AdKit

Control what an AI agent can do (access levels)

Give an AI agent read-only access to your ad accounts, or let it publish. Set a permission level per connection so an agent can pull reports without touching live ads.

Every connection you create in AdKit, whether it's an AI agent, a CLI session, or a plain API key, has an access level. The level decides what that connection can do with your ad accounts: pull reports, prepare drafts, or publish changes live. New connections get full access by default, and you can lower any of them whenever you want.

The most common reason to change it: give a reporting agent Read-only, so it can pull combined reports with no way to edit, pause, or delete a live ad.

The four levels

LevelWhat the connection can do
DisabledNothing, not even reading. Use it to switch a key off without deleting it.
Read-onlyView your campaigns and pull reports. Cannot change anything in your ad accounts.
Draft onlyCreate and edit campaigns as drafts. Drafts can only be published from the dashboard, by you.
Draft + PublishCreate and edit campaigns as drafts, and publish them. This is the default for new connections.

Every level except Disabled can read your data. And every change an agent makes is saved as a draft first, so the only difference between Draft only and Draft + Publish is who can push a draft live: you from the dashboard, or the agent itself.

Set the level when you create a key

  1. Open Devices & Keys in AdKit. The new-key dialog opens automatically.
  2. Under Access level, click Customize and pick a level.
  3. Name the key and create it.

Change a level later

You don't have to recreate a key to change what it can do.

  1. Open Devices & Keys in AdKit.
  2. Find the connection in the list. Its current level shows in the Access column.
  3. Click the access control on that row, pick a new level, and save.

The new level applies on the connection's next request.

What a read-only agent runs into

A read-only connection pulls reports and reads campaigns normally. The moment it tries to make a change, AdKit blocks the request and tells the agent that its connection doesn't have permission, with a link back to Devices & Keys. Nothing reaches your ad accounts. To allow the change, raise the level on that page and have the agent try again.

Agents you connect by login

When you connect an agent through the in-app flow ("Connect an agent" or the OAuth login), it starts at Draft + Publish. To restrict it, open Devices & Keys afterward and lower its level. Picking the level during the connect flow is coming later.

New to connecting agents? Start with the getting started guide.

Need a hand? Reach out and we'll help.