The write access is the interesting part here. How are you handling approval boundaries for campaign changes—does the agent propose changes first, or can it execute within predefined limits?

Great question! The agent asks you with every call to our MCP whether you would like to "Deny"/"Allow once"/"Allow always", that way you can keep read calls on auto-approve and review the write calls one by one to stay on the safe side :)