Running in productionPlatforms

Campaign Creation to Delivery

From an operator composing a campaign to messages accepted by receiving providers, through a single mandatory suppression gate and a fail-closed readiness barrier.

Runtime state: The full path runs in production. The suppression gate and the fail-closed readiness barrier are in the send path, and delivery protection evaluates on a fixed tick in a live service.

Business objective: Get an approved campaign delivered without any path that can bypass suppression, and without starting a send before the system is genuinely ready.
Trigger: An operator schedules a campaign, or a scheduled campaign reaches its send time.
Inputs: Campaign definition — audience, template, sending identity, schedule
Suppression list state at send time
Sending identity readiness — the lane and its signing key
Delivery capacity available on the sending host
Outputs: Messages accepted by receiving providers
Per-recipient delivery events
Suppression additions from bounces and complaints
Campaign funnel and engagement reporting

The workflow

Campaign creation to delivered outcome

Three gates. None of them can be skipped by adding a new send path.

Human action
Compose and schedule
Audience, template, sending identity and send time.
AI / LLM
Optional drafting assistance
Subject and body drafting in the editor. Always operator-reviewed; nothing schedules itself.
Automated software
Audience resolution
Lists and segments resolved to a concrete recipient set.
Approval gate
Suppression filter
Decision point: Every send path funnels through here. Suppressed recipients are removed before anything downstream exists. Suppression is append-only in production.
Automated software
Message generation
Personalized rendering, with the mandatory unsubscribe mechanism on every outbound marketing message.
Approval gate
Readiness barrier
Decision point: Queue, cache and readiness state complete? If not, the send is refused. The gate fails closed.
Automated software
Handoff to the delivery engine
One campaign delivers from exactly one sending identity — never fanned across several for throughput.
External service
Delivery to receiving providers
Decision point: Accepted, deferred or permanently failed.
Monitoring / feedback
Delivery protection cycle
Decision point: Fourteen rules across four priority bands, on a fixed tick, decide whether to continue, throttle or pause — without waiting for a person.
Automated software
Event ingestion and bounce classification
Per-recipient lifecycle events pulled back and classified.
Data store
Suppression updated
Hard bounces and complaints append to suppression, closing the loop for the next campaign.
Human action
Operator reviews reporting
Funnel, placement and engagement.

Human action
Automated software
AI / LLM
Data store
External service
Approval gate
Monitoring / feedback

Decision points

Suppression gate — remove or proceed, per recipient. Deterministic, no exceptions, no override.
Readiness barrier — start or refuse. Fails closed: absence of a positive readiness signal is treated as not ready.
Delivery protection — continue, throttle or pause. Rule-based on live delivery signal.
Per-message outcome — accept, defer with a retry time, or fail permanently.

Responsibilities

AI / LLM

Drafting assistance for subject lines and body copy, in the editor.
Explaining an anomaly in the funnel after a deterministic monitor has flagged it.

Deterministic

Suppression filtering — every time, no model involved.
Audience resolution and message rendering.
The readiness barrier.
All fourteen delivery-protection rules and the eleven action types they can take.
Bounce and complaint classification.
Every reported number.

Human approval points

Composition and scheduling. A campaign does not send itself.
Any AI-assisted copy is reviewed before the campaign can be scheduled.
Resuming a paused campaign. Delivery protection can pause autonomously; only a person restarts.

Failure handling

Failure	Response
Readiness incomplete at send time	Refuse the send. Fail closed rather than start early.
Signing key does not match the one recorded at import	Stop before the first message rather than send unverifiable mail.
Receiving provider defers	Scheduler reschedules with backoff; the learning agent adjusts concurrency.
Permanent failure	Terminal outcome recorded; hard bounces append to suppression.
Delivery health degrades	Protection rules throttle or pause without waiting for a person.
Process interrupted mid-send	Restart replays the event log; messages with terminal outcomes are excluded automatically.
Bounce processing stops	Treated as a critical silent failure — liveness is monitored positively, not by absence of errors.

Monitoring

Queue depth and drain rate, acceptance and deferral rates per destination, protection-rule firings, bounce processing liveness, suppression list growth, and per-campaign funnel counts. The important ones are checked for movement, not for absence of errors — most failures here are silent.

Business value

This is the revenue path. Every safeguard on it exists because the alternative — a compliance breach or a reputation incident — costs more than the campaign is worth, and takes weeks to recover from.

More workflow designs

Back to the library