There is a genre of video doing the rounds at the moment that shows you how to connect an AI coding agent directly to your Google Ads account and let it manage the whole thing. Pull the keyword data, find the wasted spend, write the negative keyword lists, restructure the campaigns, adjust the bids. The demonstrations are real, the setup works, and for a business owner who has been doing that by hand on a Sunday evening it looks like an obvious win.
Most of it is a fair description of what these tools can now do. What the enthusiasm tends to skip is that you are about to give a piece of software write access to a system that spends your money every hour, unsupervised, and that the strategy being demonstrated is often one experienced practitioners abandoned years ago. Below is what the setup actually requires, what the controls are, and the two questions worth answering before you turn it on.
What connecting an agent actually involves
The plumbing is less casual than the videos suggest. Programmatic access to Google Ads runs through the Google Ads API, and that needs a developer token, which Google describes as a 22-character string issued from the API Centre of a manager account. Applying for one means supplying a working company website and an email address somebody actually monitors, and Google assigns an access level that governs how many calls you can make in a day.
None of that is difficult. It is worth noticing, though, because it is the point at which this stops being a browser tab you can close and becomes a credential that lets code act as you, indefinitely, until you revoke it.
The controls exist, and they are the part nobody demonstrates
The good news is that the agent side is better designed than the demonstrations imply. Claude Code's default permission mode requires explicit approval before any action that changes state, while read-only operations run without interrupting you. That default is the right shape for this: an agent that can read every campaign, every search term and every conversion, and cannot alter a single bid without you saying yes.
You can tighten it further. Permission rules let you allow, deny or always-ask on named tools, so an agent can be restricted to an explicit list of read-only operations and refused everything else. Where the connection runs through a connector rather than a shell command, an organisation can set a tool to always prompt, on every call, with no option to dismiss it. And there is an audit trail: Claude Code emits structured events for every permission decision and every tool result, with identifiers that let you reconstruct exactly what happened and when.
| The worry | The control that answers it |
|---|---|
| It changes something while I am not looking | Default mode requires approval for any state change |
| I want it to look but never touch | Permission rules restricted to a read-only allowlist |
| I lose track of what it did | Structured audit events for every decision and result |
| Someone quietly turns the guardrails off | Managed settings, which a user cannot override |
One honest gap is worth naming rather than papering over. Anthropic documents these mechanisms thoroughly, but publishes no specific guidance on pointing an agent at a live system that spends money. The building blocks are there. The judgement about whether your ad account is a reasonable thing to automate is still yours, and nobody has written it down for you.
The strategy underneath the demonstration is the older problem
Here is the part that gets least attention, and it has nothing to do with AI. The account structure usually being built in these walkthroughs is the single keyword ad group, where each keyword gets an ad group to itself. It was genuinely effective once. It is now widely considered outdated, and the reasons are worth understanding because they apply whether a person or an agent builds the account.
As the Google Ads specialist Dennis Moons sets out in a detailed review of the tactic, Google's matching has been widened repeatedly. Close variants arrived in 2014, exact match was expanded through 2017 and 2018 to cover reordered words and synonyms, and broad match was rebuilt in 2020 and 2021. The consequence is that several of your own ad groups now compete to show for the same search, negative keyword lists grow until they starve campaigns of traffic, and budgets get spread so thin that automated bidding never gathers enough data to work.
An agent will build that structure faster than you can. Speed is not the constraint that was hurting you.
Two questions worth answering first
The first is what you would do if it got something wrong at two in the morning. Not whether it might, but what the actual sequence is. Who notices, what tells them, how quickly the spend stops, and what the ceiling on the damage is before anyone is awake. A daily budget cap is a genuine answer to that question. "I would check in the morning" is not, at least not for an account spending meaningfully.
The second is whether the change you are about to automate is one you would make yourself. Automation is a multiplier on judgement, in both directions. If the underlying strategy is sound, an agent that pulls search term reports and drafts negative keyword lists for your approval will save you a real evening every week. If the strategy is a tactic from 2015, you now have a faster way to build the wrong account.
What we would actually suggest
Start read-only and stay there longer than feels necessary. Let the agent read the account, tell you what it would change, and explain why, while you check its reasoning against what you already know. This is not a trial period so much as a way of finding out whether the thing has any judgement about your business specifically, which is exactly what a demonstration on someone else's account cannot tell you.
Keep the credential separate and revocable, treat the audit log as something you actually read rather than something you have, and give write access one operation at a time. When we work with clients on search and online visibility, the automation is rarely the interesting part. Deciding what should be automated, and what quietly should not be, is where the work is.
The underlying point
The reason to be careful here is not that the technology is unreliable. It is that an ad account is one of the few systems a small business runs where a mistake converts directly into money leaving, continuously, without anyone doing anything. Most software fails loudly. This kind fails by working exactly as instructed.
If you are weighing this up for your own account and would like a second opinion on where the sensible line sits, that is a short conversation rather than a project.
Sources
Anthropic, Choose a permission mode and Configure permissions, Claude Code documentation. Anthropic, Connect Claude Code to tools via MCP and Monitoring usage. Google, Obtain a developer token, Google Ads API documentation. Dennis Moons, Single Keyword Ad Groups: Still Relevant?, Store Growers, updated 8 January 2026.
