Agent-written changes to live ad accounts, safely

The team manages about 18 industrial-sector ad accounts. Agents can help with audits and campaign builds, but API changes affect live client spend. I needed a review process that made each change traceable and required a person to approve it before execution.

Analysis runs through the read-only Cloud Run connector. Writes happen in a local workspace with eight required steps: build the request, validate it through the API, show the before/after diff, get approval for that specific change, execute, report the resources, append the audit log, and query the live state to confirm it. Campaign imports also pass a deterministic validator and at least two independent reviewer agents. One first launch had a 49-agent audit. It caught API and policy defects, including an inherited negative keyword that would have blocked the client's core market.

The record contains 35 live changes across five accounts, each with the resource, before/after values and approval. Campaign builds include a blueprint, workbook and validated import file. The import tooling checks CSV round-trip fidelity because ordinary serialization was corrupting ad copy. In a separate investigation, the data didn't support the client's suspected click fraud: paid traffic was the most engaged channel. I isolated an invalid-traffic burst that the platform had already filtered at no cost, and issued a written correction to an earlier vendor recommendation.