An approval gate is a checkpoint where a human must confirm an AI agent’s proposed action before it changes live spend. Two recent developments show where the industry is placing that checkpoint: Google’s official Ads MCP server cannot change anything, and IAB Tech Lab’s latest agentic advertising release calls for human approvals on spend commitments.
- Google’s developer documentation describes its official Ads MCP server as strictly read-only: it cannot modify bids, pause campaigns or create assets.
- Agents that write to accounts do so through third-party servers or direct API code, which moves the safety design onto the advertiser and the vendor.
- IAB Tech Lab’s AAMP 2.3, announced July 30, 2026, states that spend-committing paths should be deterministic and carry human approvals outside value-based thresholds.
- The thresholds themselves are not set by any standard. Your team has to choose them, and a vendor should be able to show you where they live.
What Google’s official server allows
MCP, the Model Context Protocol, is an open standard that lets an AI agent call tools in another system through a common interface. Google publishes an MCP server for Google Ads, and its design is conservative.
Google’s Ads API documentation, last updated October 16, 2026, lists three tools: list_accessible_customers, search for Google Ads Query Language queries, and get_resource_metadata. The page labels the current release as read-only and states that the implementation “cannot modify bids, pause campaigns, or create new assets.” The server’s GitHub repository adds a warning that connecting it exposes your account data to whichever agent or language model you attach.
For a buyer, the implication is practical. An agent wired to this server can audit, report on and diagnose an account, but it cannot spend. That makes it a low-risk starting point for analysis work, and a poor fit for any vendor claiming Google itself endorses autonomous campaign changes through this route.
Where write access comes from
If the official server only reads, agents that change campaigns must get write capability elsewhere. Google’s documentation points developers who need mutate operations to its Google Ads API Developer Assistant, which generates client-library code for those calls.
The market has also filled the gap. Markifact, for example, announced global availability of a hosted Google Ads MCP server on July 13, 2026, and described it as one with human-approved changes for use with Claude and ChatGPT. Other vendors advertise servers that adjust budgets and bids. We could not independently test these products, so treat their safeguards as claims to verify, not facts.
The consequence is that the safety model is no longer set by the platform. It is set by whoever builds the write layer, which is why an advertiser should ask what stops an agent from overspending before signing anything. Our guide to what is actually autonomous in agentic advertising covers how much of the market’s autonomy claims hold up.
What IAB Tech Lab’s AAMP 2.3 asks for
IAB Tech Lab, the industry standards body for digital advertising, announced AAMP 2.3 on July 30, 2026. AAMP is its framework for agent-to-agent advertising transactions between buyer agents and seller agents.
The release states that “any path that commits spend is deterministic and provable with human approvals outside of value-based thresholds.” In plain terms, small transactions may proceed on rules alone, while larger ones need a person to sign off, and the path to every spend decision must be reproducible. The release also adds a vendor approval gate to the Buyer Agent, tied to the IAB Diligence Platform.
PPC Land’s coverage of the release reports that the vendor gate is off by default and stays inactive without a verification key. We did not review the full specification, so the details of how thresholds are configured should be read from IAB Tech Lab’s own repository. The principle is what matters for buyers: autonomy is bounded by value, and the bound is a human decision.
Three levels of agent authority
The two developments point to a simple way of classifying any agentic ads setup by what the agent is permitted to do. The table below is our own framework, not an industry standard.
| Level | What the agent can do | Typical control | Fits |
|---|---|---|---|
| Read-only | Query performance, flag anomalies, draft recommendations | Account permissions, as in Google’s official server | Audits, reporting, diagnosis |
| Write with approval | Propose changes that a person confirms before they apply | Per-change sign-off, change log | New campaigns, large budget moves, new audiences |
| Autonomous within caps | Apply small changes automatically | Hard daily and monthly spend ceilings, allowed-action list | Routine bid and budget adjustments |
Most teams should start at the first level, earn their way to the second, and move to the third only for actions with a bounded downside. The AAMP wording maps onto the same logic: rules handle the routine, people handle what exceeds a value threshold.
Questions to ask an agentic ads vendor
Any vendor that touches your ad accounts should be able to answer the following in writing, in this order.
- Which actions can the agent take without approval, and which require a named person to confirm?
- Where are the spend ceilings enforced: in the vendor’s software, or in the ad platform’s own account settings you control?
- Does every change appear in a log that records what the agent proposed, who approved it and what the account looked like before?
- What happens when the approval service or the model is unavailable: does the agent stop, or continue?
- Who is liable for a mistaken change, and is that stated in the contract?
Vendors with a clear design answer these quickly. Hesitation on the fourth question is particularly informative, because a safe system should stop when its control layer fails.
Frequently Asked Questions
Can an AI agent change my Google Ads campaigns through Google’s official MCP server?
No. Google’s documentation describes the server as strictly read-only, so it cannot modify bids, pause campaigns or create assets. Changes require the Google Ads API or a third-party server.
What spend threshold needs human approval?
No standard sets a number. IAB Tech Lab’s AAMP 2.3 refers to human approvals outside value-based thresholds, leaving each organization to decide where its own line sits.
Is a read-only agent still useful?
Yes. Reading performance data, finding anomalies and drafting recommendations are real efficiency gains, and they carry no risk to live spend.
Deciding where an agent should read, propose or act is a design question before it is a tooling question. At Grow with Hafsa we help teams set up AI agents and performance-marketing workflows with approval paths that match their risk, and we are glad to review a setup you are considering.