In the PaidSync.ai workspace, an AI agent does not change your ad account on its own by default: each change is written as an approval card showing the account, the tool, the arguments and the expected effect, and it runs only after a person taps Approve. You can then widen what an agent may do, one band at a time, and the spend ceiling and kill switch stay on in every band.
An AI that can edit live campaigns needs a gate, or one wrong guess costs real money. PaidSync.ai puts the gate in four places:
Approval cards hold every change an agent proposes until a person approves it.Autonomy bands decide how much an agent may do without waiting.Spend ceilings queue any budget above your daily limit for approval.Kill switches pause every automatic change for a brand, and a platform gate fails closed.The cards are the default. The rest only narrow or widen what happens around them.
| Band | What the agent does | Who can set it |
|---|---|---|
| Observe | Reads and alerts, and writes nothing | Any editor or above |
| Propose | Drafts every change as a card and waits | Any editor or above |
| Act with guardrails | Executes inside the limits, and never-auto tools still become cards | Admin or owner |
| Full auto | Executes without waiting, inside the budget ceiling and the protected-campaign list | Admin or owner |
Two details catch people out. Some tools never run on their own in any band, such as campaign launches, removals and deletes. And these rules apply in the workspace. In Claude or ChatGPT, no card is written, and your assistant's own approval setting decides whether it asks first.
These steps use the PaidSync.ai workspace, where the cards and bands live.
Sign up at paidsync.ai, then connect each ad platform on its own sign-in screen. You never give PaidSync.ai a platform password.
Every agent runs in one of four bands. New agents start in propose, and audit and report agents start in observe.
Maximum actions per run defaults to 10, and maximum budget per action defaults to one channel-day of spend. Your Brand Brief sets a daily spend ceiling.
Each card shows the account, the tool, the arguments and the expected effect. Tap Approve and only then does the write run.
An applied card keeps an Undo where PaidSync.ai can reverse the change. A daily check measures the result and raises a rollback card if it got worse.
Read the change log after a week. Every applied change shows who approved it, what it touched and a before-and-after result, so you can see that nothing ran without a tap.
For the full list of checks, see the security page.
To judge another server the same way, see how to verify an ads MCP server is safe.
A rule that every change an AI wants to make to your ad account waits for a person to approve it. In the PaidSync.ai workspace each change is a card, and it runs only after you tap Approve.
Only if an admin or the workspace owner moves it into a band that acts on its own. Even then it stays inside the spend ceiling, and some tools, such as deletes and campaign launches, always need a person.
No card is written there. Your assistant's own approval setting decides whether it asks first, while dry run, the rule validator and the confirm flags still apply.
Where PaidSync.ai can reverse it, yes. An applied card keeps an Undo, and the card says so when a change has no safe inverse.
PaidSync.ai is free for 15 tasks a month with no card. Pro starts at $99 a month. Team starts at $249 a month for 5 seats. See pricing.
PaidSync.ai runs 630+ tools across 14 ad and analytics platforms. Connect your accounts once and use them in the AI assistant you already work in.
Get Started Free Book a Demo