When you connect Claude, ChatGPT or another agent to Meta, Google or Amazon Ads through an MCP server, the agent can do anything its tools and its login allow. Your prompt does not change that. So before an agent touches an ad account, write a one-page mandate: what it is trying to achieve, what it may change, what it must never touch, and what makes it stop.
The rule that runs through this guide:
A limit only counts if something outside the prompt enforces it. "Never spend more than €5,000" written in a prompt is a request. The same limit set as a platform cap, or blocked by the agent's permissions, is a guardrail.
This SOP is for teams putting AI agents on their own ad accounts. It is not a guide to platform automation like Performance Max, Advantage+ or Amazon budget rules. Those still matter, because your agent works on top of them, and Step 4 covers where they collide.
Who it's for: DTC brands, Amazon sellers and agencies running Meta, Google and Amazon Ads, who are testing or already using agents with ad-account access.
What you end up with: one signed mandate per agent, an access setup that enforces it, a decision log, and three prompts you can use this week.
Most teams already make these decisions. They just make them in people's heads, in Slack threads and in "ask Sarah before you raise the budget". That works when a human makes every change. It breaks when an agent can make 40 changes on a Tuesday night.
Writing the mandate forces three conversations most teams have never finished:
The decision log (Step 8) then turns every change into something you can review. After a quarter you can see which recommendations made money, which limits were too tight, and which "gut" overrides were right. That is where better decision-making comes from: not from the agent, but from finally recording what you decided and why.
An MCP server is a translator. It turns "cut bids on the worst 10 search terms" into the platform's API calls. Between your instruction and your money there are four layers, and only the bottom three can enforce anything.
| Layer | What it controls | Can it enforce a limit? |
|---|---|---|
| 1. Instructions (your prompt, Project, skill) | What the agent tries to do | No. It's a request the agent usually follows |
| 2. MCP server (the tool list) | Which actions exist at all: read-only, staged drafts, or live writes | Yes. A read-only server cannot change a bid, however it's asked |
| 3. Credential (the login or token behind the server) | What that user is allowed to do in the account | Yes. A read-only user can't raise a budget |
| 4. Platform settings (caps, exclusions, portfolios) | What any change can buy, whoever makes it | Yes. Works even if layers 1–3 fail |
What's available today (November 2026)
| Platform | Official MCP server | Can it write? | What to watch |
|---|---|---|---|
| Google Ads | Google's open-source server, released October 2025 | No, read-only | Writing needs a third-party server or your own API build. Many of these add write access with an approval queue; check how changes are staged |
| Meta Ads | Meta's hosted server (mcp.facebook.com/ads), open beta | Yes: campaigns, reporting, audiences, catalogue | Connects with your login. If you are an admin, the agent is an admin |
| Amazon Ads | Amazon's hosted server, open beta since Feb 2026 | Yes, e.g. launching Sponsored Products campaigns | Sees ad data only: no inventory, margin, Buy Box or organic rank |
| Third-party (Adspirer, Pipeboard, AI PPC tools) | Various | Usually yes | Your data passes through their infrastructure. Ask how writes are staged, logged and reversed |
Two things follow from this table. First, the safest setup on Google is the default one: the official server can't change anything. Second, on Meta and Amazon the agent inherits whatever the connected login can do, so the credential matters more than the prompt.