# Is it safe to give AI access to Google Ads?

> What you actually hand over when an AI assistant connects to Google Ads, where the real risks are, and how to limit them.

It can be, but the answer depends less on the AI than on what sits between it and your account. This guide looks at what you hand over when you connect an assistant, which risks are real, and how much access suits your situation.

For how these servers work and how to compare them, see [What is a Google Ads MCP server?](/guides/what-is-a-google-ads-mcp-server).

## What you hand over

Three separate things are involved, and people often treat them as one.

- **Access to the account.** Google's API access uses one [`adwords` scope](https://github.com/googleads/google-ads-mcp) for reading and changing. A tool that asks for this scope is not limited to reading by Google, so any read-only promise has to come from the tool.
- **Your data.** Whatever the assistant reads goes to the AI provider as part of your conversation. That can include campaign names, budgets and search terms, and for an agency, client data. Check how your AI plan handles conversations, and whether your client contracts allow it.
- **Your spending power.** Anything that can raise a budget or enable a campaign can spend your money, and money spent can't be recovered, even when the setting can be put back.

## The risks that matter

**Misunderstood requests are the likely one.** "Pause the bad campaigns" depends on what the assistant takes "bad" to mean. If it judges on a week of data or the wrong conversion action, it can pause something that works. Nobody needs to attack you for this to happen.

**A wrong figure can look right.** Assistants write confidently, so a mistaken total reads like a correct one. Before you act on a number, check where it came from and which dates it covers, at least until you trust the setup.

**Text in your data can carry instructions.** Search terms come from the public, so anyone can put words into your search terms report. If an assistant treats that text as a request, it might act on it. This is called prompt injection. The defense is a step that the text can't reach, such as limits held outside the assistant and a person approving each change.

**Leaked access is the quiet one.** A key pasted into a config file or a chat can spread further than you intended. Sign-in through OAuth avoids copying a secret around, and it can be revoked later.

## How much access suits you

Match the access to the account, not to how impressive the demo was.

| Your situation | A sensible level |
| --- | --- |
| Curious, first week | Read only. Ask questions and compare the answers with Google Ads |
| Your own small account | Changes with a preview, and a tight budget limit |
| A large or fast-moving account | Reads and negative keywords first. Add budgets only after a few calm weeks |
| Client accounts | Agree it with the client first. Keep a change log you can show them |

Moving up a level should follow evidence from your own account. A good sign is several weeks of answers that matched the ad platform.

## Reduce the risk before you connect

1. **Use the smallest Google Ads role that works.** A login with [read only access](https://support.google.com/google-ads/answer/9978556) can't make changes, whatever a tool tries. It is the strongest limit for a first trial, because it doesn't depend on the tool.
2. **Set limits the assistant can't change.** A cap the assistant could raise by asking is only a suggestion. Look for limits that only a person can set.
3. **Read the prompt before you approve.** Approval only protects you if you read it. Check the account, the item and the value before and after.
4. **Review changes weekly.** Compare what changed with what you meant to change, in the tool's log and in the Google Ads change history.
5. **Know how to cut access.** You can remove a connected app in your [Google Account](https://myaccount.google.com/permissions). Try this once so you know where it is before you need it.

## When to say no

Hold off if your conversion tracking is broken, because any assistant will then optimize toward bad numbers. Hold off too if you can't explain what a tool does when something goes wrong, or if a contract or regulation stops you sending account data to an AI provider.

## How Roasby handles this

[Roasby](/google-ads) sits between your assistant and your ad accounts. The assistant never sees your ad platform access, it reads through tools, and each change has a preview step that returns a one-time token. It is told to show you the change and wait for your yes.

Limits on budgets and bids are set by people on the web, so an assistant can read them but not loosen them. There are no delete tools, new campaigns start paused, and the change log shows who changed what. Most changes can be reverted, though money already spent can't be recovered, and a change made directly in Google Ads goes around these limits.

The [safety model](/docs/safety-model) lists every rule. Your AI assistant is still software that can misread you, so keep reading what it proposes.