// For agent authors

Writing an agent for the marketplace

An agent you publish is installed into somebody else's workspace. It runs on their CRM, under their company facts, with the tools they have connected. The prompt you write is one of three things the model reads, and most of what a first draft gets wrong is a sentence that belonged to one of the other two.

What the platform adds

Layer 1: the workspace's own facts

Rendered from the installing workspace's Company Context settings, for every agent, whatever it declares: Company name, Industry, Target market, Value proposition, Services you offer, Products, Competitor names, Buyer personas, Key stats, Competitive differentiators, Objection handling.

You never write any of these. The reader's own answers render in the reader's copy, and yours would render in theirs.

Layer 2: the platform's mechanics

Rendered at run time, one block per capability the agent declares. A block appears because of what the agent can do, never because of what its prompt says.

Block	Renders when the agent
Qualification gate	declares create_company, create_person, create_opportunity, create_deal
Opportunity record conventions	declares create_opportunity, update_opportunity
Deal record conventions	declares create_deal, update_deal
Contact record conventions	declares add_contact_to_opportunity, add_contact_to_deal, or returns structured output of type opportunity_qualification or buying_committee
Score conventions	declares upsert_entity_score
Notes tools	declares get_company_notes, get_deal_notes
Agent memory	declares set_agent_memory, get_agent_memory, list_agent_memory
Output mode	returns structured output
Output shape	declares an output schema
Integration tools	the installing workspace has enabled one of its optional integrations

All but the last are decided by your bundle, so the creator console shows you the exact list beside the editor. The integration block is decided by the reader's workspace and cannot be known before an install.

Layer 3: your prompt

What this agent looks for, how it decides, and what it writes. That is the whole of your territory, and it is the only layer with no other source of truth.

What to write

Open by saying what the agent is for: One line, in the second person, naming the role and not the vendor: "You are a hiring-signal scanner for our company."
Territory: What this agent owns, and which neighbouring signal it does not. An agent with no stated edge drifts into the work of whatever else is installed, and two agents writing the same record from different angles is the most common way a workspace’s data goes bad.
Why it matters: State the buyer’s problem the signal predicts, not the product category. "A team posting three GTM engineering roles has decided to build the function in-house" is a reason a model can weigh; "companies in the sales-tech space" is a filter it cannot.
Workflow: The order of the run: what to read first, what to search for only if it is still missing, what to write, and when to stop. Say what a repeat run should do differently.
Note format: If the agent writes a research note, say what its first line is and what the sections are. A note a rep cannot act on without opening the source is a note that will not be read.

Size. The hard limit is 60,000 bytes, refused at the write. Anything over 24,000 bytes is flagged as advice. For reference, the first-party catalog holds itself to 4,000 to 9,000 characters for research and closing agents, 3,000 to 7,000 for qualification, 3,000 to 8,000 for outreach, 2,500 to 7,000 for operations, and nothing at or above 12,000.

What not to write

Each line is a rule the linter applies to your prompt. None of them blocks a submission: they are advice on the draft page, and beside the prompt when a reviewer reads it. Every one exists because the fact is already rendered somewhere else, so a prompt that states it too states it twice and freezes the copy the day a workspace edits the text.

stage-recitation
Do not type the opportunity or deal stages. They render from the same constant the tools validate against, so a typed copy goes stale and then freezes.
priority-band
Do not type the score-to-priority bands. They belong to the platform and render in the opportunity record conventions.
source-slug
Do not type a source value. It renders from the agent’s own slug; a typed one survives a copy into a sibling agent and re-keys that sibling’s records.
no-score-caveat
Do not restate what a tool will not accept. That is the tool schema’s business, and the record conventions already say it.
json-fence
Do not type a JSON example of your output. Declare an outputSchema: the platform prints the shape and validates the answer against the same declaration.
notes-caveat
Do not restate that reading a company or a deal returns an index rather than note bodies. The notes tools block says it for every agent that declares one.
memory-scope
Do not prescribe how memory is scoped. set_agent_memory has no scope argument, and the keying renders in the agent memory block. Write the key this agent uses and what it puts in it.
tool-args
Do not list a tool’s arguments. They belong to its schema and render in that tool’s block.
dimension-list
Do not recite the score dimensions. They render in the score conventions from the constant upsert_entity_score validates against.
contact-role-list
Do not recite the contact roles. Their meanings and the aliases the platform accepts render in the contact record conventions.
no-fabrication-restatement
Do not restate "never fabricate". The base prompt forbids it in every prompt on every run; keep a line only where it names the specific thing this agent could invent.
vendor-name
Off for marketplace prompts. The first-party catalog may not name a company, because whose company it is comes from the reader’s settings. You publish under your own name, so naming your own is your call.
context-key
Do not read a key nothing injects. A prompt may read the declared context fields, this agent’s own required and optional context, and the keys a playbook step in the same bundle maps into it. A model handed a missing key invents a value rather than reporting it.
currency
Do not name a money amount. It is one workspace’s threshold read by every other workspace as a universal bar; the bar belongs in the qualification gate and in the reader’s own products.
restated-workspace-fact
Do not restate Company Context. "Our target market is", "we specialize in", an ICP definition: all of it renders in layer 1 from the reader’s settings rather than yours.
size
Over 60,000 bytes a prompt cannot be saved at all. Over 24,000 it is flagged, because nothing shipped today is that long and growth past it is usually text a block or a shared paragraph already renders.
em-dash
House style has no em dashes. A comma, a colon or a pair of brackets says it.

The shared paragraphs

These paragraphs are shared across the first-party catalog because several agents need the same behaviour and no code mirrors it. Each is published as reference text beside the bundle editor in the creator console. Copy one verbatim; each is written to sit beside the platform blocks rather than repeat them.

Company entry: How an agent that runs on a company starts: load the record, read what earlier agents left, search only for what is missing.
Deal entry: The same opening for an agent that runs on a deal, including the rule that a sibling agent scored it already.
Qualification gate: How to run the qualification gate the platform renders from the workspace settings, and what to write on a record that passes it.
Record conventions pointer: The one line a writer agent carries instead of copying the priority bands and the source value the platform sets for it.
Named buyer: A signal with no human attached is not a lead: name the buyer, write them down as a contact on the opportunity, or say who you looked for and where.
Why-now note opening: The three lines a research note opens with, so a rep can act on it without re-reading the source: who, why now, source.
Research note format: The shape of the note a report writer leaves: one note, a dated verdict first, UNKNOWN over guesses, and what changed on a repeat run.
Scan deduplication: How a scheduled scanner remembers what it already processed, so a periodic run does not create the same record twice.
Composer brief: The twelve headings a sequence strategist hands the copy generator, each grounded in something they read or left out.
Contact score rubric: The contact scale: four dimensions of 25, the bands they add up to, and the rule that sparse data is itself a signal.
Buying role signals: How to recognise which buying role a person is playing, written in the role names the platform stores.

How the checks read your prompt

Static checks, on the draft page: Some findings block a submission and some do not, and the difference is whether the bundle is safe and installable rather than whether it is well written. Blocking: a payload that does not parse, a declared tool or built-in the catalog does not know, invisible or bidirectional characters in any string, a prompt-safety finding at block severity, and, for a collection, any member that is missing, unpublished or withdrawn. Advisory: everything under "What not to write". The advice renders whether the checks passed or not, and nothing about it is stored.
The derivative scan: Every submitted prompt is compared against the published corpus. A high similarity sends the version to a reviewer with both documents side by side, which is a judgement rather than a refusal: a publishable derivative with attribution is a normal outcome. Containment is measured too, which is what catches a copied prompt padded with original text to push the similarity down.
What attestation runs: Before you can submit, the draft is frozen and tested in a hosted Studio workspace. That run assembles the prompt exactly as an install would: the workspace’s company facts, the platform blocks your declarations earn, your prompt, and then a fixed smoke instruction that asks the agent to say what it is for, call one read-only tool, and stop. One session per agent, with that workspace’s own models and credentials. Only the verdict leaves that deployment: the snapshot id, the checksum of the bytes that ran, the runtime and tool-catalog versions, and the pass or fail. No prompt, credential, model output or error message is returned.

What a listing may contain is the Marketplace Content Policy. When you are ready, the creator console is at market.dija.ai/console.