Your AI agent can now edit your ad account (read is a report, write is a risk)

It's 9 PM on a Friday. A marketer hooks an AI assistant up to the ad account and types one instruction before closing the laptop: "Shift budget from the weak ad sets into the best one."

The agent does exactly that. It pauses four ad sets — one of them only three days old and still collecting delayed conversions — and pushes the freed budget into the top performer, which goes from ₹15,000 a day to ₹60,000 a day. Nobody opens the account again until 9 AM on Monday.

Sixty hours later, the "best" ad set has spent an extra ₹1,12,500, at three times its normal cost per acquisition. The model didn't make anything up. It followed the instruction to the letter — and that's the problem worth planning for now that agents can act, not just answer.

Reading and writing are different jobs

AI assistants reach ad platforms through MCP servers — connectors that hand the model a menu of "tools" it can call. Some of those tools only read: pull a report, break spend down by placement, compare two weeks. Others write: pause an ad, change a budget, launch a campaign.

The official Google Ads MCP server is read-only. Meta's Ads MCP, in beta through 2026, includes campaign-management tools alongside reporting, and plenty of third-party connectors do both across several platforms. So "connect the AI to the ad account" can mean two very different levels of risk depending on which tools come along.

How much can one bad action cost?

A useful way to size the risk: damage ≈ how much the change added × how long nobody noticed × how much of it was wasted. Teams usually think about the first term. The second is the one that hurts, because agents are happy to work while everyone's asleep.

Play with it and notice what shrinks the number fastest: a smaller allowed change and a shorter time-to-notice. Both are settings you control today. Neither needs a better model.

Gates that actually work

The trick is to sort every tool call before it runs. In a typical week, the vast majority of an agent's calls are reads — something like four out of five. A small slice are minor, reversible writes, and a sliver are big or irreversible ones. Gate the writes and you remove almost all of the risk for a few taps a week.

1. Read-only — runs automaticallyReports, breakdowns, search-term pulls, diagnostics. This is where most of the value lives anyway.
2. Small, reversible writes — approve each onePause or resume one ad, move a budget by up to 20%, add a negative keyword. Shown as a plain before → after and approved with one tap.
3. Human-only — not available to the agentNew campaigns, budget jumps above your cap, bid-strategy or audience changes, deleting anything, billing. The agent can draft these; a person makes them.

The approval has to be readable, too. "Allow tool call update_adset?" isn't an approval, it's a rubber stamp. Compare it with: Ad set "Prospecting – Broad": daily budget ₹15,000 → ₹60,000 (+300%). Anyone would pause at that.

Log every write, then look at what happened next

Every change an agent makes should land in a table: who asked for it, what changed, who approved it, when. Then a single query answers the question that matters each week — what did the agents do, and did any of it hurt?

WITH changes AS (
  SELECT change_id, asked_by, approved_by, object_id,
         change_type, before_value, after_value, applied_at
  FROM agent_change_log
  WHERE applied_at >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 7 DAY)
),
followup AS (
  SELECT c.change_id,
         SUM(h.spend)       AS spend_48h,
         SUM(h.conversions) AS conv_48h
  FROM changes c
  JOIN ad_stats_hourly h
    ON h.object_id = c.object_id
   AND h.hour BETWEEN c.applied_at AND TIMESTAMP_ADD(c.applied_at, INTERVAL 48 HOUR)
  GROUP BY c.change_id
)
SELECT c.applied_at,
       c.change_type,
       c.object_id,
       CONCAT(c.before_value, ' → ', c.after_value)   AS change,
       COALESCE(c.approved_by, 'NOT APPROVED')         AS approved_by,
       ROUND(f.spend_48h)                              AS spend_next_48h,
       ROUND(f.spend_48h / NULLIF(f.conv_48h, 0))      AS cpa_next_48h
FROM changes c
LEFT JOIN followup f USING (change_id)
ORDER BY c.applied_at DESC;

Two kinds of row deserve a look every week: any change marked NOT APPROVED, and any change followed by a CPA well above target in the next two days.

• Start read-only. Give the agent reporting access for the first few weeks. You get most of the benefit and none of the exposure.
• Cap every write. No single action may move a budget by more than 20% or touch more than one campaign. Anything bigger goes to a person.
• Alert on every write. A message to email or chat the moment the agent changes anything, with the before → after. A short time-to-notice is the cheapest safety net there is.

Quick gut-check

Questions people ask