Write safety: when an AI agent may change your account, and what always waits for a person
The risk that actually matters with an AI agent is not that it reads something it shouldn't — it's that it changes something it shouldn't. The answer here is not that the agent asks about everything, which would make unattended operation impossible; it is that a named class of irreversible actions can never happen without a person, whatever mode you run in. Every write waits for your approval by default; the hands-off modes are opt-in per task, schedule or API key, keep every write inside the guardrails, and never cover the irreversible, money-moving or public writes a platform marks as a person's decision.
The checks on every write
- Human approval, on by default. Bids, budgets, status changes, new campaigns — each pauses and waits for a person, in-app or by email magic-link. Hands-off is a choice made per task, per schedule or per API key (auto-approve, or a key minted for autonomous writes), never one switch for the whole organization.
- A person's decision, whatever the mode. The irreversible, money-moving or public writes — a permanent delete on Microsoft Advertising, Snapchat or LinkedIn, a refund or a deep discount on a store, publishing a Tag Manager container, a public post — never apply without a person: under auto-approve and in the autonomous loop they wait for one, over an API key they are held for one or not offered at all, and they are never part of a bulk approval.
- Guardrails under hands-off. With auto-approve on, or from an autonomous API key, every write still passes the autonomy guardrails — magnitude caps on budgets and bids, protected campaigns, the monthly spend cap — which block a write that crosses them and say why.
- Stale-state revalidation. The account is re-read immediately before an approved change applies. If the state it was calculated against has moved, the change doesn't fire on old assumptions.
Scope limits per platform
Beyond approval, several platforms are deliberately restricted at the path level rather than by convention. Campaign Manager 360 allows writes to exactly five trafficking collections while Floodlight measurement configuration stays read-only. Search Console writes are limited to sitemap submission and deletion — the agent cannot request indexing or change any other Search Console setting. Shopify and SHOPLINE write access exists only when your connection carries write scopes, ticked on a pasted token or granted on the app's consent screen. The Stripe connection reaches the catalogue only: no tool creates a charge, refund, payout or transfer.
Batch review without losing the gate
A scheduled audit proposing thirty changes used to mean thirty approvals, and approval fatigue is how a gate quietly becomes theatre. Batch review collapses that into one review while keeping per-write validation, and money writes carry an age bound on the data they were calculated from. See the batch approval release.
An audit trail
Each organization has an audit log recording what was proposed, who approved it, and what applied — so a change can be traced after the fact rather than reconstructed from memory.
Frequently asked questions
- Can the AI agent change my ad account without asking?
- Not by default. Every write waits for your approval unless you turn on auto-approve for a task or schedule, or mint an API key for autonomous writes — and even then every write passes the guardrails (magnitude caps, protected campaigns, the monthly spend cap), and the irreversible, money-moving or public writes still never apply without a person.
- What stops an approved change from applying to a changed account?
- The account state is re-read immediately before the change applies. If the basis it was calculated on has moved, the change does not fire on stale assumptions.
- Is there a record of what the agent did?
- Yes — a per-organization audit log records what was proposed, who approved it and what applied.