Marketing automation as a constrained decision system: an event-driven design

1Context and motivation

Most marketing automation is organised around campaigns. Audiences are computed in batch, a schedule decides when messages go out, and rules decide who receives what. Three weaknesses follow from that shape.

First, rules built on observed correlation confuse who would have bought anyway with who was moved by the message. Confounding of this kind is the central problem of causal inference¹, and a campaign engine has no place to represent it. Second, the constraints that matter to a recipient (how often they are contacted, whether they consented, whether a group of customers is systematically left out) are checked after the fact, if at all. Third, segments go stale between batch runs, so the system acts on yesterday's state of a buyer.

We propose treating each send, offer, channel and timing choice as a decision taken by a closed loop: sense events as they happen, estimate the effect of each possible action, choose under explicit constraints, act, and record enough to audit the choice later. The rest of this paper describes that loop as a worked design. We name its two halves the Marketing Decision Fabric (MDF), which turns events into trustworthy signals, and the Execution Mesh (EM), which turns signals into constrained actions.

2Design principles

The design follows six principles, each of which constrains the components below.

• Event first. Every meaningful state change is an event with a schema contract and consent and residency flags attached at ingest.
• Causal preference. Where the question is "what would this message change", the system prefers effect estimates from experiments or quasi-experiments over correlational scores^{1, 2}.
• Constraints on the decision path. Consent, frequency, exposure and latency limits are evaluated before each action, not reported afterwards.
• Human review for high-impact changes. Policy changes above an impact threshold set by the operator need sign-off, and every recommendation carries an explanation³.
• Several objectives at once. Conversion, margin, cost to serve, fatigue and trust are scored jointly; no single metric is optimised alone.
• Traceability. Every action can be traced back to the events, features, model version and policy version that produced it⁴.

3Architecture

3.1Marketing Decision Fabric

Ingest and contracts. Events arrive on a streaming bus and are validated against a schema registry. Each event carries consent and residency tags, an idempotency key and an event time. Stream processing must cope with duplicates and late arrivals; the design uses idempotent consumers and event-time windows with watermarks, standard techniques for data systems of this kind⁵.

Signal store. Features are served online and offline from the same definitions so that a model is trained on what it will see in production. Each feature records its lineage and a freshness target set per signal.

Signal quality monitors. Each critical field is monitored for null rate, volume anomalies and distribution drift. Drift is measured as the Kullback-Leibler divergence between the current window and a trailing baseline⁶. Alert and rollback thresholds are configuration, set per signal by the operator; we do not propose universal values.

3.2Execution Mesh

Causal services. These estimate the effect of an action rather than the probability of an outcome. Heterogeneous effects across customer groups are estimated with methods that give valid confidence intervals per subgroup, such as honest causal trees². Where a market cannot be randomised, synthetic controls build a weighted comparison from untreated units⁷.

Predictive models. Gradient-boosted trees handle tabular features⁸. Sequence models based on the Transformer architecture⁹ handle ordered behavioural events when the decision's latency budget allows them; otherwise the system falls back to the tree model.

Policy engine. Offer, creative and timing choices are made by contextual bandits, which learn from the reward of the chosen action only¹⁰. Multi-step journeys (channel, then timing, then offer) are planned with linear or quadratic solvers that enforce spend, inventory and capacity limits.

Safety layer. Before any action leaves the system, it checks consent and residency, frequency caps, exposure constraints and the remaining latency budget. A failed check returns a safe default, never an error to the recipient.

Action connectors. Email, push, in-app, SMS, on-site modules and partner APIs, each with a rollback path and cached fallbacks.

4Signals

The design groups signals into four families, each with its own freshness and quality expectations.

• Behaviour and intent: search queries and reformulations, clickstream, cart edits, wishlists and abandonment, plus session context (device, locale, referral, recency).
• Channel and delivery: opens, clicks, delivery errors, send-time and frequency histories, and fatigue markers such as engagement decay and complaints.
• Commerce and operations: inventory exposure and delivery-promise accuracy, prices and discounts, payment declines and retries, refunds and support contacts.
• External: exchange rates, holidays and local events, and search-trend indices.

Two cautions from the literature shape how these are used. Search-volume data can improve short-term forecasts of economic activity¹¹, but a model built on search trends alone can drift badly when the behaviour behind the searches changes¹². External trend signals therefore enter as features alongside first-party behaviour, never as the sole driver of a decision.

The meaning of a behavioural signal also depends on the buyer's stage. In a field experiment, Lambrecht and Tucker found that ads showing the exact products a consumer had viewed were on average less effective than generic ads, and became more effective once the consumer's preferences had narrowed, for example after visiting a review site¹³. The design therefore treats message specificity as a decision variable that depends on lifecycle state, not as a constant.

5Estimation

5.1Effects, not scores

The causal services answer one question per candidate action: what is the expected difference in outcome if this recipient receives this action rather than the default? Subgroup estimates come with intervals², and a policy acts on an estimate only when its interval excludes zero by a margin the operator sets. Where no experiment is possible, synthetic controls with placebo checks give a comparison for a whole market⁷.

5.2Experiments

Experiments remain the reference standard for effect estimates⁴. Two techniques make them practical in a system that decides continuously. Variance reduction using pre-experiment covariates (CUPED) lets an experiment reach a given precision with less traffic¹⁴. Always-valid inference permits continuous monitoring without inflating false positives through repeated peeking¹⁵.

5.3Forecasts and explanations

Time-series models provide baselines for send volume, response rates and latency, against which anomalies are judged¹⁶. For operators, SHAP attributions on the tree models show which features drove a recommendation³, and influence-shift alerts fire when the top drivers of a model change between periods.

6Decision policies and constraints

6.1Bandits with exposure constraints

Contextual bandits allocate offers, creatives and send times. Exploration is reduced for groups with sparse data and suppressed for recipients in sensitive lifecycle states. A pure reward-maximising bandit can starve some options of exposure; one formal response is to require that each option receives at least a given share of pulls, which Patil and colleagues analyse as a fairness-constrained bandit with bounded regret¹⁷. Our design applies the same idea to exposure across customer groups and regions: a policy that would push a group's exposure below its floor is held for review.

6.2Journey planning

Journeys are policies, not templates. Each step re-reads current signals and re-runs the on-path checks (consent, frequency, exposure, latency) before it acts. Eligibility filters for age, legal restrictions and regional policy are applied before any optimisation.

6.3Feedback regulation

Short spikes in response can make a bandit swing exposure sharply. The design damps this with a feedback regulator in the spirit of the adjustment schemes of statistical process control¹⁶: exposure changes are smoothed, and rising fatigue signals throttle frequency automatically.

6.4Lifecycle states

Recipients are modelled as a state machine (awareness, consideration, evaluation, purchase, loyalty, churn risk) with transitions triggered by events. Each state has its own policy for message type, offer, channel and cadence. Churn-risk and dispute states favour service messages over offers, since trust in the seller is a documented driver of online purchase intention¹⁸.

7Governance, privacy and observability

Every decision is logged with a request ID that links ingest, features, model version, policy version and rendered action. An experiment registry holds each hypothesis, its primary and guardrail metrics and its rollback criteria before launch⁴. Incident playbooks cover data quality, drift, exposure breaches, latency and fatigue.

Consent and residency are enforced at ingest and again at decision time; opt-outs take effect on the decision path. Data minimisation maps every signal to the decisions that use it, and unused fields are removed. When aggregate results are shared with partners, differential privacy offers a formal bound on what the release reveals about any one person¹⁹. The design also excludes manipulative patterns (false urgency, hidden opt-outs) as a matter of policy; we cite no source for that rule because it is our choice, not a finding.

8Design summary

Table 1 lists each component, the problem it addresses, and where the supporting evidence comes from. It is a map of the argument, not a result.

Component	Problem addressed	Evidence
Event intake with contracts	Duplicates, late events, schema breaks	5
Drift monitors	Silent change in input distributions	6
Heterogeneous effect estimation	Correlation mistaken for effect	1, 2
Synthetic controls	Markets that cannot be randomised	7
CUPED and always-valid tests	Slow or biased experiment readouts	14, 15
Contextual bandits	Allocation under uncertainty	10
Exposure floors	Options or groups starved of exposure	17
Feedback regulator	Over-reaction to short spikes	16
Stage-dependent message specificity	Specific messages shown too early	13
Trust-first states	Offers sent during disputes or churn risk	18
Trend signals as features only	Over-reliance on search trends	11, 12
Private aggregate reporting	Disclosure through partner reports	19

Source: our design, with the works cited in the table.

9Evaluation protocol

We have not measured this design. Before any statement of effect, it would need the following.

• Offline: calibration of the predictive models, sensitivity of the effect estimates to unobserved confounding, and placebo tests for every synthetic control⁷.
• Online: pre-registered experiments comparing the decision loop with a campaign-style baseline, analysed with always-valid inference¹⁵ and CUPED¹⁴, with guardrail metrics for latency, unsubscribe rate, complaints and exposure across groups⁴.
• Replay: simulations of outages, traffic spikes and regulatory changes against recorded event streams.

A hypothetical illustration of the intended behaviour: a store whose payment provider starts declining a card type would see the decline rate rise in the commerce signals; the policy for affected recipients would then switch from a discount message to a message offering another payment method. Whether that switch recovers orders is exactly what the online protocol would have to measure.

10Limitations

• No measurements. Every claim about the design's behaviour is an argument from its structure and from the cited work. We report no effect sizes, latencies or availability figures.
• Unobserved confounding. Effect estimates from observational data rest on assumptions that cannot be fully tested¹; natural experiments are uneven across markets.
• Sparse groups. Small customer groups produce wide intervals, so the policy defaults to standard messages for them; that protects them from bad personalisation but also withholds good personalisation.
• Attribution across touches. Multi-step journeys blur which step caused an outcome. The design does not solve multi-touch attribution.
• Fairness definition. Exposure floors are one definition of fairness. They do not ensure equal effect across groups, and the right definition depends on context and law.
• Operator burden. Explanations, review gates and playbooks add work. Whether operators read SHAP attributions correctly is an open human-factors question.
• Adversarial and bot traffic. Bots and spam distort behavioural signals; the design depends on upstream detection that we do not describe here.

11Conclusion

We have described marketing automation as a constrained decision loop: events with contracts, signals with quality monitors, effect estimates in place of correlational scores, and policies bound by consent, frequency, exposure and latency limits. Each component answers a known failure of campaign-style automation and draws on established methods. Whether the loop improves outcomes for recipients and merchants is a question for the evaluation protocol above, not one this paper answers.