Ad Agent Governance: Approval and Rollback for Creative

For years, a video delivery package could end with master files, aspect ratios, subtitles, thumbnails, and a usage-rights document. That boundary is shifting. Advertising systems are beginning to move beyond recommendations: they can assemble campaigns, call approved assets, change settings, and help move work toward launch.

For global brands connected to Chinese manufacturing and content supply chains, the important question is not whether AI can cut another video. It is who defines what an agent may do with that video, in which market, under whose approval, and how the team can reverse the action when a claim, price, product page, or right changes.

ONCE's position is that creative delivery now needs an operating contract: not a substitute for legal agreements, but a machine-readable and human-reviewable set of permissions, constraints, approvals, logs, expiry rules, and rollback instructions.

Four signals show the move from advice to action

TikTok's October 5, 2026 announcement says the TikTok for Business MCP lets developers build agents and tools that plan, launch, and manage advertising workflows. The same release describes Smart+ Creative Selection as a single approval workflow spanning advertiser assets, AI-generated creative, and creator content. TikTok also reported more than 200% growth in advertisers using the MCP for activation and management from July through September 2026. That is TikTok internal adoption data, not an industry-wide penetration rate.

Amazon's September 29, 2026 announcement positions Amazon Ads Agent as a unified advertising platform that can answer questions, support decisions, and take action. In Full-Funnel Campaigns, advertisers supply budget, products, and creative while Amazon's AI plans, executes, and continuously optimizes the campaign. The product still preserves manual, automated, and mixed modes; some capabilities are available in the United States while others are rolling out over the following months.

Google's May 20, 2026 Ask Advisor announcement connects agents across Google Ads, Analytics, and Merchant Center. It can use product details to help set up a campaign, but Google explicitly labels the experience as a beta for English-language accounts. IAB Tech Lab's AAMP page, updated September 22, 2026, makes the infrastructure gap visible: end-to-end agentic advertising needs standardized schemas, governance, identity verification, and transparency for repeatable execution.

Together, these sources support a narrow conclusion: executable scope is expanding. They do not prove that every platform, account, market, or workflow is autonomous.

Why a folder of finished files is no longer enough

An MP4 can tell a system what to render. It cannot reliably tell the system whether the creator's paid-media rights include Germany, whether a product claim is cleared for the United States, whether the price card still matches the current product page, or which version is safe when a campaign must be rolled back.

In a manual workflow, those answers often live in email, spreadsheets, or the memory of the person who commissioned the work. When an agent can select and activate creative, undocumented context becomes execution risk. A single mistake can propagate across markets, placements, and dozens of variants.

The answer is not simply more exports. As ONCE has argued in its work on platform-assembled advertising, source assets need to function as modular inputs. Agentic execution adds another requirement: every module needs operational conditions that a system can read and a human can audit.

The ONCE CONTROL framework

CONTROL turns creative from a passive asset into a governed operating unit. Each letter should map to fields, owners, and testable actions—not a generic checklist.

C — Context

Record the objective, SKU, market, audience, channel, funnel role, and validity window. An agent should not see only a “top-performing video”; it should understand why the asset exists and where the supporting evidence applies.

O — Operations allowed

Separate permission to read, generate a draft, upload, submit for approval, publish, change budget, and pause. A newly connected agent should not receive full execution rights by default. Start with read and draft permissions, then expand authority only when controls work.

N — Non-negotiables

Lock product facts, regulated claims, brand assets, creator rights, excluded markets, prohibited footage, and mandatory disclaimers. High-risk conditions must travel with each derivative, not remain buried in the original brief.

T — Test before action

Before launch, require a preview of the exact asset, copy, landing page, market, budget, and expiry date. New markets, new claims, or new asset sources require human approval. Low-risk resizing or an approved subtitle substitution can be eligible for bounded automation.

R — Roles and approvals

Assign brand expression to the creative owner, high-risk claims to legal or compliance, budget and launch to media, and the kill switch to the account owner. API access is not business approval.

O — Observe and log

Log the asset ID, version, provenance, requesting agent, approver, changed fields, timestamp, and outcome. Without this record, teams cannot separate a creative effect from a bidding change or an incorrect version.

L — Lock and rollback

Give every permission an expiry date, pause condition, and last-known-good version. When inventory, price, rights, landing pages, or regulation changes, the system must stop new actions and revert to an explicitly approved state.

Reprice the work around safe execution

Traditional scopes concentrate cost in production, editing, and delivery. An agent-ready system adds metadata mapping, permission design, previews, approval routing, monitoring, and rollback maintenance. A useful internal comparison is:

Fully loaded cost per safe execution = (creative production + metadata mapping + permission design + preview and approval + monitoring + rollback maintenance) ÷ approved actions completed without a rights, policy, or version failure.

This is not an industry benchmark and it does not assume a target automation rate. It distinguishes cheap volume from reusable, governed output. If a supplier counts variants but does not maintain rights, version state, and withdrawal rules, the low unit price may simply transfer operating risk back to the brand.

Who should upgrade now—and who can wait

An operating contract becomes worthwhile when at least two of these conditions apply: multiple markets or languages; high creative frequency; mixed creator and brand-owned assets; regulated or claim-sensitive categories; frequent price or inventory changes; an ad account connected to agents or automation; or multiple agencies sharing one asset library.

A single-market, low-frequency campaign with manual uploads and simple rights can usually continue with conventional masters plus a clear approval checklist. The trigger is not fashion. It is whether the execution radius has grown beyond what humans can review consistently.

Implementation should be progressive. Level one allows reading, analysis, recommendations, and drafts. Level two allows submission within approved assets and budget caps. Level three permits automatic execution only for low-risk, reversible actions. Move up only when logs are complete, version accuracy is proven, approvals behave as intended, and rollback has been rehearsed.

The purchasing decision changes

Brands should stop asking only who can produce more videos faster. The better question is who can make those videos safely reusable by both teams and agents.

For ONCE, the durable value is not commodity generation. It is the operating layer that preserves creative intent, rights, version relationships, and action rules as maintained data. A project can fund the first creative system; a retainer can keep permissions, market adaptations, expiry conditions, and rollback states current. What the client buys is not only content capacity, but controlled access to that capacity.