Meta ads MCP server rules: where they live, what they cover

You connected the ad account in the spring and it came back with the numbers. Nothing in that flow ever asked what the agent was allowed to change. The question got answered anyway — by a default nobody showed you. That default now has a control surface, it arrived in July, and the thing you connected cannot tell you what it says.

Where the rules actually live

Meta's ads AI connectors announcement carries a dated update section, and the July entry runs to two sentences. The people it hands the control to are, in Meta's wording, anyone holding full control of a business portfolio. What they get is the ability, in Meta's phrasing, to govern what AI agents can do on their ad account — budget changes and catalog updates are the examples given. (Source: Meta's ads AI connectors announcement, update dated 16 July 2026.)

Portfolio-level matters more than it reads, because an ad account does not have to be in a portfolio at all. The connector's account list returns an empty owning business for accounts sitting outside one — I have such an account, and so does anyone who started advertising before they started a company. If yours is one of those, there may be no portfolio admin in the picture to set a rule.

The panel is on Meta's side, not in the client. A vendor round-up — Ads Uploader's August update page, a vendor blog rather than Meta, updated 15 August 2026 — places it under Business Settings, Integrations, Ads MCP Server, and reports that several sensitive write actions — budget changes and campaign creation among them — are reportedly on by default. Note the hedge: Meta has not published the default state and I could not confirm it either. What is not in doubt is the shape of the problem. The panel is new, so anyone who connected before July has been running under a ceiling they never picked.

Deciding what an agent may touch is the same decision whether Meta enforces it or you do. See how the weekly routine draws that line →

What the connector knows about its own ceiling

Nothing — and the shape of that nothing matters, because "the model will tell me" is the assumption it breaks. Ask for your ad accounts and each returns a fixed set of fields: whether MCP is enabled and, if not, why; whether the account is queryable and, if not, why; account status; whether a payment method is on file; currency; minimum daily budget in cents. That is the whole payload. No field names which tools are permitted, no rule object, no policy block. I pulled it today to check.

The tool surface tells the same story. I counted 95 tools on the connector and not one reads or writes a rule. Governance is deliberately out of band: a human sets it, in a browser, on a surface the model never touches. So "what am I allowed to change here?" gets you a guess wearing the costume of an answer, and the only way a session finds a rule is by walking into it.

What to look for in the panel, worst case first

I have not set these rules on an account myself, and this page will say so until I have. The ordering is not Meta's — it is the four risk classes.

1. Money HARDEST TO REVERSE

   Budget changes and spending limits. A wrong budget spends at delivery speed and there is no undo, because the impressions were already served. If you switch off one category, this is the one. The trade: every budget move becomes yours, at whatever hour you happen to notice it needs making.

2. Status

   Turning campaigns, ad sets and ads on and off. Cheaper to be wrong about, and reversible in a click — but it is also your emergency stop. The trade: restrict it and you cannot ask the agent to pause a runaway ad from a phone in a car park.

3. Creation and creative edits

   The category where the connector already does the work for you. Both creation tools describe themselves as producing objects in a paused state, so a campaign the agent builds cannot spend until a person publishes it. Leaving creation on costs clutter rather than money — put the attention into the first two instead.

• Expecting the connector to enforce your policy. It enforces Meta's. Paused-on-creation is real and server-side, and it is the only thing in that category you get for free.
• Asking the model what it is permitted to do. It has no field to read, so it answers from the tool list — which describes capability, not permission.
• Reading the rollout flag as a permission model. Whether an account is MCP-enabled tells you whether it responds, not what it will agree to change. Different failure, different fix.

Try this tonight Open Meta's business settings and look under Integrations for an Ads MCP Server entry. If it is there, read it before touching anything: whatever is switched on right now is what your agent has been able to do since the day you connected. Switch off the money category, leave the rest. If no such entry exists, you have learned the more useful thing — nothing sits between your prompt and the account except the paused-on-creation default, so the ceiling has to live in your own written instructions. Either way, finish by asking for the account's change history for the last 30 days — the connector will fetch it — because that shows what has already changed rather than what merely could.