Claude Duet for Marketers: The Approval Tiers to Write Down Before an Agent Touches Your Ad Accounts

The most useful thing Anthropic shipped with Claude Duet isn't the agent. It's the list of things the agent refuses to do.

Anthropic built four hard checkpoints into Duet. It asks before it sends a message, makes a payment, signs a document, or deletes something. Then there's a second list — actions Duet won't take even with your explicit permission. Trading securities. Moving money between your accounts. Touching someone else's account. No amount of approval unlocks those.

Strip away the rest of the launch and the whole design sits in those two lists. Duet monitors, drafts and prepares on its own, then stops at a line you drew. For a marketer that line is the interesting part — and it arrives exactly as agents start reaching into ad accounts, CRMs and spend.

For fifteen years I've watched marketing teams blur two jobs: doing the work, and owning the decision. The second doesn't delegate the way the first does. Duet makes that boundary explicit enough to argue about — which is why I'd read it as a policy template, not a tool review.

What Duet actually is

Duet launched on October 21 as a research preview: a standalone app for iOS and Android plus claude.ai. It runs on its own virtual machine with its own browser, so it keeps working when you close the laptop — and can use that browser for sites with no connector. It sends a morning briefing, then checks your connected accounts every few hours and pings you when something needs a decision. Contrast that with ChatGPT Work, where the agent sits idle until you hand it a job — Duet's pitch is that it doesn't wait.

Two details stand out. It carries over the memory, skills and connected apps already on your Claude account, so it starts with context — the same idea Meta pushed as Active Memory on the other side of the market. And it runs on Claude Opus 5.5, with Anthropic's reason being judgment rather than raw capability: the model has to decide what needs you, what can wait, and when to check in first.

The rest is connectors — 6,000-plus across the Claude ecosystem, with Stripe, HubSpot, Docusign and Shopify among the announced workflows. Investigate unpaid invoices and prepare reminders. Draft follow-ups from CRM history. Assemble agreements for signature. Notice the shape of those examples: prepare, prepare, assemble, review. Anthropic gave you a long connector list and a short action list, and every action ends at a human.

The three tiers, and what they mean for your stack

The permission model, as rendered in several launch write-ups, splits into three levels — more precise than most "ask before anything important" policies.

Tier	What Duet does	From the announcement	Where it lands in your stack
1 — On its own	Reads, drafts, prepares	Read email and messages; draft replies and documents; build reports, dashboards and decks; research and organize	Reporting, monitoring, creative drafts, QA — anything you'd happily redo by hand
2 — Draft, then ask	Prepares the work, stops for your OK	Send a message; make a payment; sign a document; delete information	Anything a client, a customer or a colleague would notice
3 — Never	Blocked even with approval	Trading securities; moving money between accounts; accessing someone else's account	Permanently out of scope — put it in the policy, not in a prompt

Underneath the action tiers sits a quieter set of rules about data. Credentials, full card and bank account numbers, and identity document numbers are never shared — the agent is instructed not to hand them over even if you ask. Health and personal-finance details need explicit consent — though your own instruction counts as consent. Before anything goes out, the system checks content sensitivity and whether consent was actually given.

The detail I'd hold onto: Duet never sees your passwords, browser cookies or connected-app credentials. Credential handling happens on separate machines. Anthropic also describes an action-approval classifier, prompt-injection defenses, and outside security testing.

Which means the architecture is the policy. The gate isn't a dialog box sitting in front of an unrestricted agent — it's a separate machine the agent doesn't hold the keys to.

Write the tiers for the ad account, not for the app

Now translate it. Take one number from your stack — the daily Google Ads budget, say — and place every action near it into one of the three tiers.

Tier 1 is everything that observes: reporting on spend, flagging pacing anomalies, drafting creative variants, checking whether CPA crossed threshold. None of it moves money.

Tier 2 is anything that moves money or becomes visible to someone else: raising a budget, issuing a refund, emailing a client about a change, pausing a campaign a client's media plan depends on. Duet prepares it, you approve it.

Tier 3 gets no exceptions. Not because you distrust the model, but because a permanent rule is cheaper to maintain than a judgement call made at 11pm.

The line people get wrong: "Email a client about a change" is Tier 2. "Email the client a draft of the change and wait" is Tier 2 wearing a Tier 1 costume — the moment the send is one tap away, it's Tier 2. The tier isn't decided by the content, it's decided by the send.

If you already run a Make.com pipeline that enriches, scores and routes leads, you've built a version of it by hand. Duet's value isn't another automation layer; it's that it exposes the tier list your existing layers were implicitly using. Routing logic in a scenario and judgment in your head can't be audited. Written as a permission policy, it can.

The economics and the access wall

Two facts kill the "deploy this to your team next week" plan.

First, access. Research preview, waitlist, US-only, Claude Pro and Max subscribers only. Team and Enterprise plans are not included at launch. Anthropic isn't selling this to companies yet — no admin console, no SLA, no client-facing version. If you run marketing for a team, this is a solo tool right now.

Second, the economics. There's no separate Duet price; it rides on the Pro ($20/month) or Max (from $100/month) subscription you already pay for. But background activity counts against the same usage allowance as your normal conversations, and Anthropic says why: Duet checks your connected accounts every few hours, because "checking nonstop would use up your plan's limits much faster." A financial model or a deck needs more model turns on top.

That is the trade nobody headlines. You're spending the tokens that fund your interactive work to fund the agent's idle time. Which makes Anthropic's tuning knob — what to flag, how often to check — a budget control disguised as a preference setting.

So the first question isn't "should I try this." It's "which of my own limits am I willing to spend on it."

Auto mode is a different thing — don't conflate them

On October 22, the day after launch, Anthropic posted that from the following week, sessions across the Claude web, desktop and mobile apps would default to "auto mode" on Pro, Max and Team plans. Instead of asking you to approve each step, an automated check blocks risky actions. Anthropic has run the same idea in Claude Code since August, where it reported the auto-mode classifier caught 89% of dangerous commands in testing, against 14% for manual approval.

That's Claude, not Duet. Duet is a separate app for now. Whether Duet inherits auto mode during the preview isn't something I could confirm from the announcement. It matters because auto mode swaps your approval gate for a classifier's opinion about what's risky — a trade worth making on Tier 1 work. On Tier 2 — the ad budget, the client email, the signed document — a classifier's 89% is not a number I want standing between my agency and a client's money.

The tier list is the durable artifact

The last three years of AI tooling for marketers has been a shopping problem: which tool, which model, which subscription. Duet is the first release that quietly turns it into a policy problem. The valuable artifact isn't the agent — it's the list of verbs it won't use without you.

That list is worth writing before you get on the waitlist, because you already know your answer. Every agent that reaches into your accounts after this inherits whatever defaults you accept. Duet will ask. The question is whether you've already decided what the answer is.

For fifteen years the hard part of marketing was never doing the work. It was knowing which decisions you were allowed to make on your own. Duet just made that the product.