Google Ad Manager writes work on the autonomous lane — with an argument-shaped safety fence
Found by transposing a coverage audit: instead of asking whether each mechanism covers every platform, ask of each platform which mechanisms it actually gets. Ad Manager's row read "plan lane only" — it had been that way since the writes first shipped, and nobody had added up its row.
What shipped
- Ad unit creation, ad unit changes and Review Center blocking are reachable from the autonomous lane, not only from a planned run.
- Every safeguard the other platforms have: the shared write budget with a refund when a change is refused, autonomy guardrails, the approval gate, the circuit breaker, and an audit row on apply.
- One dispatch path, not a second implementation — the autonomous lane applies changes through exactly the same code the planning lane uses.
- Typed tools rather than one generic mutate gateway, because these writes already exist as distinct operations with distinct argument shapes.
The fence is shaped by arguments, not by verb
On most platforms the dangerous operations are identifiable by verb — anything that deletes. Ad Manager's REST API has no delete for these collections, so there is no verb to gate on. The risk lives in the arguments instead: un-blocking ads a human deliberately blocked is a different act from creating a new ad unit, even though both are ordinary updates. The fence reads the arguments, so a harmless edit doesn't end up behind a control people learn to switch off.
Frequently asked questions
- What can the agent change in Google Ad Manager?
- Create ad units, modify ad units, and block or unblock ads in Review Center. Each pauses for approval, draws on the write budget and records an audit row.
- Why weren't these available to autonomous runs before?
- They were reachable only from the planning lane — an oversight rather than a decision, found by auditing each platform's row of the coverage matrix instead of each mechanism's column.
- Is there a delete operation?
- No. Ad Manager's REST API has no delete for these collections, which is why the safety fence reads the arguments of a change rather than gating on a destructive verb.