How to Stop AI Agents From Changing Your Ad Account (Without Giving Up Automation)

The short answer

Give AI agents read-only access by default, and route every account change through a step where a person approves the exact change: the specific campaign, the before and after values, and a way to undo it. Enforce that rule in software, not in the agent's instructions, because a model can misunderstand or ignore an instruction but can't get past a check it doesn't control.

Why this matters now

Through 2026, the big ad platforms opened their APIs to AI agents through the Model Context Protocol (MCP), a standard way for AI assistants to call tools:

• Google published an official Google Ads MCP server that is read-only. It can query reports but cannot change bids, budgets or campaigns.
• Meta offers a hosted Ads MCP server that can create and edit campaigns as well as read reports.
• Amazon opened an Ads MCP Server in open beta for API partners, also able to create, update and delete campaigns.

That's useful: an agent can pull a report, spot a problem and fix it in one conversation. It's also risky. An agent that misreads a CSV, confuses two accounts or acts on a broken conversion signal can make a confident wrong change. In paid media, wrong changes cost real money by the hour.

What can go wrong

Some realistic failure modes:

• Acting on broken tracking. Conversions stop recording, CPA appears to spike, and the agent cuts budgets on campaigns that are actually working.
• Wrong account. Agencies manage many accounts; one wrong ID and the change lands on a different client.
• Unit mistakes. The Google Ads API expresses money in micros (1,000,000 micros = 1 unit of currency). An off-by-1,000 error turns a ₹5,000 budget into ₹5,000,000.
• Too-large steps. Doubling a budget overnight can push a campaign back into learning and lift costs.
• Deletes. A deleted campaign takes its history with it; a paused one doesn't.

Five rules for safe AI in ad accounts

1. Read-only by default

Connect agents with read-only credentials or read-only tools wherever possible. Most audit, reporting and monitoring work never needs write access. Google's official server is read-only for exactly this reason.

2. Approve the exact change, not the idea

"Yes, optimise the account" is not an approval. Each change should be written out before it happens: platform, account ID, campaign, the value before and after, the reason, and how to roll it back. You approve that specific list.

3. Enforce limits in code

Put hard limits outside the AI:

Guardrail	Sensible default
Budget change per step	Within ±30%
Bid or target change per step	Within ±25%
Deletes	Not allowed; pause instead
New campaigns	Created paused
Accounts	Only those on an allow-list
Data freshness	Based on data under 72 hours old

4. Make approvals single-use and tamper-evident

An approval should cover one exact action, expire, and become invalid if anyone (including the agent) edits the proposed change after you approved it. Otherwise "approve once" quietly becomes "approve forever".

5. Log everything and read it back

Record what was proposed, what was approved, what ran and what the platform returned. After a change runs, read the setting back from the platform to confirm it matches what you approved.

How SpendSentry implements this

SpendSentry is an open-source PPC agent for Claude Code that follows these rules. A hook (a small program Claude Code runs before every tool call) checks each ad platform call:

• Read-only calls pass through.
• Write calls are blocked unless the exact tool and input match an action from a change set that passed safety checks and that the user approved by typing a one-time code, for example APPROVE ADS-C15127.
• Only the user's own message can create that approval. Attempts by the agent to write an approval file, type the approval phrase in a command, or send raw API requests are blocked.
• Each approval works once, expires after 24 hours, and is void if the change set is edited.

Known limits are documented honestly: shell-level detection is pattern-based, so ad API credentials should stay out of the shell environment.

You don't need an agent to start

Most of the value of an AI PPC workflow comes from finding problems, not from making changes automatically. The free PPC Audit Tool runs the same automated checks as SpendSentry (tracking breaks, wasted spend, search-term waste, budget limits, CPA and ROAS against target) on CSV exports, entirely in your browser, with no account access at all. Start there, fix what it finds by hand, and add automation once you trust the process.

What to automate first

Task	Needs write access?	Risk	Good first step?
Daily performance summaries	No	Low	Yes
Tracking-break and pacing alerts	No	Low	Yes
Search-term review with suggested negatives	No (suggestions only)	Low	Yes
Budget shifts between campaigns	Yes	Medium	After weeks of trusted suggestions
Bid strategy and target changes	Yes	Medium–high	With strict limits and approval
Creating new campaigns	Yes	High	Paused, reviewed, then enabled by a person
Deleting anything	Yes	High	Avoid; pause instead

Teams that start with read-only reporting and alerts usually find most of the value there. By the time they let an agent change anything, they know how good its suggestions are.

A checklist before connecting any AI tool to an ad account

• Does it need write access, or would read-only do?
• Can it change budgets, bids or status without a person approving each change?
• Are there hard limits on how large a change can be?
• Is there an allow-list of accounts?
• Can you see a log of every change it made?
• Does it tell you when its data is stale or incomplete?

If the answer to the second question is yes, treat the tool like a new junior hire with full admin rights on day one, and think about whether you'd allow that.