The Environment We Built For Agents To Transact Linear TV

How a TV Buy Moves Today

Today a linear TV order moves the way it has for decades. A buyer emails a spreadsheet. A seller reads it, keys it into a traffic system by hand, and emails back a confirmation. Multiply that by more than a thousand local stations, dozens of cable operators, hundreds of syndicated programs, and the national networks, each with its own rate-card format and its own order workflow, and you have an industry that runs on attachments and re-typing.

A major national TV supplier launched the first end-to-end agentic advertising platform for streaming and linear TV, and named Simulmedia its linear transactions partner. What sits underneath that announcement is the thing this post is about. We did not build a one-off integration with a single partner. We built an environment: a defined, secured way for a seller's agent and our buyer agent to transact, with trust and security designed in from the start. The launch partner is the first to run on it. For an agent to place a real order against real money, that environment has to be trustworthy in a way email never had to be. So this post walks through what we built: how a buy crosses from our agent to a seller's, how we keep the language model boxed in where money is involved, how we turn every seller's documents into one shared vocabulary, and how we secure and audit the boundary the agents transact across.

What Actually Crosses The Wire

Start with the thing itself: one buy, end to end, the way it runs today.

1. Submit. Plan Builder models the recommendation that best reaches the audience the advertiser actually cares about, and a Simulmedia AdOps manager approves it. That approval triggers the Buyer Agent to package the plan and send it to the seller in two forms at once: a natural-language request, agent to agent, and a structured buysheet carrying the typed details (advertiser, campaign, flight dates, the spot selections we have already chosen, and the total the buyer expects). We send both deliberately. The structured buysheet carries the order in a precise, machine-checkable form, and that is the record the buy is reconciled against. The natural-language channel is how the two agents communicate, and it is what carries that order to any seller. The seller receives a finished plan, already optimized for incremental reach into the advertiser's audience, not a budget to fill at its discretion. That is the Simulmedia difference: the buy is built around the marketer's outcome before it ever reaches a seller.
2. Parse and validate. The seller reads the buysheet, normalizes it, checks it against its rate card and inventory, and sends back its own structured interpretation of the order alongside the validation result.
3. Confirm intent (human gate #1). When the seller's parsed order matches the order we sent, the buy can confirm automatically. When they disagree, a Simulmedia AdOps manager sees the parsed order and the checks side by side and confirms or rejects, and the seller's process parks until that decision arrives.
4. Approve (human gate #2). A person on the seller's side signs off. Premium inventory does not get committed by a machine alone, and neither party wants it to.
5. Order. The order is written into the seller's traffic system, scheduling daylocks (the holds that lock each spot into the broadcast schedule) are applied, an order id comes back, and the spots are on air. No one re-keyed anything.

Human accountability sits at the decision points, not in the machinery between them. The seller approves on their side, and on ours a person confirms whenever the seller's read does not match the order we sent. On commitments this size, both sides want a person owning the go-ahead, and the automation carries everything in between.

The Buyer Agent normalizes ambiguous input at the edges. The Orchestrator routes through a closed, schema-validated tool set. Every order to a seller crosses the Secure Transaction Layer.

1. The Buyer Agent: A Language Model Only At The Edges

The Buyer Agent sits between three parties: the Simulmedia AdOps team, the Orchestrator inside our platform, and external seller agents across the Secure Transaction Layer. We put a language model here because the input at these edges is unstructured. An intent arrives in plain language. A seller's reply arrives in its own words and its own formats. The agent's job is translation: turn that ambiguity into typed, structured instructions the platform can act on, and turn the platform's answers back into something a person or another agent can read.

With the seller's agent, that exchange happens in natural language on purpose, with the structured buysheet alongside it as the precise, checkable record. Natural language is how the agents communicate; structure is how they stay exact. That pairing is what lets the same system handle a seller who can take a clean structured order and a seller who can only be reached through the agentic layer. The agent only manages the interfaces; the analytical work happens in the tools behind it.

2. The Orchestrator: A Closed Tool Set, Not Free Rein

The Orchestrator takes structured intent from the Buyer Agent and routes it to exactly one of a fixed set of tools: Audience Builder, Plan Builder, File Decoder, or Order Manager. The hard constraint is not that the language model produces the same words twice, because it does not, and we do not rely on it to. The constraint is that every prompt is engineered to return a bounded, typed result that is validated against a strict schema before it reaches anything downstream, and that the model can only pick from operations we defined. It cannot invent an action outside the set, and in a system that moves money, that boundary is the guarantee.

3. The File Decoder: One Vocabulary Across Every Seller

Every seller in linear TV produces documents in its own format, on its own schedule. One supplier's rate card is not another's, and one station group's pre-log columns are not the next's. Templates change without notice. The old answer was a custom ingestion script per format and a human to repair it every time a layout shifted. The File Decoder replaces that.

It works in tiers, cheapest first. When a document arrives, fixed rules try to classify it by sender domain, subject line, and filename. For known senders, that resolves in milliseconds with no model call at all. Only when the rules cannot make a confident call does a frontier model classify the document against a strict schema and return a typed object naming the document type, format, and supplier.

Parsing follows the same shape. A learned-template library is keyed by document type, format, and supplier. When a layout has no template yet, the model parses it, returns the rows as typed data, and writes the inferred layout back to the library as a side effect. Every later file from that supplier resolves to the saved template with no model call. The decoder gets cheaper the more it sees: each new layout in production expands the library and narrows the share of documents that still need a model. The same pipeline handles rate-card ingestion, invoice reconciliation, and pre- and post-log normalization (the planned schedule before air and the record of what actually aired) across the full footprint of sellers.

4. The Secure Transaction Layer: Principles Behind The Boundary

The Secure Transaction Layer is the single control point every order crosses on its way to a seller. We built it as a set of five principles rather than a fixed stack, so a different seller can meet them with their own mechanics:

Authenticate every call. The principle is short-lived, on-demand credentials over long-lived keys, so a leaked secret is worth little and nothing durable sits in the runtime. Each service also runs with a scoped identity, granted only the access it actually needs.

Verify the origin of everything inbound. An inbound event is trusted only after its source is confirmed, and the check is constant-time, so the verification itself gives nothing away to someone probing it.

Allowlist the destinations, on both sides. Each side will only call allowlisted addresses that are approved in advance. Whoever receives updates hands the other a callback address to send them to; without an allowlist, a freshly issued token could be delivered somewhere it should never reach. Pinning calls to a short, pre-approved list removes a whole class of attack, and it is a one-time setup step per connection.

Keep an immutable audit trail. Every state change in an order is written once to an append-only log and never overwritten, recorded so a repeated event lands only once. Reconciling a buy becomes a query against that record instead of a reconstruction from email threads, and any mismatch between what was ordered, confirmed, and invoiced surfaces from the same place.

Treat seller input as data, not instructions. A seller's agent could try to smuggle instructions inside a data payload to change our behavior. Everything arriving over the wire is handled as data to be processed, never as commands the model should follow, so the content on the wire cannot redirect what the system does.

The lifecycle: automation runs the transitions, and human accountability owns the decisions.

What We Learned

Agents earn their place at the edges, not in the middle. A language model is the right tool where input is ambiguous and has to be normalized into structured instructions, and where two parties need to communicate in their own words. The path downstream should be deterministic in the engineering sense: a closed tool set, prompts treated as a technical contract, every output validated against a schema before it enters the system.

Multi-agent security is architecture, not an add-on. The attack surface is larger than a conventional API integration because every agent boundary is a possible injection point. Authenticating every call, verifying every origin, least-privilege identities, allowlisted destinations, and an immutable audit log are the baseline, not optional hardening.

Trust between agents reflects trust between the organizations behind them. The technology secures the channel; the business relationship authorizes its use. Agentic infrastructure in linear TV will expand at the pace of those relationships, which is exactly why we built it with humans at the control gates rather than designed around them.

What's Next

Simulmedia runs the buy lifecycle above in production today with our TV supplier launch partner. We built it as an environment rather than a private wire to one partner, and that is the point: the next seller does not start over. The same framework, the same trust model, the same audited boundary, takes another seller's agent the moment they want to transact this way, and the environment is symmetric enough to host buyer agents on the other side just as readily. The two agents already communicate in natural language, and that channel is what the next capabilities are built on: agent-to-agent counter-offers, automated avail substitution (the swap to alternative available inventory when a seller cannot fill a spot), and audience-matched pricing negotiation. Each of those is a bounded loop over the same closed tool set, with the same human gates and the same audited boundary. The negotiation gets richer on a trust model that does not change and a foundation already in place.