An AI agent in advertising is real when it pursues a goal by choosing its own steps, works to a written mandate, can deal with another party's agent and leaves a record that someone outside the platform can check. Anything less is automation, which can be useful, but it is not an agent. Seven tests, each with a question to ask, a good answer and a red flag, will separate the two in a single vendor meeting.

TL;DR: "AI agent" is now a label applied to everything from bid rules to chat assistants, so the claim on its own proves nothing. The seven tests below check autonomy, negotiation, mandate, open standards, decision logs, shared deal records and benchmarking. A platform does not need to pass all seven to be useful, but it should be able to say plainly which ones it passes today.

Why do ad platform claims about AI agents need testing?

The word "agent" now covers products that were sold as automation or assistants not long ago. Gartner calls this "agent washing", the rebranding of existing products that lack substantial agentic capabilities, and estimates that only about 130 of the vendors offering agentic AI are real, as ExchangeWire reported in September 2025. The same article notes that many companies in advertising have repositioned existing platforms as agentic AI.

A mislabelled product puts the risk on the buyer. A team that believes it has an agent may relax the checks it would apply to a rules engine, and a team that believes it has a rules engine may never ask who is answerable for the agent's choices.

What separates an AI agent from ordinary automation?

Anthropic's guide to building effective agents draws the clearest line. "Workflows are systems where LLMs and tools are orchestrated through predefined code paths," it says, whereas agents "are systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks."

A workflow is not a lesser product. The same Anthropic guide says workflows offer predictability and consistency for well-defined tasks, while agents suit open-ended problems where the number of steps cannot be predicted in advance. Testing is about matching the label to what the software does, not rewarding the most autonomous system.

As a worked example, Alkimi structures agent permissions as five stages of earned autonomy: Observe, Recommend, Draft, Human-approved action and Bounded automatic action. Its Gym lets buyers and sellers build their own agents, set the rules those agents work to and spar against counterparty agents before any real money moves. The seven tests apply to that setup in the same way as to any other platform.

Test 1: Does the agent act, or only recommend?

What to ask: for each task the platform says its agent handles, which stage is it at today, and who decides when it moves up? The five stages of earned autonomy give a shared vocabulary, from an agent that only observes to one that takes bounded actions on its own within a mandate.

Good answer: the stage is named task by task, for example drafting a deal proposal but needing human approval to commit spend. A human operator, not the agent, decides when autonomy expands.

Red flag: "fully autonomous" with no stage attached, or a product that cannot do anything without a person clicking through every step. The second may be sound, but it is a recommendation engine and should be bought as one.

Test 2: Can it negotiate with a counterparty agent?

What to ask: can the vendor show a recorded exchange in which its agent dealt with an agent it does not control, over more than one round? Agent-to-agent messaging now has open standards, including the Agent2Agent (A2A) Protocol, an open standard for communication and collaboration between AI agents that has been donated to the Linux Foundation.

Good answer: a transcript or log showing an offer, a counter-offer and a reasoned decision to accept, amend or walk away. The counterparty should be a separate system, not a second module inside the same platform.

Red flag: "negotiation" that turns out to mean adjusting bids in an auction or matching against a price floor. Bid optimisation has value, but there is no counterparty on the other side of it.

Test 3: Does it work to a written mandate?

What to ask: can the buyer see, export and version the mandate the agent works to? A mandate is the written set of limits an agent operates within, such as budget, price ceilings, brand suitability rules and the deal terms that need human sign-off. AgenticAdvertising.org puts the risk plainly on its AdCP site: "Without governance, agents optimize for whatever metric they're pointed at."

Good answer: a document. Each decision the agent makes traces back to a specific mandate version, and anything outside the mandate triggers an escalation to a named person.

Red flag: rules that live only in a settings screen nobody can export, or a claim that the model "learns what the advertiser wants" without any written limits.

Test 4: Does it support open standards, and which parts?

What to ask: which standards does the agent implement, at which version, through which components, and what is live versus planned? AAMP, IAB Tech Lab's Agentic Advertising Management Protocols, is the umbrella for Tech Lab's agentic work and includes buyer and seller agent reference implementations and the OpenProposal specification. AdCP, the Ad Context Protocol published by AgenticAdvertising.org, is an open protocol that lets AI agents discover, plan, buy, sell and measure media, and its version 3.2 is generally available.

Alongside them sit A2A for agent-to-agent messaging and the Model Context Protocol (MCP), an open-source standard for connecting AI applications to external systems.

Good answer: a named standard, a named component and a clear line between what runs in production today and what is on a roadmap. A platform that works within one standard and is building towards another should say exactly that.

Red flag: "compatible with every standard" with no version or component named. A breadth claim without specifics is an announcement, not an integration.

Test 5: Can you see its decision log?

What to ask: for any single decision, can the buyer see what the agent knew, which options it weighed, which mandate version applied and why it chose as it did? Anthropic lists transparency among its three core principles for building agents, advising teams to "Prioritize transparency by explicitly showing the agent's planning steps."

Good answer: a per-decision log that can be exported and read by someone who was not in the room. It records escalations and human approvals as well as the agent's own steps.

Red flag: a performance dashboard offered in place of a log. Results show what happened, but only a log shows why.

Test 6: Is there a shared record of what was agreed?

What to ask: when the agent closes a deal, where is the agreed record kept, and can the other party retrieve the same record independently? A decision log explains one side's reasoning, whereas a shared deal record settles what both sides agreed.

Good answer: a record written at the moment of agreement, timestamped and held by both parties, so either side can check it without asking the other. That record becomes the reference point for delivery, invoicing and any dispute.

Red flag: each side keeps its own logs and reconciles them afterwards. Two private records of the same deal can drift apart, and neither party can prove which one is right.

Test 7: Has it been benchmarked against real counterparties?

What to ask: has the agent been tested in a controlled market against agents it does not control, and are the results published with their denominators? A demo shows that an agent can finish one task, while a benchmark shows how often it finishes and how well.

Good answer: results that separate completion from quality. In Concourse Bench v1, a published benchmark of AI buying agents (see the disclosure below), 55 of 96 registered attempts completed a buy, yet 95 of 110 signed contracts promised a viewability floor below 70%. Closing a deal and protecting the buyer are different results, and a useful benchmark reports both.

Red flag: a single success rate with no denominator, no counterparty and no definition of success.

How should a marketing manager use the seven tests?

Run them in one meeting and write down each answer word for word. Tests one to three show whether the product is an agent at all, and tests four to seven show whether anyone else can check its work. A fuller procurement view sits in how to evaluate an agentic advertising platform.

Frequently asked questions

What is agent washing?

Agent washing is Gartner's term for rebranding existing products, such as assistants and chatbots, as agents when they lack substantial agentic capabilities. The seven tests above are a practical way to check for it in advertising.

What advertising platforms are using AI agents?

Many buy-side and sell-side platforms now describe products as AI agents, but the label covers very different levels of autonomy. Putting the same seven tests to each gives a fairer comparison than any list of names.

Does an agent need to pass all seven tests?

Not necessarily, because a recommend-only tool can be valuable early on. What matters is that the vendor states plainly which tests it passes today.

Which open standards should an advertising agent support?

AAMP from IAB Tech Lab and AdCP from AgenticAdvertising.org are the two advertising-specific standards to ask about, with A2A and MCP covering agent messaging and tool access. A useful answer names the version and the component, not just the acronym.

How does the worked example map to the seven tests?

Alkimi, the worked example above, is an enterprise platform for agentic advertising with three products. Concourse is its live benchmarking product for AI media-buying agents, so the Bench v1 figures in test seven are first-party data. The Gym is the practice ground described above, where agents meet counterparties before real money moves.

The Marketplace is neutral: it works within IAB Tech Lab's AAMP framework today, is being built to be AdCP compatible, runs AAMP identity checks and leaves humans with approval rights at deal level. Its DealSheet is the kind of shared record described in test six, written at agreement, timestamped, held by both parties and retrievable by either side independently. The team also filed comments and change requests during the OpenProposal v3.0 public comment period, which runs until 10 November 2026 after an extension.

Is It Really an AI Agent? 7 Tests for Any Ad Platform's Claims