Every conversation about AI managing ad accounts arrives at the same fork. One road says the point of an agent is that you stop doing the work — so any human step is a failure of nerve. The other road says nobody sane hands a credit card to a system they met on Tuesday. Both roads are wrong, and the approval loop is where they meet.
What an approval loop actually is
When an MCP-connected agent wants to change something in your Google Ads account — create a campaign, move a budget, pause an ad group — the client you use (Claude, ChatGPT, Copilot) surfaces the exact tool call it intends to make and waits. You see the account, the entity, the change. You click once.
That is the whole mechanism. It is not a form, not a ticket, not a review meeting. The agent has already done the reading, formed the argument and drafted the change — a specialist's work, done at the speed of a sentence; the approval is the one moment its work meets your judgement, and the second you click, it executes.
The maths of one click
The case against approvals is speed. It is worth taking seriously, because it is honest: an agent that can act without asking closes the loop in seconds.
But look at what the click is buying. A Google Ads account has exactly one class of irreversible mistake — spend that should not have happened — and the approval sits precisely on the actions that cause it. Reads cost nothing and flow freely. Additions that arrive paused cannot spend by construction. What is left is a short list of spend-affecting changes, and on that list a human click costs three seconds against a mistake that costs real money.
Anyone who has managed a junior hire recognises the shape. You do not review their reading. You review the email before it goes to the client — for a while, and less over time. The approval loop is that "for a while", built into the tooling instead of into anxiety.
Autonomy is a spectrum, and you should be able to move along it
The useful question is never "autonomous or not". It is which actions run unattended today. A sane progression for an ads account looks like:
- Week one — read everything, change nothing. The agent audits: search terms, spend without conversions, disapprovals, missing negatives. You learn how it reasons.
- Week two — writes that cannot spend. New negatives, paused campaign drafts, assets. Approvals are quick because the blast radius is zero.
- Ongoing — spend changes with approval. Budgets, statuses, bids: the agent proposes with its evidence attached, you spend one click.
Notice what never appears on that list: deletion. In the Google Ads API, setting a status to REMOVED is the delete, and a well-designed hosted connector refuses it outright rather than gating it behind another prompt — because "the capability is absent" is a stronger guarantee than "the AI promised to ask first". That distinction — enforced in the server, not in the model's manners — is the difference between a safety property and a politeness convention.
What this looks like in practice
Connect an account and ask the agent which search terms spent money without converting last month. Nothing changes, so the most you approve is letting the read tool run (in Claude, set the read-only tools to Always allow and it stops asking). Ask it to add the worst of them as negative keywords: the client shows the exact add-negatives call, account and terms listed. Approve it, and the change lands in the account in seconds, with your name in Google Ads change history — because the connector runs under your own Google sign-in, not a service account.
Then ask it to delete something, once, deliberately. Watch it refuse. That refusal, more than any feature list, tells you what kind of system you have connected: one whose limits are architecture, not vibes.
The agents that end up trusted with real budgets will not be the ones that promised full autonomy on day one. They will be the ones that made the approval loop so cheap, so legible and so well-evidenced that moving along the autonomy spectrum felt obvious. That is the standard an ads agent should be held to — and the one AdCopilot was built against.