Public RelationsManaged AI Agents

Public Relations AI Agents,
Monitored for Accuracy

Nestack Agent Care helps public-relations teams monitor, evaluate, and optimize AI agents used for messaging, media monitoring, drafting, and response handling — before small AI errors become reputational issues.

125failure modes
52SEV-1 failure modes
640+baseline eval cases
24/7Agent Monitoring

Scope

Public Relations AI agents we build & manage

Twelve archetypes — from media monitoring to AI-search visibility and deepfake detection.

Observability

What we make observable

Every PR agent session is traced across ten layers — what we capture and the evidence we keep.

  1. Evidence we keep
    Goalconstraintsapproval requirement
  2. Evidence we keep
    Sourceversiontimestamprelevancecitation
  3. Evidence we keep
    Planned sequenceactual sequenceworkflow status
  4. Evidence we keep
    Task statusresultretryfailure reason
  5. Evidence we keep
    Tool nameversioninputoutputpermissionresult
  6. Evidence we keep
    Model/versioninput/outputtoken usagelatencycost
  7. Evidence we keep
    Evaluation typemetricthresholdresult
  8. Evidence we keep
    Guardrail targettriggeractionenforcement result
  9. Evidence we keep
    Reviewerdecisioncorrectionreason
  10. Evidence we keep
    Outcome statusbusiness resultlinked trace

Catalog

Failure modes

Filter failure modes by where they occur in the agent lifecycle—from goals and retrieval to tools, evaluations, guardrails and outcomes.

Nothing on this page matches that. Try a layer (tool, retrieval, guardrail), a code, or a severity.

0 documented↑↓ move · ↵ open · ⌘↵ filter matrix
125 documented · select a cell to filter
42
36
33
15
13
33
52
61
21
63
PRC2-01Unapproved statements reaching media or public channelsSEV-1
PRC2-02Crisis-response factual errors under time pressureSEV-1
PRC2-03Embargo breaks — scheduled or generated content earlySEV-2
PRC2-04Defamatory or legally risky claims in draftsSEV-1
PRC2-05Off-message tone in sensitive momentsSEV-2
PRC2-06Fake-journalist social engineering — pretext extraction of unreleased infoSEV-1
PRC2-07Injection via inbound media queries and monitored contentSEV-2
PRC2-08Sentiment-monitoring misses — brewing crises scored as background noiseSEV-2
PRC2-09Misattributed quotes — executives quoted with unapproved wordsSEV-1
PRC2-10Wrong-audience distribution — internal talking points to external listsSEV-1
PRC2-11Stale boilerplate — old figures, titles and positions in fresh releasesSEV-2
PRC2-12Crisis-tier misgrading — response scaled wrong for event severitySEV-2
PRC2-13Impersonation-response failures — deepfaked exec content not flagged for rebuttalSEV-2
PRC2-14AI-provenance backlash — machine authorship itself becomes the storySEV-1
PRC2-15Undisclosed AI use unmasked post-publicationSEV-1
PRC2-16Regulatory disclosure/labeling non-compliance — EU AI Act Art. 50, FTC review ruleSEV-1
PRC2-17Fabricated spokespeople and synthetic personas in outbound contentSEV-1
PRC2-18Binding public commitments invented by public-facing agentsSEV-1
PRC2-19Unreviewed auto-curation/syndication under the brand mastheadSEV-2
PRC2-20Copyright/trademark liability in AI-generated press assetsSEV-2
PRC2-21Localization errors in machine-translated global releasesSEV-2
PRC2-22Brand-voice homogenization — drafts converge to the generic meanSEV-3
PRC2-23Workslop handoff — polished but substantively hollow deliverablesSEV-3
PRC2-24Earned-media channel collapse — pitch flooding, blacklists and AI-score bansSEV-2
PRC2-25AI-formatting fingerprints trigger journalist spam heuristicsSEV-3
PRC2-26Hallucinated media-list contacts — fabricated journalists and emailsSEV-3
PRC2-27Entity confusion — namesake contamination of monitoring metricsSEV-2
PRC2-28Bot-manufactured sentiment poisoning — fake campaigns read as public opinionSEV-1
PRC2-29Hallucinated or inverted coverage summaries in executive briefingsSEV-1
PRC2-30Satire and parody ingested as genuine coverageSEV-2
PRC2-31Alert flooding — false-positive fatigue kills the channelSEV-2
PRC2-32Structural coverage blind spots — paywalls, dark social, API lockoutsSEV-2
PRC2-33Answer-engine reputation blind spot — AI assistants misstate the brand unseenSEV-2
PRC2-34Data-void narrative capture — planted content dominates LLM retrievalSEV-2
PRC2-35Persistent memory poisoning — incl. recommendation poisoning and cross-campaign bleedSEV-1
PRC2-36Over-scoped credentials — injection-driven data exfiltrationSEV-1
PRC2-37Approval-gate bypass via consent fatigue and incremental escalationSEV-1
PRC2-38Sycophantic counsel — agent validates flawed strategy instead of challenging itSEV-2
PRC2-39Silent model-update regression — validated behavior changes overnightSEV-2
PRC2-40Multi-agent cascade amplification — upstream errors compound downstreamSEV-2
PRC2-41Long-horizon campaign degradation — reliability decays over extended tasksSEV-3

A · Media-monitoring agents

SJ-01Corpus short of the named list01 · RetrievalSEV-3
SJ-02Story built from a null set02 · ReasoningSEV-1
SJ-03Outlet wrongly named02 · ReasoningSEV-1
SJ-04Broadcast segment served03 · Tool / writeSEV-1
SJ-05Generated text sent unlabelled03 · Tool / writeSEV-2
SJ-06Extract lawful in one market only04 · OutputSEV-2
SJ-07Silent reservation flip05 · Change / VersionSEV-2

B · Statement & release drafting assistants

SL-07Quote taken in unlabelled01 · RetrievalSEV-3
SL-01Prominence inverted02 · ReasoningSEV-1
SL-03Wrong rule class applied02 · ReasoningSEV-1
SL-04Bridge that does not tie03 · Tool / writeSEV-1
SL-06Confident half-truth03 · Tool / writeSEV-2
SL-05Draft out before the wire04 · OutputSEV-2
SL-02Cautionary block carried forward05 · Change / VersionSEV-2

C · Media-inquiry triage agents

SZ-03Sender typed from the byline01 · RetrievalSEV-3
SZ-04Out-of-scope inquiry02 · ReasoningSEV-1
SZ-06One due field, four clocks02 · ReasoningSEV-1
SZ-02Unread queue dwell03 · Tool / writeSEV-1
SZ-05Approved line reissued03 · Tool / writeSEV-2
SZ-01Hand-off without the log04 · OutputSEV-2
SZ-07Free-text notes on a reporter05 · Change / VersionSEV-2

D · Crisis-communication copilots

TJ-03Raw sources bypassed for the summary01 · RetrievalSEV-3
TJ-04Negative drafted from absence02 · ReasoningSEV-1
TJ-06Materiality settled inside a summary02 · ReasoningSEV-1
TJ-02Four audiences, four scopes03 · Tool / writeSEV-1
TJ-05Issued ahead of the consultation03 · Tool / writeSEV-2
TJ-01Issued, the clearance unlogged04 · OutputSEV-2
TJ-07The correction that does not land05 · Change / VersionSEV-2

E · Social-listening agents

TL-01Sample read as the corpus01 · RetrievalSEV-3
TL-02Irony scored as outrage02 · ReasoningSEV-1
TL-03Special category arrives unasked02 · ReasoningSEV-1
TL-04Bot volume moves a decision03 · Tool / writeSEV-1
TL-05Collection crosses the public edge03 · Tool / writeSEV-2
TL-06Named in a report, never told04 · OutputSEV-2
TL-07Silent retention renewal05 · Change / VersionSEV-2

F · Journalist-pitch-matching agents

TW-01Notice never issued01 · RetrievalSEV-3
TW-03Subject line turns commercial02 · ReasoningSEV-1
TW-05Paid promotion left undisclosed02 · ReasoningSEV-1
TW-02Recipient jurisdiction unfixed03 · Tool / writeSEV-1
TW-04Offer made with no disclosure chain03 · Tool / writeSEV-2
TW-07Practitioner blocked, silently04 · OutputSEV-2
TW-06Outbound log cannot be rebuilt05 · Change / VersionSEV-2

G · AI-search-visibility (GEO) agents

UB-01Rewrite that loses retrieval01 · RetrievalSEV-3
UB-02Lift inside run variance02 · ReasoningSEV-1
UB-03Minority answer dropped02 · ReasoningSEV-1
UB-04Instruction text published03 · Tool / writeSEV-1
UB-05Public-interest text unowned03 · Tool / writeSEV-2
UB-06Read quoted without its runs04 · OutputSEV-2
UB-07Silent model swap05 · Change / VersionSEV-2

H · Misinformation & deepfake-detection agents

UD-03Absence read as evidence01 · RetrievalSEV-3
UD-04Benchmark score read as field02 · ReasoningSEV-1
UD-06Our own footage flagged fake02 · ReasoningSEV-1
UD-02Copyright asserted, none owned03 · Tool / writeSEV-1
UD-05No instrument reaches the item03 · Tool / writeSEV-2
UD-01Channel suspended for volume04 · OutputSEV-2
UD-07The put-back nobody diarised05 · Change / VersionSEV-2

I · Earned-media measurement agents

UF-04Corpus shifted, label held01 · RetrievalSEV-3
UF-01Query rewritten mid-series02 · ReasoningSEV-1
UF-06Hostile piece read as neutral02 · ReasoningSEV-1
UF-02Whole-site audience credited03 · Tool / writeSEV-1
UF-05Valuation under a new name03 · Tool / writeSEV-2
UF-03Number crosses into a filing04 · OutputSEV-2
UF-07Method changed without a note05 · Change / VersionSEV-2

J · Review-response agents

UG-01Reviewer bound to a stranger01 · RetrievalSEV-3
UG-02Empty lookup read as a fact02 · ReasoningSEV-1
UG-03Duty-bearing review misread02 · ReasoningSEV-1
UG-04Regulated fact put in the reply03 · Tool / writeSEV-1
UG-05Firm correction reads as threat03 · Tool / writeSEV-2
UG-06Named signature on a drafted reply04 · OutputSEV-2
UG-07Silent platform-rule drift05 · Change / VersionSEV-2

K · Internal-comms assistants

UJ-03Stale group list read01 · RetrievalSEV-3
UJ-04Clock run from the draft date02 · ReasoningSEV-1
UJ-06Consultation treated as closed02 · ReasoningSEV-1
UJ-02Notice put to the wrong body03 · Tool / writeSEV-1
UJ-05Staff send placed ahead of a filing03 · Tool / writeSEV-2
UJ-01Published wording narrows a channel04 · OutputSEV-2
UJ-07Read receipts on by default05 · Change / VersionSEV-2

L · Executive-comms drafting assistants

UO-01Policy ask arrives unmarked01 · RetrievalSEV-3
UO-02Material clause in a personal post02 · ReasoningSEV-1
UO-03Connection left undisclosed02 · ReasoningSEV-1
UO-04Qualifier dropped for register03 · Tool / writeSEV-1
UO-05Unsourced line about a person03 · Tool / writeSEV-2
UO-06Signed but not read04 · OutputSEV-2
UO-07Corpus learns its own output05 · Change / VersionSEV-2

Guardrails

Critical guardrails for PR agents

Ten controls that hold regardless of prompt, plan or pressure. Open one to see what it protects, what trips it, what the agent is forced to do, who may release it, and what is written to the record.

GR-01No public statement without named-spokesperson approvalOverride defined
  1. Target

    Press releases, statements, social posts and wire distributions issued under the brand

  2. Trigger

    Any outbound statement lacking a recorded approval from an authorised spokesperson or approver

  3. Action — enforced

    Platform blocks distribution; agent may circulate the draft through the approval chain, since public commitments bind

  4. Human override

    Head of communications approves per statement via the release-approval workflow

Logged evidencestatement hash · approver identity · approval timestamp · channel list · distribution id

GR-02No internal-only material on external distribution listsNo override
  1. Target

    Talking points, holding statements and internal briefings versus external media and wire lists

  2. Trigger

    Any send where content tagged internal intersects an external recipient or list

  3. Action — enforced

    Platform blocks the send at the gateway; agent may distribute only externally cleared versions

  4. Human override

    None — cannot be overridden in session

Logged evidencecontent tag · recipient list diff · blocked send id · requesting agent · timestamp

GR-03No instruction embedded in inbound media queries ever executedNo override
  1. Target

    Journalist emails, monitored social content, coverage feeds and inbound pitch replies

  2. Trigger

    Imperative or tool-directed language detected inside any externally sourced content under processing

  3. Action — enforced

    Platform strips and quarantines the instruction; agent treats the content as inert text for analysis only

  4. Human override

    None — cannot be overridden in session

Logged evidencesource hash · quarantined instruction · detection rule id · sender · timestamp

GR-04No publication before embargo liftOverride defined
  1. Target

    Scheduled releases, generated posts and syndication queues carrying embargoed announcements

  2. Trigger

    Any publish or schedule action dated before the embargo timestamp on the announcement

  3. Action — enforced

    Platform holds the content in a locked queue; agent may only prepare and stage assets

  4. Human override

    Head of communications lifts early via a re-dated embargo record with legal sign-off

Logged evidenceembargo timestamp · content hash · hold event · lift authorisation · publish time

GR-05No executive quote without written sign-offOverride defined
  1. Target

    Quotes attributed to executives in releases, statements, bylines and briefing documents

  2. Trigger

    Any attributed quote lacking a signed-off text match from the named executive

  3. Action — enforced

    Platform blocks distribution of the attributed text; agent may propose draft quotes for sign-off

  4. Human override

    Quoted executive or their chief of staff signs off in the approval system

Logged evidencequote text · attribution · sign-off record · document hash · timestamp

GR-06No crisis response built on unverified incident factsOverride defined
  1. Target

    Crisis statements, holding lines and executive briefings drafted under time pressure

  2. Trigger

    Any factual assertion in crisis drafts lacking a source confirmed by the incident lead

  3. Action — enforced

    Platform holds the draft and flags unverified assertions; agent may issue only pre-approved holding language

  4. Human override

    Crisis lead confirms each fact via the incident log before release

Logged evidenceassertion list · source per assertion · incident log ids · confirmer · release timestamp

GR-07No disclosure to unverified journalist identitiesOverride defined
  1. Target

    Inbound media requests seeking unreleased figures, executives or embargoed material

  2. Trigger

    Requester identity failing outlet-domain, prior-relationship and callback verification checks

  3. Action — enforced

    Platform withholds the material and opens a verification task; agent may share only published content

  4. Human override

    Media-relations manager clears the identity after documented outlet callback

Logged evidencerequester identity · verification checks run · callback record · material withheld · timestamp

GR-08No synthetic content without machine-readable AI labelsOverride defined
  1. Target

    AI-generated text, imagery, audio and video distributed under the brand masthead

  2. Trigger

    Any synthetic asset missing provenance metadata required by EU AI Act Art. 50 duties

  3. Action — enforced

    Platform blocks distribution until labels embed; agent attaches provenance manifests to every asset

  4. Human override

    Compliance counsel adjusts labelling scope only via the disclosure policy register

Logged evidenceasset hash · provenance manifest · label check result · policy version · timestamp

GR-09No executive briefing from unverified coverage summariesOverride defined
  1. Target

    Coverage digests, sentiment readouts and monitoring dashboards feeding leadership decisions

  2. Trigger

    Summary items lacking resolvable source links, or sentiment shifts driven by bot-pattern accounts

  3. Action — enforced

    Platform withholds the briefing and marks suspect items; agent rebuilds from linked primary coverage only

  4. Human override

    Insights lead certifies the digest after source-link spot checks

Logged evidencedigest id · source links per item · bot-score flags · certifier · timestamp

GR-10No release built on stale boilerplateOverride defined
  1. Target

    Company boilerplate, executive titles, figures and localised variants in outbound materials

  2. Trigger

    Boilerplate block or figure older than its validation date or superseded in the fact library

  3. Action — enforced

    Platform swaps in the current validated block or holds the release; agent may not hand-edit figures

  4. Human override

    Content librarian revalidates the block via the fact-library workflow

Logged evidenceblock version · validation date · release id · swap or hold event · timestamp

Oversight

Human review — triggers, decisions and evidence

When a defined risk trigger fires, the affected action is routed to a named reviewer. Every decision is recorded with its correction, escalation and final outcome for full traceability.

  • ConfidenceLow-confidence sentiment call
  • Financial impactBinding public commitment
  • Identity / change riskMedia-contact verification
  • Irreversible actionRelease or statement issue
  • Policy riskEmbargo or approval conflict
  • Safety controlGuardrail override
  • Quality failureFailed critical evaluation
Humanreviewnamed reviewer
  • Revieweridentity + role
  • Decisionapprove / reject / amend
  • Correctionwhat changed
  • Escalationwho, why and severity
  • Final outcomereleased / blocked / returned for rework

7 triggers · any one halts the agent

1 record · 5 fields, every time

Compliance

Regulatory mapping

  • 01 Goal
  • 03 Workflow
  • 04 Task
  • 06 LLM
  • 08 Guardrail
  • 09 Human review
  • 10 Outcome

Statement control

Unapproved statements (PRC2-01) are the department’s existential risk — approval gates are absolute.

Lifecycle layer:03 Workflow · 08 Guardrail · 09 Human review

    Evaluations

    Baseline evaluation suite — in detail

    Baseline evaluations are completed during onboarding and repeated based on the selected plan. Agents that fail critical checks remain restricted until they pass re-testing.

    Detailed case sets
    32
    Failure modes covered
    41
    Retired & rotated / quarter
    10%
    Audit-ready scorecard
    Monthly

    Output evaluation3 suites · 160 cases

    60 casesCrisis-signal setcatches PRC2-08
    40 casesTier-grading setcatches PRC2-12
    60 casesMessage-house tone setcatches PRC2-05
    v1.1Expansion sets — 28 new evaluation sets in rollout (PRC2-14–41)~800 cases

    Use your work email to unlock the full grid. We use it to send the requested Agent Care material and qualify business inquiries. We do not sell or share your email.

    1. Department lead review

      For applicable high-risk agents, the client’s designated department leader reviews the evaluation criteria and pass thresholds before baseline approval.

    2. Test-case rotation

      Evaluation cases are refreshed regularly to reduce memorisation and maintain reliable performance measurement.

    3. Scorecard integration

      Scorecards track results against the approved baseline and flag material declines for review and escalation.

    4. Department-specific extensions

      Where included in scope, evaluations may be expanded using approved workflows, tools, templates, policies, and incident history.

    Monitoring

    Change-aware monitoring

    When agent performance changes, Nestack correlates the shift with changes to the agent, prompt, model, tools, knowledge base, guardrails and evaluation suite.

    Version changes by layer
    01AgentAgent changed in week 3
    02PromptPrompt changed in week 5Prompt changed in week 10
    03ModelModel changed in week 8Model changed in week 10
    04ToolTool changed in week 4
    05Knowledge-baseKnowledge-base changed in week 6Knowledge-base changed in week 12
    06GuardrailGuardrail changed in week 10
    07Eval-suiteEval-suite changed in week 3
    Fact-accuracy rate92–100%
    • Week 1 · 98.7%
    • Week 2 · 98.6%
    • Week 3 · 98.8%
    • Week 4 · 98.7%
    • Week 5 · 98.9%
    • Week 6 · 98.7%
    • Week 7 · 98.8%
    • Week 8 · 94.4%
    • Week 9 · 94.2%
    • Week 10 · 98.7%
    • Week 11 · 98.8%
    • Week 12 · 98.9%

    Week readouthover or select

    Week 8of 12

    • 03Modelopus 4.6 · 0612

    94.4%Fact-accuracy rate

    • 7 layers stamped on every run · 12-week window
    • Catches PRC2-39 · silent model-update regression

    Something missing?

    Don’t see your agent’s issue here?

    Every AI environment is different. Share what you’re seeing, and we’ll review the behaviour, assess the risk and recommend the evaluations or controls that may help.

    Report an agent issue

    Tell us what you’re seeing

    The more specific, the faster we can reproduce it. Playbook: Public Relations

    We reply within one business day.

    See pricing

    No commitment. Even if you never become a client, we’ll tell you what we think is happening.

    Process

    Universal incident runbook

    Severity is assigned based on business impact, customer harm, data exposure, operational disruption and overall scope.

    • SEV-1 Critical
    • SEV-2 Major
    • SEV-3 Moderate
    • SEV-4 Minor
    STEP 01

    Automated monitoring or human review identifies unusual behaviour. Alerts are recorded and routed according to severity.

    Cost control

    Keep public relations AI agent costs under control

    Token spend is monitored, optimised and reported as part of Agent Care — and savings never come at the expense of quality, because every change is verified against your evaluation baseline.

    We review token spend by agent, workflow, model, and session so you can understand where AI costs are coming from.

    Running public relations AI agents in production?

    Get a free assessment of one agent. We’ll review its behaviour, run a baseline evaluation and highlight potential risks and performance gaps.

    Loading open times…

    Open times

    Select an available date above to view open 45-minute times from our calendar.