For two years the hard part of putting an agent near your marketing was access: developer apps, review queues, tiers. That part is mostly over. What is left is harder to buy — knowing which decisions a model should make, and being able to undo the ones it gets wrong.
What changed in access
Meta ships ads AI connectors: an MCP server that lets an agent read an ad account and create or edit campaigns, ad sets, ads, creatives, audiences and catalogs 1. One line on that page matters more than the tool list:
“All ads are paused by default until you set them live.”
Meta also says any action on your behalf needs your authorisation through the agent, and an admin of the business portfolio can block campaign creation, block budget edits, or block budgets above a set figure — Meta's example is $1,000 1.
TikTok went further and guarded less. Its MCP server packages roughly 400 endpoints as tools — campaigns, reporting, catalogs, creative, audiences, Business Center — needs no developer credential, and allows three calls a second per tool per user 2. It documents no approval step and nothing that lands paused: there, the guardrails are the integrator's job.
Google went the other way. Its open-source Google Ads API MCP server, announced on 7 October 2025, is read-only: reporting and diagnostics, no changes to the account 3. Writing to Google means the API itself, where a project sits at one of four levels — Explorer at 2,880 operations a day on production accounts, Basic at 15,000 after brand verification, Standard unlimited after a review that typically takes ten business days 4. Meta's API tiers behave the same way: 300 calls an hour per ad account plus 40 per active ad at the default Limited tier, against 100,000 plus 40 at Full 5. LinkedIn is strictest: five editable ad accounts at the development tier, and it may decline an upgrade anyway 6.
What agents do well, and what still needs a person
The split is not simple against complex, but between work with a defined procedure and a checkable answer, and work that needs judgement held over time. On CRMArena-Pro, leading agents reached about 58% success on single-turn business tasks and about 35% over several turns, while structured workflow execution came in above 83% 7. On TheAgentCompany, a set of realistic office tasks, the best agent finished 30% autonomously 8.
How they fail matters more than the rate. When Anthropic let an agent run a small shop for about a month, the failures were commercial, not technical: items priced below cost, discounts given after it said it would stop, and customers told for a time to pay into an account it had invented 9.
| Task | Reliable today? | Why | What to ask for |
|---|---|---|---|
| Pulling performance and writing the weekly read | Yes | A defined procedure over data the platform returns | Read-only access; each figure traceable |
| Drafting copy and creative variants | Yes, as drafts | Cheap to check, and costs nothing until published | No customer sees it without a named approver |
| Assembling a campaign ready to launch | Yes, if it lands paused | Structure is mechanical; starting the spend is not | Paused by default, as Meta's connector does 1 |
| Flagging wasted spend and broken tracking | Yes | Diagnostics match rules you can read yourself | The rule that fired, and its evidence |
| Day-to-day bid and budget changes | Not unattended | Editing during Meta's learning phase resets it 10 | An edit-rate limit and a per-change ceiling |
| Strategy, positioning, offer and price | No | Open-ended judgement is where success rates fall 7 | A person owns it; the agent supplies the evidence |
| Anything that moves money unprompted | No | The failure mode is commercial: money given away, figures invented 9 | Approval per action, a cap, a reversible log |
Read, then draft, then act under a cap
Adopt an agent in that order; let each step earn the next. Start read-only, for weeks: you find out whether it understands your account while it cannot cost you anything. Then let it draft — copy, variants, a campaign built and left paused — because a draft is checkable before it is expensive. Only then let it act, under a cap set outside the agent.
There is a mechanical reason not to skip ahead. Meta's ad sets usually leave the learning phase after about 50 results in the week after the last significant edit, editing during that window resets it, and Meta advises against unnecessary edits and frequent budget changes 10. An agent free to change something daily can make results worse while looking busy.
None of this is contrarian. The pattern is settled: a per-tool policy that interrupts before a call runs and offers approve, edit, reject or respond, with the run persisted so a decision can wait days 11. Anthropic's guidance prefers predictable workflows for well-defined tasks and expects autonomy to bring higher cost and compounding errors 12. The platforms' own agents follow it: Google says Ads Advisor applies changes with your review and approval 13; Klaviyo shows customer-facing work before it goes live 14. Approval is table stakes, not a differentiator.
The controls to insist on, from anyone
Five. A vendor who cannot show them all in a live account has not finished building.
- Writes land paused or as drafts — the default Meta's connector ships with 1. Nothing goes live until a person sets it live.
- Approval per tool, not per session. The standard implementation lets a tool be auto-approved, always interrupted, or interrupted on certain arguments only, which is how "under 10% proceeds, above it asks" is encoded 11.
- A hard spend cap enforced outside the agent. On Meta an admin can block any budget above a set amount 1; elsewhere the vendor must build it.
- A change log you can reverse. Google's auto-applied recommendations appear in History and Change History, and auto-applying does not increase your budget 15. That is the bar.
- No unattended spend, and a limit on edit frequency — frequency is itself a risk where edits reset learning 10.
How agent work is being priced
Pricing is moving from seats to actions. Salesforce announced on 15 May 2025 that Agentforce would move from $2 per conversation to Flex Credits at $500 per 100,000 credits, a standard action costing 20 credits, or $0.10 16. HubSpot meters agents in credits at $0.010 each, or $10 per 1,000: 50 credits to resolve a conversation, 100 to recommend outreach for one lead, 1,000 to generate one piece of content, with 500–5,000 included a month by edition 17. Intercom charges $0.99 per Fin outcome, once per conversation, over seats at $29, $85 and $132 per seat per month 18.
Two caveats. Those are vendors' published prices, read on 19 September 2026, not a market rate. And every published outcome price we found is in customer support, where a resolved conversation is an unambiguous unit. Marketing has no equivalent, so anyone quoting a price per lead invented the denominator. Gartner predicted on 25 June 2025 that over 40% of agentic AI projects would be cancelled by the end of 2027 on escalating costs, unclear value or inadequate risk controls 19. A forecast, not a measurement — but those causes are checkable before you sign.
Where a free score fits
Troy has no agents running in production, so it has nothing to report about how they perform. What it can offer is the first step: the Troy Score, a free read-only look at your accounts and your site, prepared by a strategist. The read in read, then draft, then act.
Sources
Every claim above points at one of these. Dates are the source’s own.