Meta Opened Your Ad Account to Any AI Agent. What Should Yours Be Allowed to Do?

On 29 April 2026 Meta opened its ad system to outside AI agents. Its ads AI connectors, an MCP server and a command line tool in open beta, let an agent you already use create and edit campaigns, ad sets and ads in plain language, build a product catalogue, and pull performance reports. Meta's own words for the setup are no developer credentials, no API setup and no code.

That settles a question that used to take weeks: can an agent reach my ad account? It now takes minutes. It leaves a harder question wide open, and it is the one this post is about. Once an agent can change anything, what should it be allowed to change without asking you?

Why the question is now permission, not access

Before April, getting an agent into an ad account was the hard part, and the difficulty did some of the safety work for you. Few agents were connected, and the ones that were had been built by somebody who thought about what they could touch. With access this cheap, the agent in your account may be a general assistant that was asked to help with a report and can also change a budget.

Meta saw the same gap. On 16 July it added what it calls ads MCP server rules, which let anyone with full control of a business portfolio govern what agents can do on the account, in Meta's words "from budget changes to catalog updates". That is a control at the platform, and it is worth using. It does not answer the question for you. Somebody still has to decide which changes belong on which side of the line, and the line is different for a pause than for a budget raise.

What an agent can actually do in an ad account

Meta's developer documentation groups the server's tools into seven areas: reporting, ad creation and management, catalogue creation and management, signals and datasets, help and troubleshooting, A/B tests and conversion lift studies, and activity logs. Read as a list of risks rather than features, the changes an agent can make fall into a handful of kinds:

• Read. Reports, settings, delivery. Changes nothing.
• Stop. Pause a campaign, ad set, ad or keyword. Spend goes down, and the change can be reversed.
• Restart. Resume something that was paused. Spend goes back up by whatever budget it restarts on.
• Move money. Raise or cut a daily budget, shift budget between campaigns.
• Change bidding. Bid caps, bid strategy, device bid adjustments. Spend can rise up to the budgets already set, by an amount nobody can read in advance.
• Widen delivery. New keywords, broader targeting, a longer schedule. More places to spend.
• Create. New campaigns, ads, audiences. Something new starts delivering.
• Remove. Archive or delete. Some of it cannot be brought back.
• Reach customers. Send an email campaign or a message. It cannot be unsent.

The kinds differ on two things, and those two things are the whole of the sorting rule: whether the change can be undone, and whether it can raise spend.

Our sort: on its own, ask first, never on its own

Cresva's agents work at one of three levels a person chooses for each brand: Recommend only, where nothing is sent and a person makes every change by hand; Ask first, the default, where every change waits for approval; and Safe actions, where some changes run on their own. The table below is what Safe actions means, taken from the per-action table on our Autonomy page rather than written for this post.

Two things sit on top of the table. First, "on its own" never means unlimited: a change runs alone only when the brand is at Safe actions, agents are not paused, the brand allows at least one change per run on its own (the starting setting is none), and, if it can raise spend, it sits inside a goal a person approved that sets a daily spend ceiling. Second, the rules live at the single point every write passes through, not in the agent's instructions. An agent that has been talked into a budget raise by a cleverly worded request still hits the same refusal, which is the practical defence against prompt injection.

Four questions to ask before connecting any agent

These apply to any agent, ours included, and to Meta's own rules as much as to a vendor's promises.

1. What happens to a change that can raise spend? "It asks first" is an answer. "It is careful" is not. Ask where the limit is enforced: in the instructions the agent reads, or at the point the write is sent.
2. Can it undo what it does, and for how long? A pause is undone by a resume. A deleted audience is not undone by anything. An agent that treats those two the same is not sorting by risk.
3. Where is the record? You want a row written before the change is attempted and the account read back after it, so the record shows what the account actually says rather than what the agent believes it sent.
4. How do you stop everything at once? And does the stop cover only what the agent starts, or also changes you already approved that have not run yet?

Where we got it wrong

The sort above is the second version of it. The first had two holes, and neither was found by a test.

A bid change could run without approval. In an audit of our own write records on 29 August, we found that a Google Ads bid-cap change was classed as reversible and allowed to run on its own at Safe actions. It was not on the list of money changes our size limit applies to, so it had no ceiling at all. That contradicted what our own homepage said, that no budget change runs without your approval. The audit found it had never fired: none of the write records at the time was a Google change. The same day the bid change, and two keyword changes that carried an uncapped bid inside them, moved to ask first at every level, and a test now fails if any change that touches a budget, bid, cap, spend, amount, price or cost is marked as able to run alone, apart from four budget changes that may run only under the caps described above.

A resume was counted as free. Until 2 October, the question "does this raise spend?" was answered in four different places, and three of them treated resuming a paused campaign as costing nothing. It costs exactly the budget it restarts on. There is now one table that classifies every action the system can take, an action missing from it is treated as able to raise spend by an unknown amount, and a test fails if any action has no row.

Both mistakes had the same shape: a list of dangerous changes, and a dangerous change that was not on it. If you write your own rules in Meta's new controls, that is the failure to look for.

The one-screen checklist

• Write down which kinds of change the agent may make alone. Start with stops only.
• Anything that can raise spend asks first, unless it sits inside a goal with a daily ceiling you set.
• Bid and bid strategy changes ask first. There is no size limit that bounds them.
• Anything that cannot be undone needs a deliberate confirmation, every time.
• Limits are enforced where the write is sent, not in the agent's prompt.
• Every change leaves a record written before it runs and read back after.
• One control stops everything, and you have tested it.
• Review the list whenever the agent gains a new kind of change, because the new kind is the one most likely to be missing from your rules.