Can the AI make changes without my approval?

No. Mutating actions return a dry-run preview and require a matching single-use confirmation token before anything is committed. Only read-only operations like reports run without a gate.

What stops the model from changing the plan after I approve it?

The confirmation token is bound to the exact preview it was issued for and can only be used once. If the plan changes, the old token no longer matches, so a swapped-in edit is rejected.

Does approval gating slow down analysis work?

Not meaningfully. Reads run freely, so exploring an account stays fast and conversational. The checkpoint only appears when the assistant wants to write a change, which is exactly where you want to pause anyway.

Approval-Gated Ad Changes: How MCP Guardrails Work

VigilDog Team · September 2, 2026 · 6 min read

Handing an AI assistant the keys to a live ad account sounds reckless: one hallucinated budget edit and a client's daily spend triples overnight. Approval-gated ad changes exist precisely so that never happens. The model can propose, but a human confirms before anything touches the account, and this is how those guardrails actually work under the hood.

Propose, don't execute

The core idea behind approval-gated ad changes is a hard split between planning a change and committing it. When you ask an AI assistant to "pause the underperforming campaigns" or "raise the search budget by 20%," a well-built ads integration does not call the write endpoint immediately. Instead it assembles a concrete plan of exactly what it would do and hands that back to you first.

This matters because language models are probabilistic. They are excellent at reading a search-terms report and reasoning about which negative keywords to add, but they will occasionally misread an account ID, invert a bid direction, or over-interpret a vague instruction. Separating the proposal from the execution turns those mistakes into harmless suggestions you decline, rather than live changes you have to unwind.

The dry-run preview

The mechanism that makes the split real is the dry-run preview. When the model calls a write tool, the tool computes the full effect of the change and returns a structured preview instead of applying it. A good preview spells out the target entity (which campaign, ad group, or keyword), the exact before-and-after values, and any downstream effects, then issues a single-use confirmation token tied to that specific plan.

Nothing is committed until you send that token back on a matching confirm call. Because the token is single-use and bound to the exact preview it was issued for, the model cannot quietly change the plan between preview and confirm and slip a different edit past you. The VigilDog Ads MCP builds every mutating action this way, so "approve" always means approving something specific you have already read.

How an Ads MCP runs a change safely

What the gate checks before you approve

The confirmation step is not just a rubber stamp. Before a preview is even offered to you, the tooling validates the change against a set of guardrails so the plan you see is already sane.

Entity validation: the campaign, ad group, or asset actually exists and belongs to the account you are working in.
Budget and bid sanity: large deltas are flagged so a 20% raise never silently becomes a 20x one from a misplaced decimal.
Policy guardrails: ad copy, URLs, and targeting are checked against platform rules so you are not confirming a change that will be disapproved anyway.
Single-use, tamper-proof confirmation: the approval token maps to one plan and cannot be replayed or reused for a different edit.

Reads are free, writes are gated

Not every action needs a gate, and treating them all the same would make the assistant painfully slow to work with. Read operations, such as pulling a performance report, listing campaigns, or analyzing search terms, run freely because they cannot damage anything. The approval requirement is reserved for mutations: creating, updating, pausing, or removing entities, and anything that moves money.

This is why you can have a fast, conversational analysis session where the model explores the account and reasons out loud, then hits a deliberate checkpoint the moment it wants to change something. The friction lands exactly where the risk is, and nowhere else. Running Google, Meta, or LinkedIn ads from an assistant this way is covered end to end in our guide to running Google Ads from Claude.

Why agencies need the audit trail

For an agency managing client accounts, approval gating is as much about accountability as safety. Every confirmed change is a discrete, logged event with a clear author and an exact diff, which means when a client asks "who raised this budget and when," the answer is a record rather than a guess. That trail is hard to reconstruct when changes are made ad hoc through a web UI by whoever happened to be logged in.

It is worth being honest about the limit, though: a guardrail is not a substitute for judgment. The gate guarantees you saw the change and approved it deliberately, not that the change was wise. Read the diff before you confirm, especially on budgets and bulk edits. Used that way, approval gating gives you the speed of an AI operator with the control of a careful human reviewer.