divide-y divide-zinc-100 dark:divide-zinc-800\"><tr><th scope=\"row\" class=\"whitespace-nowrap px-5 py-3 font-medium text-zinc-800 dark:text-zinc-200\">Priority use-case fit</th><td class=\"px-5 py-3 font-semibold tabular-nums text-teal-700 dark:text-teal-400\">20%</td><td class=\"px-5 py-3 leading-6 text-zinc-600 dark:text-zinc-400\">Live test using your workflow and acceptance criteria</td></tr><tr><th scope=\"row\" class=\"whitespace-nowrap px-5 py-3 font-medium text-zinc-800 dark:text-zinc-200\">Data and integration fit</th><td class=\"px-5 py-3 font-semibold tabular-nums text-teal-700 dark:text-teal-400\">20%</td><td class=\"px-5 py-3 leading-6 text-zinc-600 dark:text-zinc-400\">API limits, data model, sync behavior, error handling</td></tr><tr><th scope=\"row\" class=\"whitespace-nowrap px-5 py-3 font-medium text-zinc-800 dark:text-zinc-200\">Usability and adoption</th><td class=\"px-5 py-3 font-semibold tabular-nums text-teal-700 dark:text-teal-400\">15%</td><td class=\"px-5 py-3 leading-6 text-zinc-600 dark:text-zinc-400\">Role-based tasks completed by actual users</td></tr><tr><th scope=\"row\" class=\"whitespace-nowrap px-5 py-3 font-medium text-zinc-800 dark:text-zinc-200\">Security and privacy</th><td class=\"px-5 py-3 font-semibold tabular-nums text-teal-700 dark:text-teal-400\">15%</td><td class=\"px-5 py-3 leading-6 text-zinc-600 dark:text-zinc-400\">Controls, subprocessors, retention, audit evidence</td></tr><tr><th scope=\"row\" class=\"whitespace-nowrap px-5 py-3 font-medium text-zinc-800 dark:text-zinc-200\">Implementation risk</th><td class=\"px-5 py-3 font-semibold tabular-nums text-teal-700 dark:text-teal-400\">10%</td><td class=\"px-5 py-3 leading-6 text-zinc-600 dark:text-zinc-400\">Plan, dependencies, staffing and migration proof</td></tr><tr><th scope=\"row\" class=\"whitespace-nowrap px-5 py-3 font-medium text-zinc-800 dark:text-zinc-200\">Portability and exit</th><td class=\"px-5 py-3 font-semibold tabular-nums text-teal-700 dark:text-teal-400\">10%</td><td class=\"px-5 py-3 leading-6 text-zinc-600 dark:text-zinc-400\">Export formats, limits, deletion and transition support</td></tr><tr><th scope=\"row\" class=\"whitespace-nowrap px-5 py-3 font-medium text-zinc-800 dark:text-zinc-200\">Service and vendor fit</th><td class=\"px-5 py-3 font-semibold tabular-nums text-teal-700 dark:text-teal-400\">5%</td><td class=\"px-5 py-3 leading-6 text-zinc-600 dark:text-zinc-400\">Support model, references, roadmap and escalation</td></tr><tr><th scope=\"row\" class=\"whitespace-nowrap px-5 py-3 font-medium text-zinc-800 dark:text-zinc-200\">Three-year TCO</th><td class=\"px-5 py-3 font-semibold tabular-nums text-teal-700 dark:text-teal-400\">5%</td><td class=\"px-5 py-3 leading-6 text-zinc-600 dark:text-zinc-400\">Contract plus internal and partner operating cost</td></tr></tbody></table></div></div><p>For each score, record the evidence level:</p><ul>\n<li>asserted by the vendor;</li>\n<li>described in public documentation;</li>\n<li>shown in a controlled demonstration;</li>\n<li>tested with representative data and users;</li>\n<li>confirmed by a comparable customer reference;</li>\n<li>committed in the contract or service level.</li>\n</ul><p>This prevents an unsupported “yes” from being treated the same as a tested capability. “Supports AI agents” is the current example. Before it earns a score, run the checks in <a href=\"https://www.amirmousavi.com/articles/how-to-check-a-martech-vendor-mcp-server\">how to check a martech vendor’s MCP server</a> and record what the documentation actually states.</p><h3>Make the proof of value test the hardest assumptions</h3><p>A proof of value should not reproduce the vendor’s easiest demo. Test one or two high-priority use cases that cross the riskiest boundaries: real identity rules, representative data quality, consent behavior, integration latency, administrative work, measurement, and failure recovery.</p><p>Define acceptance criteria before the test. Depending on the use case, they may include audience match rate, processing latency, manual hours, error visibility, workflow completion, user success, data export quality, or measurement completeness.</p><h3>Calculate lifecycle cost, not only subscription price</h3><p>IBM defines total cost of ownership as the direct and indirect cost of a product or service over its lifecycle. For MarTech, that includes internal labor and organizational change as well as vendor invoices.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 \"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">The cost model below the subscription price</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">Model direct and indirect costs over the expected lifecycle. The cheapest license can be the most expensive system to operate.</p></div><div class=\"grid gap-px bg-zinc-200 dark:bg-zinc-700/60 sm:grid-cols-3\"><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Acquire and launch</h4><ul class=\"mt-4 space-y-2 text-sm leading-5 text-zinc-600 dark:text-zinc-400\"><li class=\"border-l-2 border-teal-500/40 pl-3\">Subscription and usage</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Procurement</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Implementation</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Migration</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Integration</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Initial training</li></ul></section><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Operate and improve</h4><ul class=\"mt-4 space-y-2 text-sm leading-5 text-zinc-600 dark:text-zinc-400\"><li class=\"border-l-2 border-teal-500/40 pl-3\">Administration</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Data operations</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Quality assurance</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Support</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Enablement</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Change requests</li></ul></section><section class=\"bg-white p-5 dark:bg-zinc-900\"><h4 class=\"text-sm font-semibold text-zinc-900 dark:text-zinc-100\">Change or exit</h4><ul class=\"mt-4 space-y-2 text-sm leading-5 text-zinc-600 dark:text-zinc-400\"><li class=\"border-l-2 border-teal-500/40 pl-3\">Contract uplift</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Downtime</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Data export</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Rebuilds</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Retraining</li><li class=\"border-l-2 border-teal-500/40 pl-3\">Decommissioning</li></ul></section></div></div><p>Build a three-year model covering price escalators, contact or usage growth, implementation, migration, integrations, environments, enablement, administration, quality assurance, partner support, downtime, and exit. State assumptions and show a range rather than manufacturing a precise number from weak inputs.</p><p>Usage-based AI pricing belongs in that model as its own line, because the unit is no longer a seat. I read the current rate cards side by side in <a href=\"https://www.amirmousavi.com/articles/what-does-an-ai-agent-action-cost\">what one AI agent action costs</a>, and the answer changed twice in August 2026. It is not only AI: on HubSpot’s flexible seats-and-credits pricing, marketing email is metered in credits too, and the overage default changed on September 16, 2026, as I set out in <a href=\"https://www.amirmousavi.com/articles/hubspot-credits-and-seats-what-changed\">what HubSpot’s GTM seats and email credits cost</a>.</p><p>The value case should likewise distinguish:</p><ul>\n<li>incremental revenue or retention supported by a credible test;</li>\n<li>operating capacity or cycle-time improvement;</li>\n<li>avoided cost from consolidation or reduced failure;</li>\n<li>reduced privacy, security, or operational exposure;</li>\n<li>strategic options created by reusable data or workflow capabilities.</li>\n</ul><p>The phase-four deliverable is not “Vendor A won.” It is a decision record explaining why the investment is justified, what evidence supports it, what remains uncertain, and which conditions must be in the contract and implementation plan.</p><h2 id=\"operate\">Phase 5: implement, govern, and measure value</h2><p>Implementation planning must begin before signature because staffing, data preparation, integration work, environments, security review, migration, training, and change management materially affect the investment.</p><p>Sequence delivery by usable capabilities rather than technical components alone. A successful first release should complete an end-to-end use case for real users: data arrives, a decision is made, an action occurs, the outcome is measured, and support knows how to respond when something fails.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 sm:-mx-4 lg:-mx-12\"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">A practical 30/60/90-day operating roadmap</h3></div><div class=\"grid gap-px bg-zinc-200 dark:bg-zinc-700/60 sm:grid-cols-3\"><section class=\"bg-white p-5 dark:bg-zinc-900 sm:p-6\"><p class=\"text-xs font-semibold uppercase tracking-wide text-teal-700 dark:text-teal-400\">Days 1–30</p><h4 class=\"mt-2 text-base font-semibold text-zinc-900 dark:text-zinc-100\">Validate and stabilize</h4><ul class=\"mt-4 space-y-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\"><li>Confirm outcomes and owners</li><li>Inventory contracts and data</li><li>Fix critical access, tracking, or sync risks</li></ul><p class=\"mt-5 border-t border-zinc-100 pt-3 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\"><span class=\"font-semibold text-zinc-700 dark:text-zinc-300\">Output:</span> Verified current state</p></section><section class=\"bg-white p-5 dark:bg-zinc-900 sm:p-6\"><p class=\"text-xs font-semibold uppercase tracking-wide text-teal-700 dark:text-teal-400\">Days 31–60</p><h4 class=\"mt-2 text-base font-semibold text-zinc-900 dark:text-zinc-100\">Design and pilot</h4><ul class=\"mt-4 space-y-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\"><li>Finalize target flows</li><li>Configure priority use case</li><li>Test migration, controls, and measurement</li></ul><p class=\"mt-5 border-t border-zinc-100 pt-3 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\"><span class=\"font-semibold text-zinc-700 dark:text-zinc-300\">Output:</span> Working proof of value</p></section><section class=\"bg-white p-5 dark:bg-zinc-900 sm:p-6\"><p class=\"text-xs font-semibold uppercase tracking-wide text-teal-700 dark:text-teal-400\">Days 61–90</p><h4 class=\"mt-2 text-base font-semibold text-zinc-900 dark:text-zinc-100\">Adopt and govern</h4><ul class=\"mt-4 space-y-2 text-sm leading-6 text-zinc-600 dark:text-zinc-400\"><li>Train by role</li><li>Publish standards and support paths</li><li>Review value, risk, and next use cases</li></ul><p class=\"mt-5 border-t border-zinc-100 pt-3 text-xs leading-5 text-zinc-500 dark:border-zinc-800 dark:text-zinc-500\"><span class=\"font-semibold text-zinc-700 dark:text-zinc-300\">Output:</span> Operating capability</p></section></div></div><h3>Establish governance that supports change</h3><p>Governance should make safe work easier, not centralize every decision. Define:</p><ul>\n<li>accountable owners for platforms, data domains, integrations, and business outcomes;</li>\n<li>role-based access, privileged administration, onboarding, and offboarding;</li>\n<li>campaign, content, lifecycle, event, field, and audience naming standards;</li>\n<li>documentation requirements and a change log;</li>\n<li>testing, release, rollback, and incident procedures;</li>\n<li>privacy, security, and vendor-risk review triggers;</li>\n<li>a renewal calendar and decommissioning process;</li>\n<li>monthly operational reviews, quarterly value reviews, and an annual architecture review.</li>\n</ul><h3>Measure activated capability and business value</h3><p>Do not equate implementation with success. Use a balanced scorecard:</p><ul>\n<li><strong>Adoption:</strong> trained active users, workflow usage, feature depth, and support demand.</li>\n<li><strong>Operational performance:</strong> campaign cycle time, manual steps, errors, incidents, and recovery time.</li>\n<li><strong>Data quality:</strong> completeness, duplicate rate, consent coverage, schema errors, and reconciliation differences.</li>\n<li><strong>Customer outcomes:</strong> conversion, retention, complaints, preference changes, and experience measures.</li>\n<li><strong>Business outcomes:</strong> incremental revenue, qualified pipeline, lifetime value, cost savings, and risk reduction.</li>\n<li><strong>Financial health:</strong> cost per active user or use case, license utilization, partner dependency, and TCO variance.</li>\n<li><strong>Governance:</strong> tools with named owners, reviewed access, current documentation, and compliant changes.</li>\n</ul><p>Use controlled experiments where feasible and document attribution limitations. Activity metrics such as sends, dashboards, and workflows created may explain operations, but they do not prove business value.</p><p>This scorecard is only as good as the collection system underneath it, and that system fails for reasons that have nothing to do with the platforms in your stack. The specification stops being owned, definitions drift, and a year later two teams bring two numbers for the same metric. That failure pattern, and the deliverables that prevent it, are in <a href=\"https://www.amirmousavi.com/articles/why-analytics-implementations-fail\">why analytics implementations fail</a>. The newest version of the same problem is AI search, where four systems report visibility in four incompatible units — see <a href=\"https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic\">how to measure AI search traffic</a>.</p><h2>Common MarTech buying mistakes</h2><h3>Buying for a future maturity level</h3><p>The organization purchases advanced orchestration or AI capabilities without the data, process, skill, or governance to operate them. Stage the roadmap and prove prerequisites before paying for future-state complexity. This is where agentic claims land hardest: before you connect one, it is worth knowing <a href=\"https://www.amirmousavi.com/articles/what-ai-agents-can-do-in-your-martech\">what an AI agent can actually do in your ad accounts and CRM</a>, which is a question about the OAuth scope rather than the feature list.</p><h3>Copying another company’s stack</h3><p>Logos reveal almost nothing about another company’s business model, data, team, contracts, or operating constraints. Borrow evaluation questions, not architecture answers.</p><h3>Treating a CDP, AI platform, or consolidation suite as a repair strategy</h3><p>New software does not define lifecycle stages, resolve organizational ownership, clean historical data, or create a measurement discipline by itself.</p><h3>Letting the demo define the requirements</h3><p>Novel features become urgent because they are memorable. Use your script, your acceptance criteria, and your evidence scale.</p><h3>Ignoring the exit</h3><p>Before purchase, validate data export, formats, API limits, deletion, workflow portability, contract assistance, and the internal work required to leave.</p><h3>Updating the business case only at renewal</h3><p>Measure adoption, quality, operating performance, value, and cost during the contract. Renewal should confirm a known pattern, not initiate the first investigation.</p><h2 id=\"checklist\">The procurement-readiness checklist</h2><p>The checklist below is intentionally stricter than a conventional feature comparison. It tests whether the organization is ready to convert software into a governed capability.</p><div class=\"not-prose my-10 overflow-hidden rounded-2xl border border-zinc-200 bg-white shadow-sm shadow-zinc-900/5 dark:border-zinc-700/60 dark:bg-zinc-900 \"><div class=\"border-b border-zinc-200 px-5 py-5 dark:border-zinc-700/60 sm:px-6\"><h3 class=\"text-base font-semibold text-zinc-900 dark:text-zinc-100\">Procurement-readiness checklist</h3><p class=\"mt-2 max-w-2xl text-sm leading-6 text-zinc-600 dark:text-zinc-400\">A team should be able to check every item before committing to a material platform purchase.</p></div><div class=\"divide-y divide-zinc-100 dark:divide-zinc-800\"><label for=\"readiness-en-0\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-0\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>The business outcome, baseline, target, and accountable executive are documented.</span></label><label for=\"readiness-en-1\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-1\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>Priority use cases have owners, audiences, actions, required data, and success measures.</span></label><label for=\"readiness-en-2\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-2\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>The current stack, contracts, capabilities, adoption, integrations, and risks are inventoried.</span></label><label for=\"readiness-en-3\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-3\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>The gap cannot be solved more safely through configuration, training, data, or process changes.</span></label><label for=\"readiness-en-4\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-4\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>The target data flow identifies systems of record, identifiers, consent, latency, retention, and failure ownership.</span></label><label for=\"readiness-en-5\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-5\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>Business, user, functional, data, integration, security, privacy, reporting, and commercial requirements are testable.</span></label><label for=\"readiness-en-6\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-6\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>Vendor scores are supported by evidence rather than feature counts or presentation quality.</span></label><label for=\"readiness-en-7\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-7\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>The proof of value tests the hardest assumptions with representative data and users.</span></label><label for=\"readiness-en-8\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-8\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>Three-year TCO includes internal labor, integration, training, support, change, and exit costs.</span></label><label for=\"readiness-en-9\" class=\"flex cursor-pointer gap-4 px-5 py-4 text-sm leading-6 text-zinc-700 transition hover:bg-zinc-50 dark:text-zinc-300 dark:hover:bg-zinc-800/50 sm:px-6\"><input id=\"readiness-en-9\" type=\"checkbox\" class=\"mt-1 h-4 w-4 shrink-0 rounded border-zinc-300 text-teal-600 focus:ring-teal-500 dark:border-zinc-600 dark:bg-zinc-800\"/><span>Implementation, adoption, governance, measurement, and exit plans have named owners.</span></label></div></div><p>If several items remain unchecked, delay the purchase or narrow it to a reversible pilot. The unresolved work will otherwise reappear during implementation at greater cost.</p><h2 id=\"faq\">Frequently asked questions</h2><h3>How many tools should a MarTech stack contain?</h3><p>There is no ideal number. Count distinct operating obligations, not logos. A larger stack can be coherent when boundaries and ownership are clear; a smaller stack can still be fragmented through weak data and process design. Optimize for comprehensibility, interoperability, adoption, control, and value.</p><h3>How often should a MarTech stack be audited?</h3><p>Review usage, incidents, cost, access, and upcoming renewals quarterly. Perform a deeper capability and architecture review annually and before a major purchase, acquisition, market expansion, privacy change, or operating-model shift.</p><h3>When does a company need a CDP?</h3><p>Consider a CDP when prioritized use cases require persistent unified profiles, identity resolution, and activation across systems—and when the organization has defined identifiers, consent logic, source systems, ownership, and operating capacity. Data messiness alone is not a sufficient business case.</p><h3>Should we consolidate onto one suite?</h3><p>Consolidate when shared data, administration, workflow, and commercial leverage create more value than specialization. Keep a point solution when it provides material capability depth and the integration and governance costs are justified. “One suite” does not eliminate integration with sales, commerce, service, product, finance, or data systems.</p><h3>What should a MarTech proof of concept test?</h3><p>Test the assumptions most likely to invalidate the investment: representative data, identity, consent, latency, integration limits, user administration, error handling, measurement, export, and support. Do not judge the platform by a polished path using clean vendor data.</p><h3>Who should own the MarTech stack?</h3><p>Ownership is usually shared. Marketing owns outcomes and use cases; marketing operations owns many workflows and standards; IT and data own enterprise architecture, security, and critical integrations; privacy and legal advise on applicable obligations; finance and procurement own commercial controls. Each platform and data flow still needs one accountable owner.</p><h3>How should AI change stack planning?</h3><p>AI adds requirements for data rights, approved inputs, output quality, model and vendor transparency, human review, monitoring, and reversibility. It does not change the planning order. Begin with the decision or workflow, then determine whether AI is the appropriate capability. My own rule for where automation belongs is in <a href=\"https://www.amirmousavi.com/articles/ai-agents-for-seo-content\">AI agents for SEO content</a>: hand over the task when it is structured, reversible, and cheap to verify. And treat AI-visibility scoring tools as vendors making a measurement claim: ask for the sample size, the prompt set, and the run-to-run variance before one enters the stack.</p><aside class=\"not-prose my-10 rounded-2xl border border-zinc-200 bg-zinc-50 p-5 dark:border-zinc-700 dark:bg-zinc-800/50 sm:flex sm:items-center sm:justify-between sm:gap-6 sm:p-6\"><div><p class=\"font-semibold text-zinc-900 dark:text-zinc-100\"><p>Turn the framework into your next-step roadmap</p></p><p class=\"mt-1 text-sm leading-6 text-zinc-600 dark:text-zinc-400\"><p>Answer nine questions and get recommendations ranked by the evidence your\nstack is missing.</p></p></div><a class=\"mt-4 inline-flex shrink-0 items-center justify-center rounded-lg bg-teal-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-teal-700 sm:mt-0\" href=\"https://www.amirmousavi.com/resources/martech-stack-assessment\"><p>Start the assessment</p></a></aside><h2>Sources and editorial method</h2><p>This guide synthesizes source material available and checked on June 29, 2026. Statistics appear only when the original or authoritative source could be identified. Vendor material is appropriate for explaining a vendor’s own product behavior, but not as the sole evidence for neutral market comparisons.</p><p>The July 29, 2026 revision changed structure, framing, and internal links rather than evidence. I did not recheck the references below on that date, so June 29 remains the verification date that counts.</p><p>Core references:</p><ol>\n<li><a href=\"https://chiefmartec.com/2026/05/2026-marketing-technology-landscape-supergraphic-peak-martech-achieved-maybe/\">Chiefmartec, 2026 Marketing Technology Landscape</a>.</li>\n<li><a href=\"https://www.gartner.com/en/marketing/topics/marketing-technology\">Gartner, Maximize ROI With Marketing Technology</a>.</li>\n<li><a href=\"https://www.mckinsey.com/capabilities/growth-marketing-and-sales/our-insights/rewiring-martech-from-cost-center-to-growth-engine\">McKinsey, Rewiring MarTech: From Cost Center to Growth Engine</a>.</li>\n<li><a href=\"https://www.forrester.com/blogs/alignment-on-martech-decisions/\">Forrester, Getting Alignment on MarTech Decisions</a>.</li>\n<li><a href=\"https://www.ibm.com/think/topics/total-cost-of-ownership\">IBM, Total Cost of Ownership</a>.</li>\n<li><a href=\"https://www.intercom.com/blog/rice-simple-prioritization-for-product-managers/\">Intercom, RICE Prioritization Framework</a>.</li>\n<li><a href=\"https://www.cdpinstitute.org/wp-content/uploads/2021/07/CDPI-2289-Industry-Update-July-2021.pdf\">Customer Data Platform Institute, CDP definition</a>.</li>\n<li><a href=\"https://developers.google.com/tag-platform/security/concepts/consent-mode\">Google, Consent Mode overview</a>.</li>\n<li><a href=\"https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief\">Office of the Privacy Commissioner of Canada, PIPEDA requirements</a>.</li>\n<li><a href=\"https://csrc.nist.gov/pubs/sp/1300/final\">NIST, Cybersecurity Framework 2.0 supply-chain risk guidance</a>.</li>\n</ol><p>The page does not use several frequently repeated claims from secondary research—including a “$1 trillion MarTech market,” a universal “3.2× revenue multiplier,” an average of 75 tools per organization, or generic 10–40% utilization ranges—because the original evidence or comparability was not strong enough for this guide.</p>\n",
            "url": "https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack",
            "title": "How to Plan a MarTech Stack Before Buying Tools",
            "summary": "A practical, evidence-based framework for auditing capabilities, mapping data, defining requirements, evaluating vendors, and governing a MarTech stack.",
            "date_modified": "2026-05-14T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "MarTech stack",
                "technology strategy",
                "data architecture",
                "vendors"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/why-analytics-implementations-fail",
            "content_html": "<p>The moment an analytics implementation dies is easy to recognize and almost never recorded. Two people bring two numbers for the same metric to the same meeting, someone says they will reconcile it offline, and the reconciliation never happens. From that meeting onward, the dashboards stay up and nobody makes a decision with them.</p><p>I have been called in to fix the dashboard several times. The dashboard is almost never the problem. What I usually find is a tracking setup that was treated as a set of tags rather than as a managed information system, built correctly against a specification that no longer exists, by people who have since left.</p><h2>Quick answer</h2><p>Analytics implementations fail at the specification, not at the reporting layer. Six failure modes cover nearly everything I see: no measurement plan connecting business questions to observable behaviour, event definitions with no contract, naming that describes interface elements instead of outcomes, consent behaviour that was never tested, QA that verifies tags fired rather than data arrived correctly, and no named owner of the specification after launch. The last one is the one that actually kills implementations, because the other five are recoverable while somebody is accountable.</p><h2>What has to happen before anybody touches a tag?</h2><p>A measurement plan, and it is not a tracking document. It connects a business question to observable behaviour, which means most of it is written before anyone opens a tag manager.</p><p>For each question, write down the decision the data should support, the metric and its exact calculation, the events and properties required, the systems that will provide the data, the segments and exclusions that matter, the consent or privacy constraints, and the person who approves the definition. Seven fields. The last one is the field people skip, and it is the field that makes the other six durable.</p><p>Here is the difference that matters in practice. &quot;Track button clicks&quot; is not a measurement requirement. &quot;Measure how many qualified visitors begin and complete the consultation request flow, segmented by service interest and acquisition source&quot; is close to one, because it names an outcome, a journey and two dimensions somebody will actually slice by. The first version produces a tag. The second produces a report a person can act on.</p><p>If you want the short version to work through, it is the <a href=\"https://www.amirmousavi.com/resources/analytics-implementation-checklist\">analytics implementation checklist</a>.</p><h2>Why do event definitions drift?</h2><p>Because an event specification is a contract between five parties, and contracts without a signatory get rewritten by whoever is nearest.</p><p>The parties are the website or app, the data layer, the tag manager, the analytics platform, and every report and audience that consumes the data. Each event in that contract needs a stable name, a plain-language definition, a trigger condition, required and optional parameters, permitted values and formats, an example, and an owner with version history.</p><p>Without the contract you get the failure I can predict before opening the container: three near-duplicate events named <code>form_submit</code>, <code>form_submission</code> and <code>lead_form_complete</code>, each firing in slightly different circumstances, none documented. Reports then depend on undocumented filters and institutional memory, and institutional memory resigns.</p><h2>Should naming conventions be clever or boring?</h2><p>Boring. Every time.</p><p>I have never seen an elaborate taxonomy survive two years of staff turnover, and I have never seen a boring one fail for reasons of taste. Set conventions for casing and separators, event and parameter naming, page and product and campaign and form identifiers, how you represent null and unknown and not-applicable, currency and date and numeric formats, how test and environment data is marked, and what is prohibited outright — which for analytics fields means anything personally identifiable.</p><p>The goal is not theoretical elegance. The goal is a specification a different analyst can apply next year without guessing, because guessing is how the near-duplicates get created.</p><p>One rule I hold firmly: event names should describe user outcomes, not interface elements. <code>cta_click</code> tells you nothing in eighteen months, when the CTA has moved, changed colour and been split into two. <code>consultation_request_started</code> still means something.</p><h2>How does consent change the numbers?</h2><p>It changes what you collected, which is not the same as what happened, and the gap between those two sentences is where most misreadings live.</p><p>Consent behaviour belongs in the design and in the QA plan, not in a follow-up ticket. The team needs to know which tags run before and after consent, how consent choices are stored and updated, whether events are blocked or modelled or sent with restricted fields, how regional rules change collection, and how all of that changes the interpretation of a trend line.</p><p>The practical consequence is the one that catches teams out. If a consent change reduces observed traffic, the website did not necessarily lose traffic. The measurement system changed. An analyst who does not have that change written down with a date will read a collection artefact as a business decline, and will be persuasive about it, because the chart is real.</p><p>Every consent configuration change should land in an annotation log with a date. That log costs nothing and is the only thing that makes a time series interpretable across a config change.</p><h2>What does real QA look like?</h2><p>Not a debugger showing a tag fired. That confirms one link in a seven-link chain.</p><p>Validate the whole chain, in this order:</p><ol>\n<li>the user action actually occurred;</li>\n<li>the data layer contained the correct values at that moment;</li>\n<li>consent permitted the intended behaviour;</li>\n<li>the request was sent exactly once;</li>\n<li>the analytics platform processed the event;</li>\n<li>parameters arrived with the expected type and scope;</li>\n<li>reports and audiences used the definition you documented.</li>\n</ol><p>Then test the cases that are not the happy path, because the happy path is the only one that gets tested by default: errors, repeat actions, back-button behaviour, multiple tabs, logged-in versus anonymous states, campaign parameters, and the two or three devices that carry most of your traffic. Write the test cases down so they can be rerun after the next release, which is the entire point. QA that cannot be repeated is a one-time observation, not a control. When the release is a whole site rather than a container change, the <a href=\"https://www.amirmousavi.com/resources/website-launch-checklist\">website launch checklist</a> puts this chain next to the crawl, redirect and performance checks that ship with it. Campaign parameters deserve their own case on Safari: several click IDs and email tokens are on Safari’s link-stripping list, which I found reading <a href=\"https://www.amirmousavi.com/articles/does-safari-27-block-your-marketing-tags\">the tracker lists Safari 27 runs on</a>.</p><h2>Who owns the specification after launch?</h2><p>This is the question that decides whether the implementation is alive in a year, and it is usually answered by silence.</p><p>Name a person for each of these: approving new events and parameters, reviewing tag-manager changes before publish, monitoring data volume and anomalies, updating documentation after site releases, controlling access and publishing rights, maintaining dashboards and metric definitions, and deprecating fields and reports that no longer mean anything.</p><p>Analytics degrades the way any unowned specification degrades: slowly, invisibly, and then all at once in a meeting. This operating model belongs inside the broader <a href=\"https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack\">MarTech stack plan</a>, because analytics depends on exactly the same integrations, governance and team capacity as everything else in the stack. My working notes on the tooling side are in <a href=\"https://www.amirmousavi.com/resources/ga4-gtm-notes\">GA4 and GTM notes</a>.</p><h2>How do I know an implementation is already failing?</h2><p>Nine signs, and you rarely see just one:</p><ul>\n<li>teams bring different numbers for the same metric;</li>\n<li>reports need filters nobody can explain;</li>\n<li>event names describe buttons rather than outcomes;</li>\n<li>production releases ship without analytics review;</li>\n<li>test and internal traffic cannot be identified and excluded;</li>\n<li>personally identifiable data appears in analytics fields;</li>\n<li>nobody can explain how consent affects a specific metric;</li>\n<li>the tag container has many publishers and no release process;</li>\n<li>the documentation describes a version of the site that no longer exists.</li>\n</ul><p>The same failure now has an AI-search version, and it arrived faster than I expected: four systems report AI visibility in four different units, and a dashboard sums them anyway. The units and their blind spots are in <a href=\"https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic\">how to measure AI search traffic</a>.</p><h2>The minimum deliverable I would accept</h2><p>Before anyone calls an implementation complete, I want eight artefacts, and I want them in a place other people can find:</p><ul>\n<li>a measurement plan;</li>\n<li>an event and parameter specification;</li>\n<li>a consent and privacy map;</li>\n<li>a tagging and data-layer design;</li>\n<li>documented QA evidence, not an assurance that QA happened;</li>\n<li>metric definitions for every key report;</li>\n<li>ownership and change-control rules;</li>\n<li>a release and monitoring checklist.</li>\n</ul><p>None of these are exotic. All of them are the difference between a tracking setup and a measurement system.</p><h2>My working take</h2><p>The uncomfortable part of this work is that almost none of it is technical. Tagging is the easy half. The hard half is agreeing on definitions, writing them down, and assigning a person to defend them against the next twelve reasonable-sounding requests to add one more event.</p><p>I would rather inherit a small implementation with eight documented events and a named owner than a comprehensive one with two hundred undocumented events and nobody accountable. The first can answer a question. The second can only produce numbers, and numbers that cannot be defended stop being used — quietly, without anyone announcing it.</p><p>Dashboards become trustworthy when the collection system underneath them is understandable and governed. The quiet work before reporting is what makes the report worth opening.</p><h2>Frequently asked questions about analytics implementation failures</h2><h3>What is the most common reason analytics implementations fail?</h3><p>No owner for the specification after launch. Missing measurement plans and untested consent are more visible, but they are recoverable while somebody is accountable for definitions. Once nobody owns the specification, every other problem compounds without being noticed.</p><h3>How do I know whether to trust an existing analytics setup?</h3><p>Ask for the event specification and the metric definitions, then pick one number in a dashboard and trace it back to a documented event and trigger. If that trace cannot be completed, the setup is not trustworthy yet, regardless of how sophisticated the reporting looks.</p><h3>Does a consent banner change my analytics data?</h3><p>Yes, and the size of the change depends on your configuration and region. What matters operationally is that the change is documented with a date, so a drop in observed traffic can be attributed to the measurement system rather than misread as a business decline.</p><h3>How many events should a GA4 implementation have?</h3><p>As few as answer your documented questions. I would rather see eight events tied to a measurement plan than two hundred tied to nothing. Event volume is not maturity; every event is a maintenance obligation and a chance for a definition to drift.</p><h3>Who should own analytics in an organization?</h3><p>One named person owns the specification and approves changes to it, even when the work is shared across marketing, engineering and data. Shared ownership of definitions reliably becomes no ownership of definitions.</p><h3>Can this be fixed without rebuilding everything?</h3><p>Usually, and rebuilding is often the wrong instinct. Write the measurement plan for the questions people actually ask, document the events that already serve them, deprecate the rest explicitly, and assign an owner. Most of what looks like a technical rebuild is a documentation and governance problem wearing a technical costume.</p><h2>Sources and method</h2><p>Verified at source: July 29, 2026.</p><p>The failure modes above come from my own implementation and audit work rather than from a published study, and I have not put numbers on their frequency because I do not have a defensible sample. The platform mechanics referenced here rest on primary documentation:</p><ul>\n<li><a href=\"https://developers.google.com/analytics/devguides/collection/ga4/events\">Google: GA4 events</a></li>\n<li><a href=\"https://developers.google.com/analytics/devguides/collection/ga4/reference/events\">Google: GA4 event reference</a></li>\n<li><a href=\"https://developers.google.com/tag-platform/tag-manager/datalayer\">Google: the data layer in Tag Manager</a></li>\n<li><a href=\"https://developers.google.com/tag-platform/security/guides/consent\">Google: consent management for tags</a></li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/why-analytics-implementations-fail",
            "title": "Why Analytics Implementations Fail Before Reporting",
            "summary": "Analytics implementations rarely fail at the dashboard. They fail at the specification nobody owns. The six failure modes, and the deliverables that prevent them.",
            "date_modified": "2026-04-02T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "analytics implementation",
                "measurement plan",
                "GA4",
                "tag management"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/cdp-crm-and-marketing-automation",
            "content_html": "<p>Almost every stack I audit has at least two systems that each believe they are authoritative for email consent. Nobody chose that. It is what happens when three platforms can all store a customer record and no one ever wrote down which one wins.</p><p>The most common version plays out like this. A contact unsubscribes through the one-click link in a campaign, and the automation platform records it. A few hours later, a bidirectional CRM sync overwrites the flag with its own stale value. Next week’s campaign goes out, and the recipient — who already opted out once — presses &quot;report spam&quot; instead of the unsubscribe link they no longer trust. Google’s <a href=\"https://support.google.com/a/answer/81126\">sender guidelines</a> treat a 0.3% user-reported spam rate as the line past which bulk senders lose standing, so a sync-direction mistake made in an integration settings page surfaces three weeks later as a deliverability incident in a different team’s dashboard.</p><p>The confusion behind it is understandable. A CDP, a CRM and a marketing automation platform can all show you a person, an email address and a history, which makes them look interchangeable in a demo. They are not interchangeable, and the way to tell them apart is not by feature list. It is by the job each one owns.</p><h2>Quick answer</h2><p>A CRM manages known relationships and the human work around them. A CDP unifies data from many sources into resolved profiles and makes them available downstream. A marketing automation platform decides when and how a message is delivered. Feature overlap between the three is now normal and not the real problem; ownership ambiguity is. The question that settles most arguments is not &quot;which platform is our source of truth&quot; but &quot;which system is authoritative for this specific field or decision, and how do the others learn about changes to it?&quot; The deliverable that answers it is a field-level ownership table, and a worked example is below.</p><h2>What job does each system actually own?</h2><h3>CRM: relationships and pipeline</h3><p>A CRM — HubSpot, Salesforce, Pipedrive — is usually the operational source of truth for accounts, contacts, leads, opportunities, owners and sales activity. It answers who the customer or prospect is, which team member owns the relationship, what conversations and opportunities and service cases are open, and what the commercial status of the account is.</p><p>Its data is entered and reviewed by people — sales, service, account teams — which is both its strength and its characteristic weakness. A CRM is strongest when a person or organization is known and the business needs a durable history of the relationship. It is weakest wherever it depends on someone remembering to update a field, and its records decay as fast as its contacts change jobs.</p><h3>CDP: profile unification and audience data</h3><p>A CDP — Segment, mParticle, RudderStack in the packaged version of the category — collects data from websites, apps, transactions, service systems, CRM records and elsewhere. It resolves identities, builds profiles, and exposes audiences or attributes to downstream tools. The CDP Institute’s definition remains the useful test: packaged software that builds a persistent, unified customer database accessible to other systems. A product that cannot ingest raw behavioural events, or whose profiles cannot leave for other tools without engineering tickets, is wearing the label rather than doing the job.</p><p>It answers which events and transactions belong to the same person or household, what consent and preferences and identifiers are available, which customers qualify for a specific audience, and which profile attributes should be activated somewhere else.</p><p>The failure mode here is well known and still common: the CDP becomes a place to put every available field, on the theory that unified data is inherently valuable. It is not. A CDP earns its cost through defined use cases, explicit identity rules, data quality, governance and reliable destinations. Without those five, you have bought a very expensive copy of your existing mess, and the copy also needs maintaining.</p><h3>Marketing automation: orchestration and delivery</h3><p>Marketing automation platforms — Braze, Customer.io, Klaviyo, Marketo, or the marketing module of a suite — execute. They manage triggers, timing, branching logic, frequency rules, templates and channel delivery, and they answer what should happen after a form submission or purchase, which message goes next, when someone enters or leaves a journey, and how email and SMS and push and advertising get coordinated.</p><p>These platforms consume customer and audience data. They are execution systems, and treating one as your customer data foundation is the most common architectural mistake I see, because it is the cheapest one to start making.</p><p>Suites blur these lines on the price list, not in the work: HubSpot sells the CRM and the automation platform on one bill, as does Salesforce with Marketing Cloud. The bundling changes the invoice. It does not change the fact that the modules hold overlapping copies of the same fields, disagree with each other in exactly the way separate products do, and need the same written ownership decisions.</p><p>If you are mapping out one of these programs, the <a href=\"https://www.amirmousavi.com/resources/marketing-automation-planning-template\">marketing automation planning template</a> covers the audience, trigger, channel, follow-up, and measurement decisions worth settling before the tool is configured.</p><h2>Why do these three keep getting confused?</h2><p>Because vendors keep buying and building into each other’s territory, and because the sales motion rewards it.</p><p>A CRM now ships campaign journeys. A marketing platform builds profiles and segments. A CDP activates messages. Every one of those claims is true and none of them settles anything, because capability is not the same as accountability. Two systems can both be able to store consent. Only one can be right about it.</p><p>So stop asking which platform is the single source of truth for everything. Assign an <a href=\"https://www.amirmousavi.com/resources/martech-glossary#authoritative-system\">authoritative system</a> per field and per decision instead. Here is the table filled in for the stack I meet most often in mid-market B2B — HubSpot as CRM and automation, Segment collecting events, Stripe for billing, GA4 for analytics, Zendesk for support:</p><table><thead><tr><th>Field or decision</th><th>Authoritative system</th><th>How the others learn about changes</th></tr></thead><tbody><tr><td>Account owner and lifecycle stage</td><td>HubSpot CRM</td><td>Synced outward as read-only traits; nothing downstream writes lifecycle stage back</td></tr><tr><td>Web and app behavioural events</td><td>Segment</td><td>Forwarded to GA4, the warehouse, and HubSpot as events; never edited downstream</td></tr><tr><td>Resolved profile and audience membership</td><td>Segment — or the warehouse, where one exists</td><td>Audiences pushed to ad platforms and HubSpot lists on an hourly schedule</td></tr><tr><td>Email consent and communication prefs</td><td>HubSpot subscription types — the only system with a write path</td><td>Zendesk and any other sender read it over the API before sending; other records show a read-only copy</td></tr><tr><td>Journey state and message history</td><td>HubSpot workflows</td><td>Summary fields (last campaign, last engagement date) written to the contact; raw send logs stay where they are</td></tr><tr><td>Revenue, invoices, refunds</td><td>Stripe</td><td>Nightly to the warehouse; the CRM account shows a derived revenue field, labelled as derived</td></tr></tbody></table><p>Your table will differ, and I have seen defensible stacks that assign these rows differently. What is not negotiable is that exactly one system is authoritative for each row, that the third column exists at all — sync direction and cadence are where the opening incident came from — and that the table is written down and agreed. Filled in, it prevents more incidents than any integration platform.</p><p>Fill in the consent row first. It is the only row where an ownership mistake is a legal event rather than a reporting error, because an unsubscribe that fails to reach a <a href=\"https://www.amirmousavi.com/resources/martech-glossary#suppression-list\">suppression list</a> in another tool is a violation, not a discrepancy.</p><h2>How do the three work together in practice?</h2><p>The same reference stack, end to end — and the order matters:</p><ol>\n<li>A person interacts with the website, the product, or a sales conversation.</li>\n<li>Segment collects the behavioural and identity data under the consent state the CMP exposes.</li>\n<li>Segment connects identifiers and updates the profile; the warehouse receives the same stream.</li>\n<li>HubSpot CRM contributes relationship, account and pipeline context as read-only traits.</li>\n<li>Audience membership is pushed to HubSpot lists and the ad platforms.</li>\n<li>A HubSpot workflow delivers the message and records the outcome.</li>\n<li>Engagement and conversion data flows back to GA4, the warehouse and the profile — so the journey can be evaluated against revenue rather than against opens.</li>\n</ol><p>Step seven is the one that gets dropped, and dropping it is how organizations end up unable to say whether a journey worked. Which is why platform selection should follow a <a href=\"https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack\">data-flow and capability map</a> rather than a feature checklist from a vendor demo, and why the measurement design has to exist before the campaign does — the failure pattern is the same one described in <a href=\"https://www.amirmousavi.com/articles/why-analytics-implementations-fail\">why analytics implementations fail</a>.</p><h2>Which one should you buy first?</h2><p>Buy against the unresolved problem, not against the maturity model. The industry’s default failure is buying ahead of the problem: Gartner’s marketing technology surveys have put stack utilization between a third and half of purchased capability in every edition since 2022 — 42% in 2022, <a href=\"https://martech.org/marketers-are-only-using-one-third-of-their-stacks-capability/\">33% in 2023</a>, 49% in 2025.</p><ul>\n<li>Start with a <strong>CRM</strong> when relationship ownership, pipeline visibility or service history is fragmented. This is a people-and-process problem before it is a data problem.</li>\n<li>Start with <strong>marketing automation</strong> when the customer data is already usable but execution is manual, inconsistent or dependent on one person’s calendar.</li>\n<li>Consider a <strong>CDP</strong> when valuable data is genuinely spread across systems and identity resolution, audience portability or real-time activation is a demonstrated requirement with a named use case attached.</li>\n</ul><p>I will say the unpopular part plainly: most teams asking me about a CDP do not need one yet. Better CRM hygiene, a clear analytics plan and two reliable integrations solve the near-term problem at a fraction of the operational complexity. A CDP is a good answer to a question about identity and activation at scale. It is a poor answer to a question about data quality, because it will faithfully unify data that is wrong.</p><h2>When does a data warehouse replace a CDP?</h2><p>There is a fourth option that did not exist meaningfully a few years ago. If the company already runs BigQuery, Snowflake or Databricks, the CDP’s jobs can be assembled on top of it: events land in the warehouse, identity resolution lives in SQL models the data team maintains, and a <a href=\"https://www.amirmousavi.com/resources/martech-glossary#reverse-etl\">reverse ETL</a> tool — Hightouch and Census defined the category — syncs the resulting audiences into the CRM, the ad platforms and the automation tool. Vendors call this the <a href=\"https://www.amirmousavi.com/resources/martech-glossary#composable-cdp\">composable CDP</a>; both camps argue the label with pricing decks.</p><p>What the warehouse route buys is real: audience logic lives in version-controlled SQL instead of a vendor interface, every downstream tool receives the same answer, there is no second profile store to reconcile against the first, and you pay for compute you already own instead of per-tracked-user pricing. What it costs is just as real: your team now owns identity logic, sync monitoring and the on-call for both.</p><p>It also makes the real-time question honest. A nightly sync is a scheduled query and a morning check. Real-time is a streaming pipeline with retries, backfills, monitoring and someone who answers when it pages. The first is a line item; the second is a role. Most activation use cases — win-back campaigns, audience exclusions, lead routing — are perfectly served by the nightly version, which is why &quot;how quickly must this data actually move, in a number&quot; appears in the list below and deserves a defended answer rather than the word &quot;instantly&quot;.</p><p>The decision rule I use: a warehouse the company already operates, a data engineer with capacity to own the models, and latency tolerance measured in hours — take the composable route. Missing any of the three, buy packaged or stay with the automation platform’s native segments until the missing piece exists.</p><h2>What should be documented before you evaluate products?</h2><p>Answer these eight before you take a demo, because a demo will otherwise answer them for you:</p><ul>\n<li>Which use cases are blocked today, specifically?</li>\n<li>Which identifiers can legally and reliably connect records?</li>\n<li>Who owns data quality and profile rules after launch?</li>\n<li>How quickly must data actually move between systems, in a number?</li>\n<li>Which destinations need audiences or attributes?</li>\n<li>What is the retention and consent model?</li>\n<li>Which existing platform should stay authoritative for each field?</li>\n<li>Who operates the system once the implementation team leaves?</li>\n</ul><h2>My working take</h2><p>The goal is not to crown one platform as the centre of the stack. That framing is what vendors want the conversation to be, because whoever is at the centre is hardest to remove.</p><p>The goal is to give each system a clear job and make the boundaries legible to the people who maintain them at 9am on a Tuesday when something has broken. I would take three well-bounded systems with an agreed ownership table over one consolidated suite with vague internal boundaries, and I have watched both.</p><p>If you take one thing from this: overlap is not the problem, and trying to eliminate overlap by consolidating is often a more expensive way to arrive at the same ambiguity. Ambiguity is the problem. Write the table.</p><p>If you are not sure whether your stack is ready for that conversation at all, the <a href=\"https://www.amirmousavi.com/resources/martech-stack-assessment\">nine-question MarTech stack assessment</a> scores exactly this: whether ownership, data, and measurement are defined well enough that buying anything would help.</p><h2>Frequently asked questions about CDP, CRM and marketing automation</h2><h3>What is the main difference between a CDP and a CRM?</h3><p>A CRM records relationships that people manage, mostly through human input. A CDP unifies machine-collected data from many systems into resolved profiles and pushes them elsewhere. Put simply: a CRM is where you record what you know about a relationship; a CDP is where you assemble what your systems have observed.</p><h3>Do I need a CDP if I already have a CRM and marketing automation?</h3><p>Usually not yet. A CDP earns its cost when identity resolution across several systems, audience portability or real-time activation is a demonstrated requirement with a named use case. If the actual problem is that CRM data is incomplete or inconsistent, a CDP will unify the inconsistency rather than fix it.</p><h3>Is HubSpot a CRM or a marketing automation platform?</h3><p>Both — it is a suite whose CRM and Marketing Hub cover two of the three jobs on one bill, and Salesforce plus Marketing Cloud is the same answer at enterprise scale. The bundling does not dissolve the ownership question: the modules keep overlapping copies of the same fields, so the field-level table applies inside a suite exactly as it does between separate products.</p><h3>Can a marketing automation platform replace a CDP?</h3><p>For simple stacks, its native profile and segmentation features are often enough, and I would use them before buying anything. It stops being enough when you need identity resolution across systems the automation platform cannot see, or when several destinations besides messaging need the same audiences.</p><h3>Which system should own consent and communication preferences?</h3><p>One of them, explicitly, and written down. Whether that is a dedicated consent platform, the CRM or a governed profile store matters less than the fact that every other system reads from it rather than keeping its own opinion. Two systems both holding consent is the most consequential version of this whole problem — under Canada’s <a href=\"https://crtc.gc.ca/eng/internet/anti.htm\">anti-spam law</a>, a message sent after an unsubscribe is a violation with penalties up to $10 million per violation for organizations, not a data-quality footnote.</p><h3>Does a data warehouse replace a CDP?</h3><p>Sometimes. If the company already operates a warehouse, identity modeling can live there in SQL and a reverse ETL tool can activate audiences from it, which covers the use case without a separate profile store. The deciding factors are who runs the warehouse, how quickly that team can ship a change, and whether latency measured in hours is acceptable — the full decision rule is in the warehouse section above.</p><h3>What is the most common mistake in choosing between these systems?</h3><p>Letting a vendor demo define the requirements. The second most common is treating a CDP purchase as a data-quality strategy. Both come from the same root: choosing a tool before writing down which system is authoritative for what.</p><h2>Sources and method</h2><p>Verified at source: August 20, 2026.</p><p>This is a definitional and architectural piece. The boundaries, the reference stack, and the ownership table come from my own implementation and audit work rather than from a published taxonomy, and the named products are positioning examples, not endorsements. I have deliberately not used vendor category definitions as evidence, because vendors define these categories to include their own products — which is reasonable of them and useless for a neutral comparison.</p><p>External facts in this article rest on:</p><ul>\n<li><a href=\"https://www.cdpinstitute.org/\">CDP Institute</a> — the packaged-software definition of a CDP used as the category test.</li>\n<li><a href=\"https://www.gartner.com/en/marketing/topics/marketing-technology\">Gartner: marketing technology</a> and <a href=\"https://martech.org/marketers-are-only-using-one-third-of-their-stacks-capability/\">MarTech’s report on the 2023 survey</a> — the stack-utilization figures (42% in 2022, 33% in 2023, 49% in 2025).</li>\n<li><a href=\"https://chiefmartec.com/2026/05/2026-marketing-technology-landscape-supergraphic-peak-martech-achieved-maybe/\">Chiefmartec: 2026 Marketing Technology Landscape</a> — the category-overlap context: 15,505 products and a market that has stopped growing.</li>\n<li><a href=\"https://support.google.com/a/answer/81126\">Google: email sender guidelines</a> — the 0.3% user-reported spam threshold behind the opening incident.</li>\n<li><a href=\"https://crtc.gc.ca/eng/internet/anti.htm\">CRTC: Canada’s Anti-Spam Legislation</a> — consent requirements and penalty ceilings.</li>\n</ul>\n",
            "url": "https://www.amirmousavi.com/articles/cdp-crm-and-marketing-automation",
            "title": "CDP vs. CRM vs. Marketing Automation: What Each Does",
            "summary": "Three systems, three jobs, and one question that settles most arguments: which system is authoritative for this field? Boundaries, data flow, and what to buy first.",
            "date_modified": "2026-02-18T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "CDP",
                "CRM",
                "marketing automation",
                "customer data",
                "reverse ETL"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/ai-agents-for-seo-content",
            "content_html": "<p>I use AI agents in my own content work every week, which is why I am unimpressed by the demonstrations. An agent producing a finished article is the least interesting thing an agent can do, and it is the only thing most people try.</p><p>The useful question was never whether an agent can write. It is which parts of the workflow can be handed over without weakening accuracy, originality or editorial judgment. After a year of running this properly and a few months of running it badly first, my answer has narrowed to a single test, and the test is not about capability.</p><h2>Quick answer</h2><p>Give an agent the task if it is <strong>structured, reversible and cheap to verify</strong>. That covers research organization, brief generation, metadata variants, internal-link candidates and mechanical QA — the parts of content work that are systematic and boring, and where a wrong answer is obvious in seconds. Keep people accountable for the point of view, every factual claim, the examples, and the decision to publish. Anything where being wrong is expensive and not immediately visible stays human, and stays owned by a named person.</p><h2>Which tasks can an agent actually own?</h2><p>The best candidates are repetitive, have clear inputs and outputs, and fail visibly.</p><p><strong>Research organization.</strong> An agent can group a large keyword set by topic, intent, audience or buying stage, and compare existing pages against a proposed topic map to flag gaps. This is genuinely useful and it is where I get the most time back. It also needs review, because similar wording does not mean similar intent, and the model cannot tell the difference between two phrasings that convert differently. It clusters language; you are clustering demand.</p><p><strong>Content briefs.</strong> Given a defined audience, business objective, primary query and an approved source set, an agent drafts a serviceable brief: the question the page must answer, subtopics worth covering, terminology needing a plain-language definition, internal pages that may deserve a link, and — the item I care about most — a list of claims that require a source or a subject-matter review. That last list is where an agent earns its place. Guide the writer with it. Do not let it flatten every page into the same shape, which is the failure mode when briefs get generated at volume.</p><p><strong>Metadata variants.</strong> A bounded, verifiable task with an obvious reviewer. Generate several title and description options, then have a person choose the accurate and specific one. The title should describe the content rather than repeat a keyword, which is a judgment an agent optimizes against rather than for.</p><p><strong>Internal-link candidates.</strong> Agents can compare a draft against published URLs, propose links, and find orphan pages or repeated anchor text. This works dramatically better when you feed the system page titles, summaries, canonical URLs and topic categories instead of asking it to infer meaning from URL strings. Most disappointing results I have seen came from starving the agent of context and then blaming the model. The structural side of that work is in the <a href=\"https://www.amirmousavi.com/resources/seo-architecture-checklist\">SEO architecture checklist</a>.</p><p><strong>Mechanical QA.</strong> Missing headings, unsupported claims, inconsistent product names, broken links, duplicated sections, descriptions over a length limit. These checks are valuable precisely because they are systematic and rerunnable, and because a human doing them for the fortieth time does them worse than a machine.</p><h2>Where does automation start costing you money?</h2><p>When the task depends on experience, accountability, or context that was never in the prompt.</p><p>People stay responsible for deciding whether a topic deserves a page at all, verifying factual and legal and financial and medical and technical claims, choosing examples that are real, protecting confidential and licensed material, holding a recognizable voice and a defensible point of view, and confirming the page satisfies a reader rather than a scoring tool.</p><p>The trap is quality-shaped rather than error-shaped, and that is what makes it dangerous. An article can be clean, well structured, on topic, and still worth nothing — generic summaries, plausible invented examples, confident unsupported statements. None of those trip a QA check. All of them create editorial debt that surfaces months later, when someone asks where a number came from and the answer is that a model produced it.</p><p>Google’s own position here is narrower than either camp claims. Its guidance has focused on the quality of content rather than how it was produced, while its spam policies name scaled content abuse — generating many pages primarily to manipulate rankings, regardless of how they were generated — as a violation. Read together, those two positions say something specific and easy to act on: automation is not the problem, and volume without purpose is.</p><h2>The workflow I actually run</h2><p>Six steps, and the separation between planning, drafting and validation is the part that does the work.</p><ol>\n<li><strong>Define the page.</strong> Audience, search intent, business purpose, primary question, desired action. Written down before any generation, because an agent will happily fill an undefined brief with something average.</li>\n<li><strong>Provide approved sources.</strong> First-party documentation, expert notes, and only sources the writer is permitted to use. An agent with no source set will substitute its training data and will not tell you it did.</li>\n<li><strong>Generate a brief.</strong> Ask for coverage gaps, questions, entities and internal-link candidates. Ask explicitly for the claims that need verification.</li>\n<li><strong>Draft under explicit constraints.</strong> Require the draft to mark uncertain claims and forbid inventing experience or data. This instruction does not fully work, which is why step five exists.</li>\n<li><strong>Run independent checks.</strong> A separate pass — separate context — for factual consistency, duplication, links, headings and metadata. Checking a draft in the conversation that produced it is theatre; the model is now invested in its own output.</li>\n<li><strong>Human review with a name attached.</strong> A named editor approves the content and owns corrections after publication. Not &quot;the team.&quot; A person.</li>\n</ol><p>This fits inside the broader <a href=\"https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack\">MarTech planning process</a>: define the job first, then decide where automation removes effort rather than relocating it.</p><h2>How do you tell whether it is working?</h2><p>Not by articles per week. That number always improves, which is precisely why it is the wrong metric.</p><p>Track time from approved idea to publication, editor revision time, factual corrections after publication, organic impressions and qualified visits, engagement with the next useful page, conversion quality, and the share of content that goes stale or redundant.</p><p>Then apply the diagnostic that matters: if output rises while revision time, corrections and content overlap also rise, the automation moved work rather than removing it. That is not a failure of the tools. It is a workflow that pushed effort downstream onto editors, who are more expensive than the tokens you saved.</p><p>One measurement trap belongs here specifically. AI visibility scores from commercial tools are single samples of a non-deterministic system, so they cannot tell you whether an agent-assisted page worked. Before trusting one, ask for the sample size, the prompt set and the run-to-run variance; and for numbers that can actually be verified, use the four first-party systems in <a href=\"https://www.amirmousavi.com/articles/how-to-measure-ai-search-traffic\">how to measure AI search traffic</a>.</p><h2>My working take</h2><p>Use an agent when the task is structured, reversible and easy to verify. Add review weight when output touches reputation, customer decisions or technical accuracy. Keep a person accountable for every published page, and keep that person’s name attached to it.</p><p>The durable advantage was never automatic writing, and I think the people selling that are describing a product rather than a workflow. It is a content operation where automation absorbs the repeatable mechanics and people supply evidence, judgment and expertise — the two things that remain scarce, and the two things a reader can tell are missing even when they cannot say why.</p><p>The honest summary of my experience: agents made my research and QA meaningfully faster and made my drafting slightly worse until I stopped asking them to draft the parts that required a point of view. That was the whole lesson, and it cost me a few months to learn.</p><h2>Frequently asked questions about AI agents for SEO content</h2><h3>Can AI agents write SEO content that ranks?</h3><p>Sometimes, and that is the wrong bar. Google’s guidance has focused on content quality rather than production method, while its spam policies treat scaled content abuse as a violation. Pages that answer a real question with real evidence can rank whether or not an agent helped build them; pages generated in volume to fill a keyword map are the documented risk.</p><h3>Which SEO tasks should never be automated?</h3><p>Deciding whether a topic deserves a page, verifying factual or regulated claims, choosing real examples, protecting confidential or licensed material, and the decision to publish. The rule underneath all five: if being wrong is expensive and not immediately visible, keep it human.</p><h3>How do I stop an AI agent from inventing facts?</h3><p>You cannot, entirely. You can reduce it by supplying an approved source set, requiring the draft to mark uncertain claims, and running verification in a separate pass with separate context. Checking a draft inside the conversation that produced it is the single most common mistake I see.</p><h3>Does Google penalize AI-generated content?</h3><p>Not for being AI-generated. Google’s stated focus is on content quality rather than how content is produced, and its spam policies target scaled content abuse — producing many pages primarily to manipulate search rankings, however they were made. The distinction is purpose and quality, not authorship.</p><h3>What is the best first task to automate in content work?</h3><p>Research organization and mechanical QA, in that order. Both are systematic, both fail visibly, neither touches judgment, and both give back time immediately. Drafting is the last thing I would automate, not the first, which is the reverse of how most teams start.</p><h3>How many articles per week should an AI-assisted workflow produce?</h3><p>Fewer than the tooling makes possible. If revision time and post-publication corrections rise alongside output, the workflow is transferring cost to editors, and the honest response is to slow down rather than to add another agent.</p><h2>Sources and method</h2><p>Verified at source: July 29, 2026.</p><p>The workflow above is my own, and the judgments about where agents fail come from running it rather than from a study. Google’s documented positions, which I have paraphrased rather than quoted where I could not verify exact current wording:</p><ul>\n<li><a href=\"https://developers.google.com/search/docs/essentials/spam-policies\">Google Search Central: spam policies, including scaled content abuse</a></li>\n<li><a href=\"https://developers.google.com/search/blog/2023/02/google-search-and-ai-content\">Google Search Central: Google Search and AI-generated content</a></li>\n<li><a href=\"https://developers.google.com/search/docs/fundamentals/creating-helpful-content\">Google Search Central: creating helpful, reliable, people-first content</a></li>\n<li><a href=\"https://developers.google.com/search/docs/fundamentals/ai-optimization-guide\">Google Search Central: optimizing for generative AI features</a></li>\n</ul><p>I have not included the productivity statistics that circulate about AI content workflows. The ones I tried to trace measured output volume, which is the metric this article argues against using.</p>\n",
            "url": "https://www.amirmousavi.com/articles/ai-agents-for-seo-content",
            "title": "AI Agents for SEO Content: Where Automation Helps",
            "summary": "Which parts of an SEO content workflow an AI agent can own, which parts it must not, and the one test that separates them: is the task verifiable and reversible?",
            "date_modified": "2026-01-09T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "AI agents",
                "SEO content",
                "content operations",
                "automation"
            ]
        },
        {
            "id": "https://www.amirmousavi.com/articles/wordpress-to-headless",
            "content_html": "<p>Almost nobody asks me whether to move off WordPress. They ask me to confirm a decision somebody has already made, usually shortly after seeing a demo site that loaded instantly.</p><p>So I have started answering a different question first: what is broken today, and would this migration fix that specific thing? Most of the time the honest answer is that the site is slow because of how it was built, not because of what it was built with. A rebuild on a headless stack fixes that by accident, and charges you for the accident by moving a dozen SEO and editorial responsibilities out of a plugin and into your own engineering backlog.</p><p>That trade is the whole decision, and it is the one item never on the slide.</p><h2>Quick answer</h2><p>Move to a headless CMS when you have a documented requirement that only headless satisfies: structured content reused across several channels, custom application behaviour around the content, front-end release cycles that must run independently of publishing, or integration control a plugin cannot give you. Do not move for speed or for SEO. Both are properties of the implementation, not of the architecture. What you reliably gain in a headless build is ownership: canonicals, hreflang, sitemaps, redirects, metadata fields, structured data and preview all become engineering work that somebody on your team now maintains.</p><h2>What actually breaks in a headless migration?</h2><p>Not the rendering. The rendering is the part everyone tests.</p><p>What breaks is the set of things WordPress was quietly doing for you, each of which had an owner in the plugin ecosystem and now has no owner at all. I have watched migrations ship on schedule, look better, score better in a lab test, and still lose organic visibility for two quarters, because the redirect map was assembled from the sitemap rather than from the pages that actually earned links, and because nobody was assigned the words &quot;canonical tag&quot; as a job.</p><p>The pattern is consistent enough that I now treat it as the default risk rather than an edge case. A visually successful migration and a commercially successful migration are different events, and they are separated by roughly six weeks of unglamorous work that gets cut when the launch date compresses.</p><h2>Is a headless CMS faster than WordPress?</h2><p>Sometimes, and not because it is headless.</p><p>Headless builds are often fast because of choices that travel with them: static generation, edge caching, disciplined asset handling, a modern framework. Those same builds get slow through client-side rendering, oversized JavaScript bundles, third-party scripts and chatty API calls. I have seen headless sites lose to a well-tuned WordPress install on real devices, which is the only measurement that pays.</p><p>WordPress sites do suffer from heavy themes and plugin overhead. Those are implementation problems. Google’s own guidance on JavaScript-based sites exists precisely because a modern front end can be built in a way that makes content harder to crawl and render, not easier, and Core Web Vitals are field measurements of a specific build rather than a property of a category.</p><p>Judge either option on the same seven things:</p><ul>\n<li>server response time and the caching strategy behind it;</li>\n<li>whether meaningful HTML exists without client-side execution;</li>\n<li>image and font delivery;</li>\n<li>the JavaScript cost on a mid-range phone, not a laptop;</li>\n<li>third-party scripts, which are usually the real problem;</li>\n<li>Core Web Vitals from field data on real devices;</li>\n<li>content freshness and how cache invalidation actually works when an editor fixes a typo at 4pm.</li>\n</ul><p>Pick the architecture your team can hold at that standard for two years. Both can pass. Only one of them will, in your organization, and that depends on staffing rather than on technology.</p><h2>What SEO work moves onto your team?</h2><p>This is the section I wish people read before signing.</p><p>In WordPress, plugins supply canonical tags, XML sitemaps, redirects, schema controls, social metadata and editor-facing title and description fields. In a headless build, your product team designs, builds, tests and maintains all of it. None of that is difficult. All of it is work, and unassigned work does not happen.</p><p>A migration plan needs an owner’s name against every line of this list:</p><ul>\n<li>stable URLs, or a redirect map built from pages that hold links and rankings;</li>\n<li>canonical rules, including what happens with parameters and pagination;</li>\n<li>hreflang, if you are multilingual, which is where I see the most silent breakage;</li>\n<li>index and follow controls, and a way to verify them in production;</li>\n<li>title and meta-description fields editors can actually edit;</li>\n<li>structured data, generated from content rather than hand-maintained;</li>\n<li>XML sitemaps and robots directives that update when content does;</li>\n<li>pagination and archive handling;</li>\n<li>image metadata and alt text in the editing interface;</li>\n<li>preview and staging protection, so drafts never get indexed;</li>\n<li>404 and redirect monitoring after launch, for at least a quarter.</li>\n</ul><p>If those eleven lines have no names next to them, the migration has an SEO plan in the same sense that an unassigned task has a due date.</p><h2>Why does the editorial problem get discovered late?</h2><p>Because the people who evaluate a headless CMS are rarely the people who will use it every day.</p><p>Structured editing demos beautifully. What does not demo is previewing a draft that composes content across several front ends, or an editor fixing a live pricing error on a Friday afternoon without opening a pull request. That second scenario is the one that determines whether your content team trusts the platform, and it is almost never in the evaluation.</p><p>Before you migrate, make a real editor — not a developer, and not the person championing the project — complete these tasks on the candidate platform:</p><ul>\n<li>create and schedule a draft, then find it again;</li>\n<li>compose a page from reusable components;</li>\n<li>run a localization workflow end to end;</li>\n<li>move something through approval and permissions;</li>\n<li>verify that preview matches production;</li>\n<li>upload and replace an asset;</li>\n<li>roll back a bad edit using version history;</li>\n<li>publish an urgent correction with no developer available.</li>\n</ul><p>If the last item cannot be done, you have not chosen a CMS. You have chosen a deployment pipeline with a content form attached, and you will hear about it for years.</p><h2>What does a headless build actually cost?</h2><p>More than the CMS licence, and the gap is mostly labour.</p><p>Account for front-end hosting and deployment; search, forms, redirect and preview services; monitoring and error handling; API and schema maintenance; ongoing developer support; content remodelling during migration; a security review; training and documentation; and the cost of vendor or integration changes over the next three years.</p><p>This is the same discipline I apply to any platform decision: define capabilities, data flows and ownership before choosing tools. The full version of that method is in <a href=\"https://www.amirmousavi.com/articles/how-to-think-about-a-martech-stack\">how to plan a MarTech stack</a>, and the launch-day verification lives in the <a href=\"https://www.amirmousavi.com/resources/website-launch-checklist\">website launch checklist</a>.</p><h2>A decision framework I would actually run</h2><p>Score both options against identical criteria, in this order, and write the scores down before anyone demos anything.</p><ol>\n<li><strong>Editorial workflow.</strong> Tested by editors, on real tasks, with the emergency-correction case included.</li>\n<li><strong>Performance requirements.</strong> Stated as field-data thresholds, not as a preference for a framework.</li>\n<li><strong>Multi-channel content reuse.</strong> Existing channels only. A channel somebody might build is not a requirement.</li>\n<li><strong>Application and integration complexity.</strong> How much of the site is genuinely application behaviour rather than pages.</li>\n<li><strong>SEO controls.</strong> Every line of the eleven-item list above, with an owner.</li>\n<li><strong>Localization.</strong> Including hreflang and translation workflow, which are two separate problems.</li>\n<li><strong>Security and compliance.</strong> Including who patches what, and how fast.</li>\n<li><strong>Internal engineering capacity.</strong> Measured in people who will still be here next year.</li>\n<li><strong>Operating cost.</strong> Three-year total, labour included.</li>\n<li><strong>Migration risk.</strong> Specifically: link equity, redirects, and how you would roll back.</li>\n</ol><p>If WordPress meets the requirements after targeted improvements, migrating adds cost without creating value, and the improvement work was going to be necessary either way. If the site is genuinely becoming a multi-channel product with custom application behaviour and you have engineers who will own it, headless gives you a cleaner foundation and a larger permanent maintenance surface. Both of those sentences are true at the same time.</p><h2>My working take</h2><p>The important word in this entire decision is <strong>requirement</strong>. &quot;We may need an app someday&quot; is not one. Neither is &quot;our current site feels slow,&quot; until somebody has checked whether the current site is slow for reasons a migration would address.</p><p>I am not against headless. I build on it. What I am against is treating an architecture change as a fix for problems that are actually about implementation quality, staffing and ownership, because those three problems migrate with you. They arrive in the new stack on day one, wearing better typography.</p><p>The best architecture is the one your organization can operate well six months after launch, when the launch team has moved on and someone junior needs to fix a canonical tag. A migration is justified when it resolves documented constraints. It is not justified by changing the technology label on a problem you have not diagnosed.</p><h2>Frequently asked questions about WordPress and headless CMS</h2><h3>Is a headless CMS better for SEO than WordPress?</h3><p>No. Architecture does not rank. A headless build can match or beat WordPress on every technical SEO signal, and it can also lose badly, because the capabilities WordPress plugins provide by default become features your team has to build and maintain. The deciding factor is whether the eleven SEO responsibilities listed above have named owners.</p><h3>Does moving headless improve Core Web Vitals?</h3><p>Only if the new build is engineered for it. Core Web Vitals are field measurements of one specific implementation. Static generation and edge caching help; large JavaScript bundles, client-side rendering and third-party scripts hurt, and they hurt in a headless build exactly as much as anywhere else.</p><h3>Can WordPress be used as a headless CMS?</h3><p>Yes, and it is an underrated middle path. Keeping WordPress as the editing environment while serving a separate front end preserves editorial familiarity and the plugin ecosystem for content workflow, while giving developers control over delivery. You still inherit the SEO plumbing, because the plugins that generated it are no longer rendering your pages.</p><h3>How long does a headless migration take?</h3><p>Longer than the estimate, for a reason that is predictable rather than mysterious: the estimate usually covers building the front end, and the schedule is set by content modelling, redirect mapping, SEO parity and editorial testing. Those four run in parallel with development if they were planned, and sequentially after launch if they were not.</p><h3>What is the biggest risk in a headless migration?</h3><p>Losing organic visibility through redirect and canonical mistakes that nobody notices for six weeks. It is the biggest risk because it is invisible on launch day, when everyone is looking at the design, and because recovering rankings takes considerably longer than losing them.</p><h2>Sources and method</h2><p>Verified at source: July 29, 2026.</p><p>The judgment in this piece comes from my own migration work. The factual claims about how search engines handle the mechanics rest on primary documentation rather than on vendor material:</p><ul>\n<li><a href=\"https://developers.google.com/search/docs/crawling-indexing/javascript/javascript-seo-basics\">Google Search Central: JavaScript SEO basics</a></li>\n<li><a href=\"https://developers.google.com/search/docs/crawling-indexing/consolidate-duplicate-urls\">Google Search Central: consolidate duplicate URLs with canonicals</a></li>\n<li><a href=\"https://developers.google.com/search/docs/specialty/international/localized-versions\">Google Search Central: tell Google about localized versions (hreflang)</a></li>\n<li><a href=\"https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap\">Google Search Central: build and submit a sitemap</a></li>\n<li><a href=\"https://web.dev/articles/vitals\">web.dev: Core Web Vitals</a></li>\n</ul><p>I have deliberately not included the performance benchmarks that circulate comparing headless and WordPress. The ones I tried to trace compared a tuned new build against an untuned old one, which measures the rebuild rather than the architecture.</p>\n",
            "url": "https://www.amirmousavi.com/articles/wordpress-to-headless",
            "title": "WordPress vs. Headless CMS: When to Make the Move",
            "summary": "Headless is not automatically faster or better for SEO. What actually moves onto your team during a migration, what it costs, and when staying put is stronger.",
            "date_modified": "2025-11-21T00:00:00.000Z",
            "author": {
                "name": "Amir Mousavi",
                "url": "https://www.amirmousavi.com"
            },
            "tags": [
                "WordPress",
                "headless CMS",
                "web architecture",
                "SEO"
            ]
        }
    ]
}