Brand Leakage Across Workspaces at a Multi-Brand Skincare Group
Lumen & Co. is a global skincare group running three consumer brands in one Marketo Engage subscription: two brands share the North America partition, one sits in EMEA. There are 14 workspaces, 180 named users, and 6,000 active smart campaigns. Six weeks after an agency took over campaign builds, the EMEA brand's monthly newsletter began dropping into the North America partition's unsubscribe page and footer. Deliverability complaints rose 18%, and the privacy team found 2,300 EMEA records had been assigned to a North America workspace-specific campaign. The agency has 'Admin' rights because it also manages API integrations; the internal team has only 'Standard User'. The instance has one custom service API user, five LaunchPoint services, and no documented naming convention. Leadership wants a 30-day remediation plan before a fourth brand is onboarded.
1. What is the most likely cause of the EMEA newsletter using the North America unsubscribe page and footer, and which controls should be applied in the first 72 hours? Explain how workspace, partition, and user role settings interact.
Read the worked answer
Diagnosis. The unsubscribe page and footer are not chosen by the recipient's data; they come from the email asset and its subscription-center settings. The most likely cause is that the EMEA newsletter was cloned from, or built inside, the North America workspace, so it inherited the NA subscription center, footer tokens, and possibly a NA sender profile. The 2,300 EMEA records in a NA workspace-specific campaign point to a second failure: either the campaign was built in the NA workspace and targeted a NA-partition smart list, or EMEA people were created in the NA partition. Workspaces separate assets; partitions separate people. An agency with Admin rights and no naming convention can cross both boundaries silently.
First 72 hours. Freeze agency Admin access; create named standard users with workspace-limited roles. Rotate the API credentials and review all LaunchPoint services. Pause the suspect EMEA and NA campaigns. Audit active email assets for subscription center, footer, sender, and physical address. Run controlled unsubscribe tests for each brand. Export the 2,300 affected records and their consent status before changing them; do not assume they can be moved between partitions - Marketo does not provide a self-service partition move, so plan an export/recreate or vendor-assisted migration. Notify privacy/legal. The key is containment plus evidence preservation, not just rebuilding the email.
2. Design a 30-day remediation plan with sequencing, owners, and measurable exit criteria. Should the fourth brand be onboarded on schedule?
Read the worked answer
Days 1-5: inventory and freeze. Marketing Ops owns an inventory of workspaces, partitions, users, roles, API users, LaunchPoint services, and active campaigns. Map each brand to one workspace and one partition, or document why sharing is intentional. Freeze structural changes except emergency fixes. Export an audit trail of role changes and asset moves.
Days 6-12: access and governance. Security owns a role matrix. Human admins should be three named internal staff, not an agency. Agency staff get standard roles limited to assigned workspaces, with publish approval by an internal owner. API integrations get separate service users with least-privilege API roles, 90-day credential rotation, and an owner. Publish a naming convention for programs, emails, and campaigns that encodes brand, workspace, and region.
Days 13-24: asset and data remediation. Rebuild or reclone EMEA assets in the EMEA workspace, replace subscription center and footer, and test per brand. Resolve the 2,300 records with consent checks and a documented migration method. Audit 20 high-volume campaigns for workspace and partition.
Days 25-30: validation and gate. Exit criteria: zero active cross-brand assets; zero cross-partition campaign memberships in sampled campaigns; no more than three human admins; every API user documented with least privilege; 100% of active emails pass brand and unsubscribe tests; all 2,300 records resolved. The fourth brand should not launch until these criteria pass. Give it its own workspace and, if consent or privacy requires, its own partition.
3. The agency insists Admin is required because it manages API integrations. How should access and integrations be provisioned going forward, including monitoring?
Read the worked answer
Separate human access from integration access. API integrations do not need a human Admin account. Provision one named API service per integration with an API-only role restricted to the endpoints it needs: lead upsert, custom object read/write, campaign read, or webhook registration. Do not reuse the same service user for the agency and internal systems, because audit trails and rotation become impossible.
Agency access. Give each agency user a named account, SSO/MFA, and a standard role scoped to the brand workspace. If the agency must build assets, let it build but require internal approval to publish or activate. No shared credentials. Quarterly access review with a manager attestation.
Integration controls. Store credentials in a secrets manager, rotate every 90 days, restrict source IPs where supported, and monitor API call volume, 429 rates, and error spikes. Subscribe to admin audit alerts for role changes, bulk exports, and campaign deletions. Document an integration owner and a fallback contact. Use a sandbox for changes when licensed.
Monitoring evidence. A monthly report should show admin count, API users and scopes, failed authentications, and unusual bulk operations. This design gives the agency what it needs to operate without letting a single Admin account change subscription centers, partitions, or user roles across brands.