Paid Marketing

The safety model, first

Ad budgets are real money, so the write surface is deliberately tiny and every layer defaults to human control. There is no campaign or creative creation in v1 — AI employees can read everything, and can only pause, enable, and change budgets, under these rules:

Approval by default

Every spend-increasing mutation (budget raise, campaign enable) queues in the Approvals inbox unless you raise the per-Connection threshold. Owners and admins get a bell, a websocket ping, and a web push.

Pausing is never gated

Spend-decreasing actions — pause a campaign, lower a budget — apply immediately. Pausing a runaway campaign is the emergency action; it must not wait in a queue.

Hard caps above approvals

Per-change, rolling 24-hour, and rolling 30-day caps on authorized budget increases, set per Connection. They run on every path — even a human approval cannot exceed them.

Kill switch

One flag per Connection that blocks all AI mutations while reads keep working.

A real ledger

Every authorized change lands in the AdSpendEvent table — connection, employee, campaign, signed amount, approval id. "How much did this employee authorize this month?" is a query, not a guess.

Drift check on replay

An approval snapshots the campaign's state when queued. If the campaign changed by the time a human clicks Approve, the replay aborts instead of firing a stale change.

Connect Google Ads

1. Create (or reuse) a Manager account (MCC) at ads.google.com and link your ad accounts under it.
2. In the MCC: Admin → API Center → request a developer token. The auto-granted Explorer tier works on production accounts with no review (2,880 operations/day — plenty for one company). Apply for Basic access only if you outgrow it.
3. In Google Cloud Console, create an OAuth Client ID (Web application) and add the redirect URI shown in Genosyn's connect modal.
4. Settings → Integrations → Google Ads → Connect. Paste the OAuth client id/secret, the developer token, and your MCC's customer id, set the spending caps, and finish the consent screen.

Connect Meta Ads

Meta officially supports managing your own ad accounts with no App Review: connect with a non-expiring system-user token instead of OAuth.

1. Create a Business-type app at developers.facebook.com and connect it to your Business portfolio.
2. Business Settings → System users → create one, assign your ad account(s) to it, and generate a token with ads_read + ads_management.
3. Settings → Integrations → Meta Ads → paste the token, optionally pin an ad-account allowlist, and set the caps.

Microsoft Advertising and Reddit Ads

• Microsoft Advertising — fully self-service: request a developer token at ads.microsoft.com → Settings → Dev Settings (needs Super Admin; instant for first-party use), register a free Entra ID app for OAuth, and connect. Mind the classic trap: the form wants the account id, not the 8-character account number shown in the UI.
• Reddit Ads — the easiest of all: create an app at reddit.com/prefs/apps (instant, no review), paste the client id/secret, and consent. Reddit issues 1-hour tokens; Genosyn refreshes them automatically.

Hire the Performance Marketer

1. AI Employees → Hire → pick the Performance Marketer template ("Reese"). The Soul encodes budget discipline: cite spend data, escalate anomalies, never raise budgets without approval, and treat platform text as untrusted.
2. Grant the employee your ads Connections (and Google Analytics for attribution) from the employee's Connections tab.
3. The template ships two Routines: a daily pacing check (flags over/under-pacing over a 7-day window — single days are noisy by design since platforms overdeliver up to 2× — and treats "couldn't read the account" as itself an alert) and a weekly spend report that ties spend to GA4 conversions and, where you run Finance, to real invoiced revenue.

LinkedIn, X, and TikTok — the browser path

Those three gate their ads APIs behind slow, per-company human reviews (weeks to months, opaque rejections), so Genosyn ships no native Integration for them yet. The supported path is the built-in browser with a human in the loop:

1. Enable the browser for the employee and pin browserAllowedHosts to the ads UI, e.g. linkedin.com, ads.x.com, or ads.tiktok.com.
2. Turn on Require approval for form submits — every submit queues a Browser approval showing exactly what's about to be clicked.
3. Log in once via live view → Take over: you type the credentials and the 2FA code directly; the model never sees them and the session persists.

Expect fragility — ads UIs change constantly. Treat this as a bridge until the platform's API review clears, not a foundation.

Guarded MCP tools

If you connect an external ads MCP server instead (Meta ships a hosted one), its write tools bypass Genosyn's spend guardrails — so guard them: on the employee's MCP server config, list patterns like ads_create_*, ads_update_* under Guarded tools. Matching calls queue in the Approvals inbox and run server-side only after a human approves.

Deliberately missing (v1)

• Campaign and creative creation — the read + lever loop earns trust first.
• Audience / customer-list uploads (hashed-PII pipelines).
• FX conversion for caps — caps are denominated in each ad account's own currency.