An AI agent that can read an ad report is not the same thing as an agent that can change a budget, publish content, or message a customer.
Yet many teams still compress those capabilities into one decision: connect the account, then click allow or deny. Once the agent enters daily operations, the real question becomes more precise: at which step must it stop and wait for a person?
On September 29, 2026, Meta introduced Muse for Small Business. Meta says Muse can connect to Instagram professional analytics, Facebook Pages, Meta ad accounts, and tools including Shopify, Klaviyo, QuickBooks, Stripe, Slack, and others. It can analyze sales, campaigns, and social performance, propose a growth plan, and draft a campaign. Meta also says nothing publishes, sends, or spends without approval.
That sentence matters more than the connector list. When an agent can cross advertising, content, commerce, and financial systems, the design problem is no longer only prompting. It is permission.
Capability is not the same as authorization
Meta’s detailed Muse safety architecture states that agents will make mistakes and may be attacked through data they read. Muse therefore separates the agent from the system that authorizes connector actions and network access. Where a service supports it, read and write access are separated. Permissions can also be scoped to one action, a session, a task, a time window, or an ongoing grant.
The product team’s design account adds another useful distinction: conversational instructions are not enough for irreversible actions. Muse uses structured approval controls and keeps an activity log so the user can inspect what it is doing.
Shopify’s Spring 2026 release shows a similar operating pattern. Its early-access Campaign Autopilot runs marketing across Facebook, Instagram, Shop, and email, but it works within merchant-set guardrails such as budget, region, return targets, and permissions.
These company announcements prove what their own products provide or describe. They do not prove that marketing has already become fully autonomous. They do support one practical conclusion:
The closer automation gets to real accounts, real audiences, and real money, the less permission can be treated as an afterthought.
The ONCE Marketing Agent Permission Ladder
Instead of debating “fully automated” versus “human operated,” ONCE recommends assigning each marketing task a permission level. Do not give the entire account one blanket status.
| Level | What the agent may do | Typical work | What people still control |
|---|---|---|---|
| L0 Observe | Read data and assets | Summarize performance, inventory assets, identify FAQ gaps | Data scope and access duration |
| L1 Recommend | Propose decisions | Suggest creative directions, budget allocation, or missing proof footage | Whether to act and why |
| L2 Draft | Create without external effect | Write copy, create edit candidates, build campaign drafts | Claims, brand expression, and rights |
| L3 Stage for approval | Prepare the final external action | Upload assets, configure audiences, schedules, and budgets | Final asset, channel, timing, and amount |
| L4 Limited autonomy | Execute inside a narrow operating envelope | Test approved assets within defined channels, dates, and spend caps | Hard limits, exception rules, and rollback |
L4 is an ONCE governance model, not a statement that Muse currently lets businesses bypass approval for spending. It gives a brand a consistent way to decide how much authority to grant across different agent products.
Most first pilots can stop at L1 or L2 and still create value. Asking an agent to find underperforming ads, expired assets, and missing versions is easier to verify and reverse than immediately allowing it to manipulate spend.
Use five questions before raising the level
The same technical action can carry very different business risk. Automatically cropping an internal preview and automatically publishing a health claim are both “content generation,” but they should not receive the same authority.
Before raising a task’s permission level, assess five dimensions:
- Financial exposure: Can it trigger media spend, discounts, refunds, or a commercial commitment?
- External reach: Is the result internal, or will customers, the public, or a platform reviewer see it?
- Claims and rights: Does it involve performance claims, regulated language, likeness, music, fonts, or expiring assets?
- Data sensitivity: Will it access customer records, finances, orders, unreleased products, or account permissions?
- Recoverability: Can the action be undone cleanly, or will it leave public distribution, spend, or customer damage behind?
This does not need a fake precision score. If any dimension is materially high risk, keep an explicit human approval. Consider limited autonomy only when all five are low enough and a rollback path is clear.
Product video needs an execution card
An agent may be able to find footage, generate versions, and build an ad draft. It still cannot infer which SKU a shot depicts, whether a model release has expired, whether a claim is approved for the United States, or whether the music is cleared for paid media.
Reusable product-video assets therefore need a minimum execution card:
- asset ID and SKU;
- the product fact the footage actually demonstrates;
- allowed markets, channels, and paid-media uses;
- expiry dates for likeness, music, typefaces, and third-party material;
- approved horizontal and vertical versions and safe crop areas;
- prohibited edits or generations;
- final approver and review date.
This complements ONCE’s earlier model for delivering reusable creative workflows. The workflow explains how production can repeat. The execution card tells an agent whether it is allowed to use a specific asset in the next action.
Move from read-only to bounded action
A low-risk pilot can pass through four gates.
Observe first. Give the agent read access to one ad account and one approved asset set. It produces an issue list but changes nothing.
Then draft. Let it create copy, edits, and campaign candidates, with every output remaining internal.
Next, stage for approval. The agent completes upload, audience, schedule, and budget setup. A person checks the final action card.
Only then consider bounded autonomy. Restrict it to repetitive work with clear rights, hard financial caps, a short operating window, and an immediate pause control.
Do not measure the pilot only by time saved. Track how many drafts pass without material changes, how many outdated assets are caught, how often rollback is needed, how many human minutes each approved action requires, and which asset ID produced the action. Otherwise, apparent efficiency may simply move rework downstream.
The capability a brand must keep is the ability to stop
Meta’s Muse, Shopify’s Campaign Autopilot, and Adobe’s September 29 future of marketing playbook all place data, rules, human oversight, and agent execution inside one operating system. Google Cloud’s description of agentic production likewise keeps human oversight in the model.
ONCE’s conclusion is that buying a marketing agent should not begin with “Can it publish automatically?” Start with three harder questions: What can it see? What can it make externally real? Who can stop it immediately when something is wrong?
Mature automation does not remove people from the system. It moves machines toward reversible, repeatable actions and preserves human attention for decisions that are difficult to undo.
Production examples and next steps
Agree the deliverable formats and rights records in the production brief. Use the Huawei App Services film as a format reference; a published film does not verify the licences for another project.
Review TVC and commercial production and Huawei App Services: Lifestyle App Story Advertisement Collection. To discuss your project, send the territories, usage term, proposed assets and licence records through the English project enquiry form.
