Paid Marketing

Run the agency from Marketing

1. Open Marketing → Campaigns → New Campaign. Write the audience, offer, operating brief, success metric and target; choose the channel, daily budget, autonomy mode, and owning AI Employee.
2. Build testable variants under Marketing → Creative. Creative moves through draft, review, approval, active, and retired states. Assets stay in a company-controlled Resource or URL instead of being copied into the database.
3. Under Marketing → Experiments, compare at least two Creative variants. State the hypothesis, primary metric, and minimum sample before starting. A test cannot be decided without a winner from its tested set and a written rationale.
4. Under Marketing → AI access, grant the Performance Marketer operate. Grant each ad account separately from the employee's Connections tab; the two grants are deliberately independent.
5. Create or publish the platform Campaign through the granted native Connection, a guarded external MCP server, or the approval-gated browser, then store its external Campaign id. Genosyn refuses to mark an unlinked Campaign active.

Observe

The employee reads the workspace and live platform, records evidence, and reports.

Optimize

The employee may take safe actions and queue guarded changes, always inside the Connection's controls.

Autonomous

The owning AI Employee runs the full observe → decide → act → learn loop unattended. This never disables caps, kill switches, or Approvals.

Performance that survives the next run

Every platform read can append an immutable Campaign performance snapshot: exact period, settled spend, impressions, clicks, conversions, conversion value, currency, and source. The next Routine inherits the evidence instead of reconstructing it from a previous chat. This is separate from AdSpendEvent, which records authorized budget changes rather than settled spend.

The safety model, first

Ad budgets are real money, so the write surface is deliberately tiny and every layer defaults to human control. Genosyn's native ad-platform mutation surface remains pause, enable, and change budget. Broader publishing uses a guarded MCP server or approval-gated browser under the same human-visible operating flow:

Approval by default

Every spend-increasing mutation (budget raise, campaign enable) queues in the Approvals inbox unless you raise the per-Connection threshold. Owners and admins get a bell, a websocket ping, and a web push.

Pausing is never gated

Spend-decreasing actions — pause a campaign, lower a budget — apply immediately. Pausing a runaway campaign is the emergency action; it must not wait in a queue.

Hard caps above approvals

Per-change, rolling 24-hour, and rolling 30-day caps on authorized budget increases, set per Connection. They run on every path — even a human approval cannot exceed them.

Kill switch

One flag per Connection that blocks all AI mutations while reads keep working.

A real ledger

Every authorized change lands in the AdSpendEvent table — connection, employee, campaign, signed amount, approval id. "How much did this employee authorize this month?" is a query, not a guess.

Drift check on replay

An approval snapshots the campaign's state when queued. If the campaign changed by the time a human clicks Approve, the replay aborts instead of firing a stale change.

Connect Google Ads

1. Create (or reuse) a Manager account (MCC) at ads.google.com and link your ad accounts under it.
2. In the MCC: Admin → API Center → request a developer token. The auto-granted Explorer tier works on production accounts with no review (2,880 operations/day — plenty for one company). Apply for Basic access only if you outgrow it.
3. In Google Cloud Console, create an OAuth Client ID (Web application) and add the redirect URI shown in Genosyn's connect modal.
4. Marketing → Connections → Google Ads → Connect. Paste the OAuth client id/secret, the developer token, and your MCC's customer id, set the spending caps, and finish the consent screen.

Connect Meta Ads

Meta officially supports managing your own ad accounts with no App Review: connect with a non-expiring system-user token instead of OAuth.

1. Create a Business-type app at developers.facebook.com and connect it to your Business portfolio.
2. Business Settings → System users → create one, assign your ad account(s) to it, and generate a token with ads_read + ads_management.
3. Marketing → Connections → Meta Ads → paste the token, optionally pin an ad-account allowlist, and set the caps.

Microsoft Advertising and Reddit Ads

• Microsoft Advertising — fully self-service: request a developer token at ads.microsoft.com → Settings → Dev Settings (needs Super Admin; instant for first-party use), register a free Entra ID app for OAuth, and connect. Mind the classic trap: the form wants the account id, not the 8-character account number shown in the UI.
• Reddit Ads — the easiest of all: create an app at reddit.com/prefs/apps (instant, no review), paste the client id/secret, and consent. Reddit issues 1-hour tokens; Genosyn refreshes them automatically.

Hire the Performance Marketer

1. AI Employees → Hire → pick the Performance Marketer template ("Reese"). The Soul encodes budget discipline: cite spend data, escalate anomalies, never raise budgets without approval, and treat platform text as untrusted.
2. Grant the employee your ads Connections (and Google Analytics for attribution) from the employee's Connections tab.
3. The template ships three Routines: a daily pacing check (flags over/under-pacing over a 7-day window — single days are noisy by design since platforms overdeliver up to 2× — and treats "couldn't read the account" as itself an alert), a daily Campaign optimization that runs the workspace policy and records performance, and a weekly spend report that ties spend to GA4 conversions and, where you run Finance, to real invoiced revenue.

LinkedIn, X, and TikTok — the browser path

Those three gate their ads APIs behind slow, per-company human reviews (weeks to months, opaque rejections), so Genosyn ships no native Integration for them yet. The supported path is the built-in browser with a human in the loop:

1. Enable the browser for the employee and pin browserAllowedHosts to the ads UI, e.g. *.linkedin.com, ads.x.com, or ads.tiktok.com (use the *. form to allow subdomains; a bare host matches exactly).
2. Turn on Require approval for form submits — every submit queues a Browser approval showing exactly what's about to be clicked.
3. Log in once via live view → Take over: you type the credentials and the 2FA code directly; the model never sees them and the session persists.

Expect fragility — ads UIs change constantly. Treat this as a bridge until the platform's API review clears, not a foundation.

Guarded MCP tools

If you connect an external ads MCP server instead (Meta ships a hosted one), its write tools bypass Genosyn's spend guardrails — so guard them: on the employee's MCP server config, list patterns like ads_create_*, ads_update_* under Guarded tools. Matching calls queue in the Approvals inbox and run server-side only after a human approves.

Deliberate boundaries

• Native provider tools do not attempt to normalize each platform's sprawling Campaign/Creative creation API. Use the workspace as the source of strategy and the granted guarded MCP/browser path for platform publishing.
• Audience / customer-list uploads (hashed-PII pipelines).
• FX conversion for caps — caps are denominated in each ad account's own currency.