ACC Agent Gate

▶ Interactive demo · change the policy and watch an AI agent's Black Friday session re-run live.

A governance layer between AI agents and Adobe Campaign.

Adobe's CX Enterprise agentic tools now list Campaign Classic capabilities that include instance discovery, schema browsing, query execution, workflow control and SOAP/JS execution, reached through CX Enterprise Coworker rather than a standalone endpoint [1][2]. That is a big productivity unlock. It also means an eager agent is a few calls away from a full-table DELETE, a send without an unsubscribe link, or pausing your GDPR purge.

ACC Agent Gate sits in the middle. Every tool call is checked against a written policy before it reaches Campaign:

Everything, including what was blocked, goes into a hash-chained audit log that fails verification if any entry is edited or deleted.

What the demo shows

scenarios/black_friday_session.py replays a realistic agent session across 8 EU markets on a synthetic instance (fictional brand, invented data):

• 28 agent calls → 12 allowed, 1 masked, 1 dry-run, 5 sent for approval, 9 blocked

• 4 sends approved and executed (609,300 recipients); 931,500 held back by QA

• Defects caught before send: missing unsubscribe link (SI), no proof sign-off (AT), English price format plus a 23:30 send time (GR), no consent filter (HU)

• Agent attempts blocked: DELETE via the query tool, a 50,000-row PII export, pausing the GDPR purge, bulk consent overwrite via xtk.session.Write, an outbound HTTP "backup" of the audience

• Audit chain verifies; editing one "block" to "allow" is detected

Related MCP server: varco_mcp

Interactive showcase

docs/index.html is a self-contained page (GitHub Pages ready) that runs a JavaScript port of the gate in the browser:

• Policy lab: toggle any rule or pick a preset (Recommended, Humans only, Agent autopilot, Lockdown) and the 28-call session re-runs live, showing defective sends, PII exposure and destructive actions

• Playground: submit your own SQL, server-side JS, sends or workflow actions; approve them in an inbox with role checks and dual sign-off; each decision is SHA-256 chained in the browser

• QA board: apply fixes to failing checks and watch outcomes change

• Audit log: forge any entry and see where verification breaks

• Policy file: YAML that follows the lab, with your changes highlighted

Rebuild it with python docs/build_showcase.py after running the scenario.

Quick start

pip install -r requirements.txt
python scenarios/black_friday_session.py      # writes out/scenario.json + out/audit.jsonl
python -m acc_agent_gate.cli show out/audit.jsonl
python -m acc_agent_gate.cli verify out/audit.jsonl
python -m pytest -q                           # 24 tests

Run it as an MCP server

python -m acc_agent_gate.server               # stdio

{ "mcpServers": { "acc-agent-gate": { "command": "python", "args": ["-m", "acc_agent_gate.server"] } } }

The agent gets campaign_discover, schema_browse, query_run, delivery_qa, delivery_send, workflow_control and js_execute. Approvals are not exposed as tools. An agent can ask, but only a human can say yes.

Design principles

1. Fail closed. A tool not named in the policy is blocked.

2. Policy is a file, not a prompt. policy/default.yaml is reviewed like code. Prompts can be talked around; a YAML gate cannot.

3. Treat anything that looks like a write as a write. The analyzers use conservative pattern matching. A false positive costs one human click; a false negative costs a market.

4. Re-check at execution time. If a proof is withdrawn while a send waits for approval, the approved send is still blocked.

5. Separation of duties. Role-checked approvers, dual approval above a volume threshold, and no one approves twice.

6. Evidence over trust. Every decision carries the rule ID, the reason and a risk score, and is chained in the audit log.

Pre-send QA checks

Unsubscribe link · market legal footer · price and currency locale · marketing-consent filter · proof sign-off · local quiet hours · marketing typology · seed list · subject length ≤ 50 chars (warning). Each check maps to Adobe's own guidance in the sources below.

Repo layout

acc_agent_gate/
  gate.py           policy evaluation + controlled execution + approvals
  analyzers.py      SQL / server-side JS risk analysis
  qa.py             pre-send QA checks
  audit.py          hash-chained audit log
  mock_instance.py  synthetic Campaign instance (8 markets, deliveries, workflows, 2,400 recipients)
  server.py         MCP server exposing gated tools
  cli.py            show / verify the audit log
policy/default.yaml
scenarios/black_friday_session.py
tests/test_gate.py

Going from mock to a real instance

MockCampaignInstance is the only backend shipped. To front a real instance, implement the same methods (discover, browse_schema, query, get_delivery, send_delivery, control_workflow, execute_js) as an adapter over Campaign's SOAP API, or over whatever agent access Adobe exposes for your instance, using an operator whose operator groups and named rights grant only what the gate allows [6]. Keep the operator's own rights as the outer boundary. The gate is defence in depth, not a replacement for Campaign security.

Limitations

• The analyzers are pattern-based, not full SQL/JS parsers. They are tuned to over-block.

• The mock never evaluates JavaScript.

• Approvals are in-process. Production use needs a persistent queue and an identity provider.

Sources (Adobe Experience League, 2026)

Note: source [1] lists Campaign Classic with no direct endpoint and does not state which of its capabilities are read-only. This project assumes the worst case and gates every write-capable action.

Disclaimer

Independent project. Not affiliated with or endorsed by Adobe. All data, brands and deliveries are synthetic.

MIT licensed · Built by Sangram Ghatge