Separating Brain from Hands in MCP Marketing Agents

Most conversations about AI agents in marketing start with the model. Which one is smartest, which one writes the best ad copy, which one can read a GA4 report without inventing a metric. We think that is the wrong place to start.

What makes an agent safe to point at your ad accounts is not the model you picked. It is where the model's reasoning ends and its access to your systems begins.

A recent Latent Space episode gave this idea a useful name: separating the brain from the hands. The guests were Katelyn Lesse and Angela Jiang, whom Latent Space introduces as Anthropic's heads of Engineering and Product. We have been building MCP-connected marketing workflows long enough to recognise the pattern. It is the clearest way we know to explain why some agent setups feel trustworthy and others feel like handing an intern the company credit card.

What the brain and the hands actually are

As Latent Space put it, their favourite mental model in the episode is the distinction between an agent's brain and its hands. Anthropic's Managed Agents keeps two things apart:

• The harness and session log. This is the loop that holds the conversation and the agent's progress.
• The sandbox. This is where code actually executes.

The harness can persist while an execution environment is created only when it is needed. If a sandbox fails, it does not have to take the whole agent session down with it.

The episode draws out two consequences.

Security. If generated code runs in a sandbox that never receives a service credential, there is no credential in that sandbox for the code to read. The episode describes credentials held separately and attached through a proxy, with controls on where sandbox traffic can go.

Reliability. The guests describe an earlier approach that put the whole coding agent in a sandbox behind an API. Starting the environment and the agent added work before the first response, and if the sandbox disappeared, so did the running agent.

Latent Space closes that section with three questions we now ask on every agent project:

1. Which parts need to survive?
2. Which parts execute untrusted work?
3. Which secrets actually need to be present where code runs?

Why marketing agents need this more than most

Anthropic's discussion is about its own platform and coding agents. A marketing agent is not usually running arbitrary code in a sandbox. The shape of the risk is the same, though, and in one respect it is sharper: marketing agents sit next to money.

A typical marketing agent does two kinds of work:

• It reads. It pulls from analytics, usually GA4 through the BigQuery export, and from ad platform reporting.
• It acts. It changes something: a budget, a bid strategy, a campaign status, a tag.

Reading is low stakes. A bad query wastes a few seconds. Writing changes spend, and spend is hard to undo.

The brain-and-hands lens helps because it makes you treat the model's output the way Anthropic treats generated code: as untrusted until something outside the model checks it.

That matters in marketing for a specific reason. The data an agent reads is full of text that someone else wrote: campaign names, search terms, landing page titles, UTM values. A model that reads that text and also holds the keys to act on it is the setup you want to avoid.

Walking through a GA4 and Google Ads agent

Here is how we would lay out a simple analysis agent that can eventually take action.

The brain. Claude, running in a conversation or a harness. Its job is to interpret the question, plan the queries, reconcile the numbers and propose a next step. It holds no credentials. It knows what tools exist and what they return, nothing more.

Hand one: GA4 via BigQuery. An MCP server that exposes query tools over the GA4 export dataset. It is read-only and scoped to the datasets the agent genuinely needs. The service account lives with the server, not in the model's context. We wrote about the querying side of this in our piece on conversational agents over GA4 BigQuery exports, including why the raw event schema needs some guidance before a model can query it reliably.

Hand two: Google Ads reporting. A separate MCP server exposing reporting tools: campaign performance, search terms, budgets. It is also read-only by default.

Hand three: gated write actions. If the agent is allowed to act, those tools sit behind their own server or their own permission set. Every call goes through an approval step a human signs off on. This hand should be the easiest one to switch off.

Now run a real question through it: why did paid search conversions drop last week?

1. The brain plans the investigation. It decides to compare GA4 conversions by source and medium against Google Ads reported conversions over the same window.
2. Hand one runs the BigQuery query and returns rows.
3. Hand two returns campaign-level performance.
4. The brain reconciles the two and checks whether the gap is a tracking problem or a performance problem.
5. If it is performance, the brain proposes a change.
6. A person reviews the proposal. Only then does hand three execute it.

At no point did the model see an OAuth token or a service account key. At no point could text inside a search term report trigger a budget change on its own. That is the brain-and-hands property, translated into marketing.

Swapping the brain without rewiring the hands

The second benefit is less dramatic but saves more time: you can change the brain without touching the hands.

Because MCP gives tools a standard interface, the GA4 server and the Ads server do not care which model calls them. When a new model arrives, you point it at the same tools and run the same tasks. You can then judge it on your own work rather than on a leaderboard.

The episode makes the same point from Anthropic's side. Early-access customers run evaluations in their own harnesses and report surprising behaviour. Latent Space notes that the useful part is not just a benchmark score but seeing the model in environments Anthropic's own products do not cover. In the publication's words, "having good evals is golden."

There is a warning in there too. The episode mentions that protecting model reasoning against extraction meant preserving thinking blocks across turns. A new requirement like that can break a customer's existing harness. Model upgrades change things at the brain layer. If your credentials, scopes and approval logic live in the hands, an upgrade can break the conversation loop without touching your access controls.

The hands are reusable in the other direction as well. An MCP server built for one workflow becomes a building block for the next. We showed that with an SEO data source in our walkthrough of running SE Ranking through an MCP server.

Where this usually goes wrong

When we review agent setups, the failures are rarely about the model being wrong. They are about the brain and the hands being fused.

• One server with every permission. A single connector that can read analytics, edit campaigns and publish tag changes makes every mistake as large as possible. Split by system and by read versus write.
• Credentials in the prompt or the agent's environment. If the model can see a key, assume it can leak it. Keys belong with the tool layer.
• Write tools exposed by default. Start every agent read-only. Add write tools deliberately, one at a time, with approval in front of them.
• Treating tool output as trusted instructions. Data coming back from GA4 or an ad platform is content to analyse, not commands to follow.
• Forgetting GTM is a write surface. An agent that can edit a container can change what you measure. If your containers are already in flux, for example while you audit them ahead of the Google tag and GTM merge, keep agent access to read-only.

A short checklist before you connect an agent to ad spend

Adapted from the three Latent Space questions:

• What needs to survive? The conversation, the plan and the audit trail of what the agent proposed and what a person approved. Store them outside any single tool call.
• What executes untrusted work? Anything that acts on model output: queries, API calls, tag edits. Give each one the narrowest scope that still does the job.
• Which secrets need to be present? Only those the tool layer uses, held by the MCP server. The model should need none.
• Can you swap the model tomorrow? If changing models would mean rewriting your integrations, the brain and the hands are still tangled.
• Do you have your own evals? Keep a handful of real questions with known answers from your GA4 and Ads data. Run them whenever anything changes.

The implementation will differ from Anthropic's, and it should. A marketing team does not need a managed sandbox platform to benefit from the idea. It needs a clear line between the part that thinks and the part that touches your accounts.

If you are planning an MCP-connected agent for GA4, BigQuery, GTM or your ad platforms and want that line drawn properly from day one, talk to us at Bitegrico. We are happy to look at your setup and help you separate the brain from the hands before anything touches spend.