Someone's Ads campaign spent a monthly budget in a weekend. It's a Performance Max campaign that decided 2am mattress-ad impressions in Belarus were worth $40 a click. It's a "smart bidding" test that quietly tripled its own daily cap because the toggle for that lived one menu deeper than anyone checked. We heard enough of these stories while designing the Ads team that they stopped being cautionary tales and started being a spec.
Here's what we didn't do: build "autonomous with a spending cap." It's the obvious middle ground — set a daily ceiling, let the agent run inside it, sleep easy — and we actually built a version of it before throwing it out. The reasoning that killed it: a cap is a promise the system makes about its own future behavior, and promises like that erode in specific, boring ways.
- Someone raises the daily limit during a launch push and forgets to lower it after.
- A platform update changes what "daily" means at the boundary — midnight UTC or midnight account-timezone, does a mid-day cap increase apply retroactively — and that seam is exactly where automated systems misbehave, because nobody tested the seam.
- Worse: a system that touches money at all has to be re-audited for that failure mode on every future change. Every prompt tweak, every model upgrade, every new feature becomes "could this possibly cause an unauthorized spend under some input nobody thought of."
That's not a one-time cost. It's a permanent tax that compounds with team size until it eats the roadmap.
So we drew the line as a wall instead of a dial. The Ads team plans objectives, structure, channel split, and shows its reasoning — recommend a split for a launch, and it says why:
| Channel | Budget | Why |
|---|---|---|
| Google Search | $30/day | Catches people who already have intent for the category |
| Meta | $10/day | Builds the retargeting pool for later |
The split is expected to shift once there's two weeks of click data to argue with. You can disagree with that reasoning and change the split before anything goes live, which is different from guessing what a black box decided. It profiles the audience — "small business owners who hate spreadsheets" translated into interest categories, lookalike seeds, exclusion lists, the unglamorous part that actually separates a campaign that finds buyers from one that burns budget on lookers. It drafts creative from your actual product, not stock photography — a real screenshot of the interface instead of a smiling person at a laptop who's never seen your app, and in practice that creative pulled from the real UI beats generic lifestyle stock on click-through, which stops being surprising once you notice the ad is showing the thing the person's about to click into.
Then it stages the campaign. Not a preview screen in our dashboard, not a PDF summary — the actual campaign object, built inside Google Ads or Meta Ads Manager, sitting there in paused state, exactly as if a human media buyer had assembled it and gone to lunch before hitting activate. And then it stops. The activation click, the budget, the card on file — all yours. Go into the ad platform's own interface, poke at every setting, swap a headline, delete an ad group you don't like — the platform won't have noticed or minded, because it never had the ability to un-pause the thing in the first place.
The same rule governs one other thing: posting under your name. Publishing a blog post, sending an email to your list, replying to a customer as "you." Same shape of risk — cheap to draft, expensive to have gone out wrong.
The two things agents never do alone, anywhere on the platform: spend your money, and speak as you.
One sentence of policy, and every team we ship — Ads, the content agents, the ones that touch your live site — gets checked against that sentence before launch. There's a second reason we like it beyond the audit-cost argument: it's legible.
| The guarantee | What you have to trust |
|---|---|
| "Spending is capped at $X/day" | The cap logic is correct, unbypassable by a retry storm, immune to a fat-fingered zero in a config file |
| "Spending requires a human click, full stop" | You clicked |
Much shorter chain, and you can verify it yourself in five seconds by looking at whether the campaign is paused.
Where this actually pays off is upstream and downstream of the campaign itself. Upstream: the Discovery team can stage a paused campaign against a waitlist page before anything gets built. Get a product idea, Discovery drafts a landing page and a paused campaign aimed at people who'd plausibly want it, you activate it yourself with a small budget, and a few days of signup data tells you whether to build the thing at all. A dud idea now costs a landing page and whatever you chose to spend testing it, not a quarter of engineering time on something nobody wanted — and you can run that test casually precisely because you're never one click away from an agent deciding on its own that the idea deserves more budget than you gave it. Downstream: performance flows into the same scorekeeping as search and store data, and the next planning run reads it. If a channel split from three weeks ago clearly underperformed once real conversion numbers came in, the next plan starts from that evidence instead of proposing the same generic split again. You still approve it before it spends anything — but you're approving a plan that's arguing from your actual results, not a cold start.
The test we keep coming back to: if a feature misfires on its worst day, what's the blast radius? For a draft, an unused draft. For targeting, a paused campaign you edit before it touches a dollar. Nothing in the Ads team has a worst day that costs money you didn't approve, and that's not something we tuned carefully to get right — it's the one constraint we refused to trade away for convenience.
