The request sounded reasonable for about thirty seconds.

I Said No to the AI Agent. Two Months Later Their Meta Account Was Disabled.

I still can’t prove the two things are connected. I’d make the same call again.

A client wanted an AI agent connected to their Google Ads and Meta Ads accounts. Not an assistant that reviewed campaigns. Not a tool that drafted three headlines for somebody to approve.

Photo by Austin Chan on Unsplash

They wanted an agent that could get inside the accounts, read performance, decide what needed changing, and make the changes. Campaign management without the campaign manager.

I said no. They found someone else, and I lost the deal.

Two months later I heard their Meta advertising account had been disabled.

That sequence makes it very tempting to write a very simple article. They connected AI. Meta banned them. AI got them banned.

I can’t prove that, and I’m not going to pretend otherwise. But the thing that bothered me on the first call was never what the AI could write. It was how they wanted the AI to get into the account.

The deal changed when the AI went from adviser to operator

I use AI around paid media constantly. That’s not controversial anymore.

It’ll summarise a search terms report in seconds. It’ll compare creative themes across a quarter. It’ll spot a spend pattern that a human would need forty minutes of tab-opening to find. On an account with $50k spend and 3 active campaigns, that’s the difference between reviewing everything weekly and reviewing the top third.

I was comfortable with all of it.

Then the request moved from “can the AI tell us what to change?” to “can the AI make the changes itself?”

That’s where I stopped. Those aren’t two versions of the same product. One is an analysis layer. The other has authority.

Once software can change a budget, pause a campaign, publish an ad, or edit targeting, you’ve stopped asking whether the model writes good marketing copy. You’re asking about access, permissions, and what happens when a system makes the wrong decision at machine speed.

The scary part wasn’t the AI copy. It was the login.

This distinction gets flattened in almost every conversation about AI and advertising.

Someone says “AI is running the Meta account.” That could mean five completely different things:

• ChatGPT wrote a headline and a media buyer pasted it into Ads Manager
• An internal system pulled yesterday’s performance and recommended lowering a budget
• Software connected through Meta’s Marketing API with a scoped token
• A browser agent opened Ads Manager, moved around the interface, and clicked whatever a human buyer would normally click

Those are not interchangeable, and the fourth one is where I’d put my money if you asked me to guess what goes wrong first.

Here’s why. When you connect through the Marketing API, Meta issued you the token. The access is scoped, logged, rate-limited, and revocable. The platform knows software is on the other end, because it built the door the software walked through.

A browser agent has none of that. It authenticates as the human whose session it’s using. It drives an interface built for a person with a mouse, at a speed and consistency no person produces. To the platform’s automated-behaviour systems, that isn’t an advertising policy question about your creative. It’s an account authenticity question about whether the human logging in is a human.

And there’s a second problem that I think matters more. A browser agent inherits whatever access the logged-in user has. For most founders and most media buyers, that’s everything. Billing. Payment methods. User permissions. Every campaign in the business account.

You can’t scope a browser agent. Not because nobody’s built the feature, but because the whole approach is “act like the person.” The person has full access. So the agent has full access.

That’s not a configuration you tighten later. That’s the architecture.

For teams looking at what platform-native automation can do before adding an outside agent, our Meta Ads automation guide for 2026 breaks down where the built-in features are genuinely useful and where manual control still earns its keep.

The goal was never to remove every human click. It’s to remove the useless ones without removing accountability.

I lost the deal because my version had too many brakes

There’s an uncomfortable commercial lesson in this: the risky version gives the better demo.

“AI analyses your campaigns and sends recommendations for approval” sounds useful. “AI runs your advertising account while you sleep” sounds expensive. I understand why a client prefers the second sentence. It feels like automation finally removed the operator instead of merely making the operator faster.

My version came with annoying words. Permissions. Approval queues. Read-only access. Logs. Limits. Revocation. Human review.

At the time those probably sounded like weaknesses. The other version sounded autonomous.

So I lost the deal, and for two months nothing happened that made me think about it again.

What I know and what I don’t

I know what they asked me for. I know why I refused. I know they pursued the idea somewhere else, and I know the account was later disabled.

What I don’t have is the log that connects those facts. No forensic record of how the final system authenticated. No evidence that any particular model caused the restriction. Ad accounts get disabled for a long list of reasons that have nothing to do with automation, and plenty of accounts running heavy automation never get touched.

The sequence is real. The causal claim isn’t proven. I’d still refuse the original setup.

The model name was the least interesting part of the story

People like blaming models. Claude got the account banned. ChatGPT did it. Gemini changed the campaign. Whatever model is fashionable next quarter will get blamed next quarter.

That misses the useful question. The model decides what action it wants to take. The architecture decides what it’s allowed to do next.

Meta’s Marketing API scopes that with tokens and permissions. Reading ad performance data needs ads_read. Changing things needs ads_management, which carries write access with it.

Notice what’s missing. There’s no permission tier in between. No “may suggest a budget change but not make it” scope. The platform gives you read or read-plus-write, and that’s it.

So the approval layer has to exist in your system, because Meta isn’t going to build it for you. That’s the part most teams skip. They see two permission levels, decide they’ll eventually want the agent to do things, and hand over ads_managementon day one for a system that spends its first six months only reading.

An AI agent shouldn’t get the keys to the building because it wrote a good inspection report.

Read-only is boring, which is exactly why I like it

If I were building the same system today, version one would be deliberately underpowered.

The AI reads before it can write. It pulls campaign data. It compares yesterday against the previous seven days. It finds the campaign where spend jumped while conversions fell. It flags the creative that’s decaying. It recommends moving budget from Campaign A to Campaign B.

Then it stops.

A human reads the recommendation and approves or rejects it. Only after that approval does a separate, permissioned system make the change, and it logs what changed, when, and who authorised it.

Less impressive than watching an agent glide around Ads Manager on its own. Good. I’m managing somebody else’s money. Impressive architecture isn’t one of my KPIs.

Every extra permission is another way to be wrong

The phrase I keep coming back to is minimum necessary access.

If the AI only needs campaign data, why can it publish an ad? If it only drafts copy, why can it change the daily budget? If it only flags anomalies, why can it pause anything?

Most people file permissions under security. They’re also a performance problem.

Say an AI wrongly decides your best-performing ad set is decaying. If it can only recommend, you get a bad recommendation, and someone rolls their eyes. If it can change the account, you get a bad recommendation converted into a live action against real spend. If it can repeat that action across every campaign in the business account, you’ve widened the failure radius again, and you find out on Monday.

Machines don’t have to make more mistakes than humans for this to matter. They only have to make them faster, and in more places at once.

Meta is adding more AI. That doesn’t mean your controls should disappear.

There’s another reason I don’t buy the “AI and Meta Ads don’t mix” argument: Meta is pushing AI deeper into advertising every quarter. Creative production, campaign optimisation and automated placement increasingly all run through Meta’s own systems.

We’ve been tracking what those changes mean for SaaS teams in our Meta AI ad features market insight, particularly around AI-generated creative and automated campaign workflows.

So the lesson can’t be “keep AI away from Meta Ads.” That ship sailed.

The lesson is: don’t confuse AI capability with permission to act.

There’s an enormous difference between software telling you “CPA increased 32% in this campaign. I recommend reducing the budget” and software telling you “CPA increased 32%. I’ve already cut the budget.”

The first creates a decision. The second makes one. I want a person accountable for the account sitting between those two sentences.

What I’d actually do on Monday

If your Google, Meta or LinkedIn accounts have quietly accumulated integrations, tools and permissions nobody has reviewed in months, that’s a better place to start than adding another agent.

Concretely, for Meta: open Business Settings, go to System Users, and list every connected app and integration holding ads_management. For each one, name the reason it needs write access. If nobody on your team can name the reason in a sentence, that access shouldn't survive the week. Do the same in Google Ads under linked accounts and account access.

Then, before you connect anything new, ask the question that actually matters. Not can the agent do this? but:

What’s the smallest amount of authority it needs to do this safely?

Start read-only. Use explicit permissions. Require human approval before any write that costs money. Keep a record of every action. Make access revocable in one click.

And don’t hand an agent publishing rights just because the demo looks better when nobody has to click approve.

Sometimes the smartest automation decision is deciding what the machine should never be allowed to touch.