The Ethical Floor for AI Agents in PR

AI agents are arriving in PR at exactly the moment journalists have the least patience for more automation theater.

Reporters have been explicit in public about what they are seeing: irrelevant blasts, fake personalization, made-up expertise, thinly rewritten prompts, and follow-up sequences that feel less like outreach than harassment by workflow.

That is why we think this work has to be done now.

While building agentic tools for PR, we wrote down the ethical floor we think the industry needs. Not aspirational values. Constraints. Rules an AI agent can actually be made to follow. Places where the workflow should slow down, argue back, or stop.

One sentence from our internal doctrine captures the whole thing:

The user is the customer. The journalist's inbox is the commons.

That commons is easy to damage. Agents make it cheaper to damage at scale. So the industry needs a floor before it gets a slogan.

The current failure mode is easy to describe

The pattern shows up everywhere once you know what to look for.

An AI system drafts before it researches. It writes "I loved your recent article" without naming an article. It builds a 200-person media list because counting is easier than choosing. It invents a statistic rather than admitting it cannot verify one. It treats a tragedy as a timely hook because nobody encoded a line it is not allowed to cross.

Those are not edge cases. They are the default behavior of a system optimized for speed and sycophancy.

Journalists are already reacting to it. Casey Newton has complained publicly about daily AI-agent pitches and obviously AI-generated human pitches. Joni Sweet has written about daily pitch volume climbing from roughly 150 a day to 200+. Press coverage of automated PR tools and source-query bots has already started to frame them as spammy at best and fraudulent at worst.

That is the environment AI agents are walking into.

So the question is not whether a model can generate a pitch. The question is whether the system around the model produces outreach worth receiving.

1. Journalists are peers, not targets

Language creates incentives.

If the system is trained to think in terms like "lead," "prospect," "target," or "conversion," the output follows. The agent starts optimizing for activity metrics: more contacts, more follow-ups, more chances to get a reply. That frame degrades the quality of the work before a word is written.

A journalist is a professional with a beat, deadlines, judgment, and very limited attention. Good agent behavior starts there.

That means every workflow should be willing to ask a harder question than "can we send this?"

It should ask: does this actually deserve this person's attention?

That one framing change improves the output fast. The list gets smaller. The angle gets sharper. The follow-up becomes less presumptuous. The message starts to read like it was written for a working reporter instead of for an internal dashboard.

2. Volume is failure

This line from the doctrine deserves to become a category rule:

Volume borrows from future trust. Fit compounds it.

The inbox is not an ad channel. A 200-person spray is not 200 neutral attempts. It is 200 reputation events.

The math is ugly. A broad blast with a 1% reply rate might produce three replies and teach 197 journalists that the sender wastes time. Some ignore. Some mark spam. Some remember the name or domain. The next good pitch starts colder than it should.

A smaller list changes the economics. A 12-person list of reporters who actually cover the exact topic can produce the same number of replies with a fraction of the trust cost. It can also leave the right kind of memory behind: this sender knows my beat, cites real work, and does not waste my inbox.

That is why the ethical floor has to show up as instruction, not just philosophy:

• default to a small first wave
• require a reason each recipient belongs
• warn when the list gets broad
• stop when a single generic draft is being stretched across too many people

The agent should feel friction here. In PR, friction is a feature.

3. Personalization must be real

The category has been far too generous with the word personalization.

A first name is not personalization. A city is not personalization. An outlet name is not personalization. "I loved your recent article" is not personalization when there is no article in mind.

Real personalization requires a recent, specific, verifiable anchor to the journalist's work. A byline. A column. A recurring theme in reporting. A public query. A concrete thread the new angle can advance.

This is where agent design matters. An agent should be forced to do the research before it gets permission to draft. It should gather the recent bylines, confirm the beat, surface what is missing, and admit uncertainty rather than bluff its way into fake familiarity.

That is not decorative etiquette. It changes the performance of the outreach. The message becomes narrower, more useful, and much harder to dismiss as mail merge with better manners.

4. Verifiable or cut it

PR has never had creative license on facts. AI just makes factual sloppiness faster and more scalable.

This principle from the doctrine should be hard-coded everywhere:

Verifiable or cut it.

Every statistic needs a source URL. Every quote needs a real speaker. Every expert needs a real credential. Every date, title, study, and embargo needs to be real.

The important behavioral detail is what happens when the system cannot verify something.

A good agent says: I can't verify this. Strip it or give me a source.

That sentence is healthy. It is a sign the system is grounded. The opposite behavior—polished confidence on top of weak evidence—is what turns a draft into a reputational event.

Journalists have been clear that factual inaccuracy is one of their biggest concerns with AI-assisted PR. The answer is not a softer tone or a better flourish in the opening paragraph. The answer is a workflow that treats unsupported claims as defects.

5. Recency decays

Newsjacking has a clock. An agent that cannot tell time has no business claiming something is timely.

This part is easier to miss because the draft can still sound persuasive. The system remembers a story, strips the date, and pitches it as if it just happened. Or it grabs a headline that broke hours ago, assumes the angle is still live, and keeps going without checking whether the moment has already passed.

The ethical floor should require the system to know what "now" is. That means tracking when the source was fetched, when the story was published, and whether the angle is still fresh enough to justify entering somebody's inbox.

Timeliness is not an aesthetic detail. A stale hook pitched as fresh makes the sender look careless and automated.

6. Some stories are not hooks

The industry needs a line here, written plainly.

Mass casualty events are not hooks. Named individual deaths are not hooks. Hate crimes are not hooks. Child abuse is not a hook. Suicide is not a hook. Ongoing humanitarian crises are not hooks. Missing-person cases are not hooks.

There are legitimate cases where a company, subject-matter expert, or institution has standing to comment on a serious event in a way that helps public understanding. That requires a different workflow and a higher bar. It requires restraint, standing, evidence, and public value.

What it cannot become is opportunism made easier by software.

One of the strongest lines in the internal doctrine is the simplest:

This is not a hook.

That sentence needs to be available to the system, and it needs to be final.

7. Human review is not optional

AI agents should draft. They should critique. They should research. They should pressure-test. They should slow a user down when the user is about to do something stupid.

They should not auto-pitch journalists.

The doctrine says it bluntly:

I draft. You send. That's the rule.

That rule matters because the cheapest time to stop a bad pitch is before it sends. The user is tired, the news window is closing, somebody wants motion, and the model is always willing to be helpful. That is exactly when the workflow needs a hard gate.

Recipient-level previews, human confirmation, and visible warnings are not signs the product is incomplete. They are signs the product understands the cost of getting this wrong.

8. The system should argue back

A lot of AI products are built to be agreeable. That default is dangerous in PR.

A good agent should push back on a broad list. It should say a pitch is cold when there is no real personalization anchor. It should stop when the claim cannot be sourced. It should refuse tragedy opportunism. It should question a follow-up when there is no new reason to send one.

The doctrine is explicit about this:

Refuse before regret.

Hard refusals should stop the workflow. Soft pushbacks should make the trade-off visible. Users can override some things knowingly. They should not be able to override the lines that keep the channel usable.

The future of AI in PR depends on whether the systems in this category are willing to create that friction.

9. Trust is the long game

PR has always been a long-memory business. A single bad pitch can damage a relationship that took years to earn. AI does not change that. It compresses the time between mistake and consequence.

That is why the doctrine keeps returning to trust. A tool that gets a few extra sends out the door this week by lowering standards may look efficient inside the product. It is still damaging the user's reputation, the sender domain, and the broader category.

This line from the internal document should probably be on the wall of every team building AI for PR:

Optimize for the user's reputation a year from now, not the reply rate this week.

That is how a serious product should think.

The foundational work this industry needs

We are publishing this early because the category is still soft enough to shape.

AI agents in PR are going to get more capable. They will monitor breaking news, cluster angles, analyze beats, draft outreach, critique copy, and compress research that used to take hours. None of that is hypothetical anymore.

The question is what rules sit underneath those capabilities.

Without a floor, the path of least resistance is obvious: more automation, broader blasts, weaker grounding, softer definitions of personalization, thinner review, more pressure to let the system send.

With a floor, the incentives start to improve. Agents can be trained to research before drafting. They can narrow instead of widen. They can surface uncertainty instead of papering over it. They can tell the user no.

That is the foundational work we think the industry needs right now: shared constraints for how AI agents should behave when the output may land in a journalist's inbox.

The point is to help practitioners move faster without becoming sloppier.

The point is to make sure the first generation of agentic PR tools is known for judgment, grounding, and restraint instead of synthetic enthusiasm and high-volume spam.

And the point is to give the rest of the industry something concrete to react to, improve, adopt, or argue with.

That is how a standard starts.

One final line from the doctrine says the quiet part plainly:

The job is not to send as much as possible. The job is to earn attention without making the next pitch harder to trust.

We think the standard needs to start now.