The risky line in agentic advertising is not between “human” and “AI.” It is the line between a draft and a live account.
An agent may be perfectly useful when it reads performance data, assembles a paused campaign and prepares a recommendation. The same agent becomes a different commercial proposition when it can launch ads, change budgets, delete campaigns or reach billing information. Brands should therefore stop buying “AI ad management” as one undivided permission. They need an authority ladder.
That is especially important for international brands connected to Chinese manufacturing. Product updates, market claims, talent rights and regional versions often travel through several teams before a campaign goes live. A faster campaign interface does not remove those dependencies. It can simply execute the wrong version faster.
What has actually changed
On February 2, 2026, Amazon Ads announced that its MCP Server had entered global open beta for Amazon Ads partners with active API credentials. Amazon says the server can connect agents to functions including creating, updating and deleting campaigns; running performance and reporting queries; managing account-level settings; and accessing billing and financial data. It also offers multi-step tools. One Sponsored Products workflow can create the campaign, ad groups and ads from a single prompt, producing a ready-to-launch campaign that still requires review and approval.
On September 29, Amazon introduced Amazon Ads Agent as the name of its unified, agentic platform across sponsored ads, Full-Funnel Campaigns, and Display, Video and Audio. Advertisers can use manual controls, let Amazon AI optimize, or combine the two. Full-Funnel Campaigns, available to all US advertisers at the announcement date, can take a budget, products and creative and use Amazon AI to plan, execute and optimize across formats. Amazon also states that advertisers approve creative before launch.
These are material platform capabilities. They are not proof that every market, platform or advertiser has completed the same transition. The IAB Tech Lab’s AAMP program, updated September 22, 2026, still treats common schemas, governance, trust and transparency as infrastructure required for agentic advertising to work at scale. The industry is gaining action interfaces; operating responsibility is still being designed.
The ONCE four-gate authority ladder
The useful procurement question is not, “How autonomous is the agent?” It is, “What business exposure can this action create?”
| Gate | Permitted work | What remains blocked | Acceptance evidence |
|---|---|---|---|
| 1. Observe | Read selected accounts, campaigns, assets and reports | No account changes or billing access | Data scope, metric definitions, query log |
| 2. Build | Create names, ad groups, budget proposals and paused drafts | No launch or live-campaign edits | Draft diff, asset IDs, product and market mapping |
| 3. Stage | Submit a complete change set for approval | No bypassing approvers or automatically unpausing | Named approver, deadline, impact note, rollback plan |
| 4. Spend | Launch, pause or change live campaigns within a fixed mandate | No out-of-scope account, market or budget changes | Action log, spend ceiling, alert, reversal result |
The ladder deliberately separates freedom to reason from freedom to spend. An agent can investigate broadly and still have narrow write access. That is not a compromise; for many teams it is the ideal design.
A simple exposure check helps before Gate 4:
Maximum exposure = action scope × unattended time × permitted spend.
This is a procurement heuristic, not an industry benchmark. If any term is undefined, live autonomy is not ready. “One Canadian campaign, a maximum five-percent budget adjustment, reviewed within 30 minutes” is governable in a way that “all international accounts, no time window, no cap” is not.
Where a production company should stop—and where it can expand
A production company that is hired to develop scripts, shoot footage, edit versions and deliver files should usually stop at creative asset delivery. It can supply a machine-readable manifest so the brand or media team can place each video correctly, but it does not need audience, billing or budget permissions.
An integrated creative partner may reasonably move into Gate 2 or Gate 3 when it also owns test design, asset naming, regional version control and performance review. The qualification is not “we know how to use Ads Manager.” The partner must be able to maintain four durable records:
- a stable identity for every asset;
- the source and limit of each product claim;
- the territory and duration of every right;
- the meaningful differences among versions.
Without those records, an agent can assemble a campaign but cannot know whether a voice, claim, product configuration or edit is valid in the destination market.
Gate 4 is a separate service category. A vendor should receive live-execution authority only when it has media operations capability, financial limits, an approval model, action logging, an emergency stop owner and a tested revocation process. At that point the vendor is no longer selling “production plus a little media help.” It is selling accountable account execution.
The creative deliverable needs an executable asset manifest
final_v8.mp4 is not enough when campaigns are assembled by connected systems. Every usable asset should carry at least:
- a stable
asset_id; - market, language, aspect ratio, duration and subtitle state;
- product SKU and the version actually shown on screen;
- approved claims and their supporting source;
- territory and expiry for talent, music, footage and voice rights;
- permitted crops, copy changes, dubbing and generative edits;
- intended campaign, stop condition and fallback asset.
This does more than make automation convenient. It preserves brand knowledge when a media agency changes, an employee leaves or a campaign moves to another platform. The decision history belongs to the brand, not to one operator’s chat transcript.
Seven fields to put into the contract
Before connecting any agent to a live ad account, the scope of work should state:
- Account and market scope. Name the exact ad account, country, brand and product line.
- Permitted actions. List read, create, modify, pause, delete and launch separately.
- Budget boundaries. Define limits per action, per day and per campaign.
- Approval rules. Name the approver, mandatory approval events and timeout behavior.
- Creative status. Identify which assets have passed brand, legal and platform review.
- Logging and rollback. Specify what is recorded, who can reverse it and the recovery time.
- Exit and revocation. Explain how access ends while the decision record is retained.
This approach is consistent with a basic reality that predates agents: platform access is already role-based. TikTok Business Center, for example, separates Analyst, Operator and Admin capabilities in its account and asset permissions. LinkedIn’s video ad permission model depends on both ad-account and Page roles. An agent should not flatten these distinctions into one “allow everything” connection.
A practical rollout decision
Start at Gate 1. Let the agent inspect data and explain a campaign problem without touching the account. Once its reasoning is repeatable, grant Gate 2 and require paused drafts. After the team can review complete change sets and trace every asset, consider Gate 3.
Gate 4 is not a graduation badge. Many brands should remain at Gate 3 indefinitely: the agent investigates, assembles and stages; a person decides whether money moves. Limited autonomous execution becomes rational only when campaign volume is high, the action rules are stable, and review plus rollback can happen inside the agreed window.
For production companies, the scalable opportunity is not acquiring a client’s super-admin login. It is building the structured layer that makes creative assets safe to call: asset identity, product truth, rights, permitted transformations and version history. That layer improves margin because it can support repeated campaign operations without turning every new market into a fresh manual audit.
The headline change is that advertising software can increasingly act. The durable procurement response is to make authority explicit before the first action is taken.
