Giving AI agent write access** to ad accounts has been a popular topic of conversation for a few years, but, for me, it started when I got to attend Benjamin Wenner’s session on AI agents in ad accounts last October 2025 in Italy at Adworld Experience (side note: if you’ve been looking for a work reason to go to Italy… I’ll be speaking there this year, October 2026🤪) and, I thought, my stance hasn’t really changed since.
But as I kept talking with my team, thinking about it, and reading what my peers were seeing/thinking, I noticed it’s the either/or of it all that I don’t have faith in.
Giving Model Context Protocols (or MCPs) write access isn’t my wall; what I have discovered is that it moves. And read access (what I was calling the “safe” option) has its own way of making our lives a living nightmare that I didn’t consider until recently. So, if you’re reading this piece thinking I’ll defend my title argument… I am not. I wanted to explore why the line moves, what it depends on, and what happens when the thing it depends on quietly erodes.
** Read access lets an AI inspect account data and recommend changes. Write access lets it change live bids, budgets, targeting, or settings.
The gate, for me, is approval quality
I have had so many people ask me when I’ll be comfortable or willing to try handing an automation write access to an ad account (actually changing bids, budgets, targeting, live), and my answer isn’t “never.” It’s: how good is the review sitting between the model’s output and the account? Notice how I didn’t say whether a human is needed in the loop? But rather, whether that human is still doing the work of independently thinking about what they’re looking at.
That’s what matters to me, because a human “present” in the loop doesn’t automatically buy you safety. Daniela Sele and Marina Chugunova conducted a randomized online experiment (N=292) in which participants received a recommendation, either from an algorithm or another person, and, in some cases, were allowed to change the output before submitting their answer… and folks really loved having the option because 63% of recommendations were adjusted. The most interesting part: the adjustments did not make the final submission better. On average, they made them slightly worse.
The part that really caught my attention was that when the recommendation was more wrong (like, you should turn on AI Max with final url expansion/aca AND turn all keywords to broad), people were actually LESS LIKELY to intervene. But it gets better: when they did intervene, they made it worse.
So, having the authority to change something is clearly not the same thing as scrutinizing it. The participants showed a clear preference for keeping a human-in-the-loop, which the researchers read as participants either not realizing the accuracy they were giving up or knowingly trading some accuracy for the feeling of retained oversight (my name is ameet and im guilty of all of this).
I’ve Been the Disengaged Reviewer
I can recognize both sides because I’ve lived both versions of the problem. At the start of the AI craze, I wanted nothing to do with it. I refused to use it for client work or even my own work, and I only dabbled in personal/random projects where the consequences of getting something wrong were minimal.
Then, because I am who I am, I swung the other direction without realizing it. I decided to build a knowledge database for my own content, while also tracking research, accepted/rejected thoughts, etc., for the book I’m attempting to write on Automation Drift. What I ended up building is far more complicated than what I need, mainly because I assumed the system understood the project requirements better than I did. So, I let it keep building, didn’t push back on recommendations/move forward plans, and, most importantly, I wasn’t reading closely enough to notice that it was creating more problems than it was solving 🫠
The context problem is real, and smaller than I used to think it was
These systems often work with less context than they need. But handing an automation your website and a short list of services doesn’t magically give it enough information to run Google Ads or Meta in the business’s favour. Google’s own Search Themes documentation acknowledges the gap: landing pages, feeds, and assets do not always contain everything its AI needs to know about a business.
What has changed for me is how much context I think the system needs in front of it. I used to think the answer was everything, indefinitely: every thread, task, and decision. I don’t anymore. A well-retrieved slice can be enough, as long as the original records still exist underneath it. The danger isn’t a smaller working context, but rather replacing the source material with a summary and assuming nothing important disappeared. Research on long-term model memory suggests that summaries and extracted facts can weaken long-horizon question answering.
So, retrieve less if it helps and keep the originals. But deleting the transcripts because the structured database “should” be enough? I haven’t tested it, and I’m not going to write it here as if I have.
The part I don’t have an answer for
This is the part I actually don’t have an answer for, and it’s sitting on the read-only side of the line, the side I called safe.
If an MCP can pull everything and an LLM can pattern-match across it all, the analyst stops doing that work themselves. I said this out loud to myself, and it came out more certain than I expected: yes, I think that it happens; I’ve caught it in my own work. What I can’t tell you yet is whether the skill disappears, goes temporarily quiet, or migrates somewhere else.
Performance Won’t Reveal the Problem Early Enough
I used to think the check was performance: did the account’s numbers go up or down? I don’t think that holds anymore. Output can stay strong while the judgment underneath it quietly checks out, because the system’s doing the heavy lifting and the person’s just reviewing instead of actually reasoning through it.
Here’s a signal that’s closer to real, even though it has nothing to do with ad accounts: when researchers redirected search traffic into an AI Mode-style experience, people clicked through to the original source 18.8 percentage points less than they did in ordinary search. Hide the AI summary entirely, and click-through jumps back up 8.8 points. Trust dropped too. That study isn’t measuring whether the AI’s answers were any good; it’s measuring whether people still bothered going to the source. Which is the leading indicator (worth testing) I didn’t have: not “is the output still good,” but “am I still going to the account and the raw reports, or am I just reading what the summary told me was there.” Cheap to check, and you can check it constantly, unlike performance, which is expensive and shows up late.
Skill Loss Is Possible. It Isn’t Proven.
Now, the EEG study that you’ve probably seen making the rounds on social media. This study found that people writing essays with an LLM’s help showed weaker, less coordinated brain activity than people writing unaided, forgot more of what they’d just written, and reported feeling less ownership over it. Real finding, genuinely suggestive, and I want to be careful with it, because it is not a brain scan showing damage and it does NOT prove anything is permanent; it’s activity recorded during one task, the group that would actually tell you about carryover was eighteen people, and other researchers have already raised five separate methodological concerns about it. So here’s where I actually land: durable skill loss is a real hypothesis, but this study doesn’t prove it, and I’m not going to pretend it does just because it’s convenient for my argument.
What holds up better, across an endoscopy study, GPS research, and aviation cognitive-skill work, is something narrower and less dramatic: skills go quiet selectively, not globally, mostly when you’re not paying attention to them for a while. In the endoscopy study, doctors’ unaided adenoma-detection dropped from 28.4% to 22.4% after they got used to AI-assisted screening. GPS users know their surroundings worse without actually getting lost more. Pilots lose the manual stuff while keeping the scanning stuff. Whether that’s a temporary lull or the start of something real, I can’t tell you. Neither can the research, yet.
And there’s a third option I have to sit with honestly: maybe what looks like decay is actually migration. The skill of doing the analysis yourself hands off to the skill of catching the analysis when it’s wrong. If that’s true, you’d expect one thing to decline while the other holds up or improves. I don’t have that data. I’m calling it out anyway, because if I don’t, I’m essentially deciding the worst version of my own argument is the only one on the table, and it isn’t.
A Practical Check: Source-Access Rate
- Are analysts still opening the live account?
- Are they checking the raw reports against the summary?
- Can they reconstruct the recommendation without asking the agent?
If those answers start drifting toward “no” while performance still looks fine, that’s the warning. It’s not proof the skill is gone, but a reason to check whether the reviewer is still doing the work that makes their approval worth anything.
Platform Incentives
Platforms are banking on the skill atrophy. The incentives are right there: more automated, more opaque, more dependent. I don’t have an internal memo or a regulatory finding that says a platform set out to make advertisers worse at their jobs, and I’m not going to write it as if I do. BUT Anthropic is publicly researching skill loss from AI use, AND OpenAI built a “Study Mode” specifically to preserve active reasoning. Those exist too. What I actually have evidence for is the shape of the incentive, not the motive behind it.
The gate depends on the thing it’s supposed to be protecting against
Put the pieces together and here’s the shape of my actual position, which is a lot more complicated than when I initially started this journey: the thing that’s supposed to let write access happen safely, a genuinely engaged human reviewer, is exactly the thing that erodes under the same read-only automation I was calling the safe option (“human oversight is needed” was my top used phrase on stage & in my writing 2023, 2024, 2025 and up until this moment, 2026). Approval quality is the gate. Read-only use, left unattended, is what wears the gate down. That’s not a contradiction I’m going to pretend to resolve for the sake of a clean ending.
The Stronger Counterargument Is Architecture
A stronger, colder counterargument sits underneath all of this: maybe approval quality was never the right variable to begin with. Maybe what actually determines whether an automated write causes damage isn’t how carefully a human looked at it. Maybe it’s how tightly the permissions were scoped, whether the system could act outside what was actually reviewed, whether anything would have caught it if it had, and who had the authority to stop it. On that reading, the Hugging Face incident isn’t really about anyone’s approval judgment; it’s about architecture, not cognition.
OpenAI’s report describes an internal advisory on June 27 that a stop wasn’t required, a resumption within days, and execution that reached production on 41 Hugging Face worker nodes with root access on at least one. Hugging Face’s own account says there’s no evidence anything customer-facing (public models, datasets, Spaces, packages) was tampered with, though the incident still exposed the limits of a control environment that looked legitimate on paper. The decisive questions were underneath the approval conversation: how tightly access was scoped, whether anyone was watching closely enough, and who had the authority to stop the system.
I think you can hold both of these without pretending one refutes the other: hard architecture bounds how bad the worst case can get, and approval quality governs how good the ordinary, everyday case is. My argument has mostly been about the ordinary case, and about what happens to it slowly, over time, if nobody’s paying attention to the reviewer’s own habits.
So, I don’t currently know what would have to be true for me to hand over unsupervised, bounded write access. I’m not saying nothing could ever meet that bar; I’m just saying I can’t name it today, and I’ve tried.
I don’t know. It still makes me uneasy.