Control what an AI agent can do (access levels)
An access level is what an agent is allowed to do in your ad accounts: read, prepare drafts, or publish. It applies to anything connected to AdKit, whether that's Claude, the AdKit CLI (the command-line version coding agents use), or an API key you created for a script.
You set one default per project, and you can give any single agent a different level. Your own role in the workspace sets the maximum for both (more on that at the end).
The four access levels
Every agent sits on one of these:
| Level | What the agent can do |
|---|---|
| Disabled | Nothing, not even viewing. Use it to pause an agent without deleting it. |
| Read-only | View campaigns and pull reports. If it tries to change something, AdKit refuses and tells it why. |
| Draft only | Create and edit campaigns as drafts. If it tries to publish, AdKit saves a draft instead, for you to publish from Drafts. |
| Draft + Publish | Create and edit campaigns as drafts, and publish them when you ask. |
On Draft only and Draft + Publish, every change is saved as a draft first. The only difference is who pushes it live: you, or the agent when you tell it to.
Set the project default level
The project default applies to every agent in that project, including ones you connect later. An agent with its own level (next section) keeps it when you change the default.
New projects start on Draft + Publish, so an agent can finish a job without you opening the dashboard. The trade-off is that a misread request can go live with real spend behind it. Draft only costs you one click per change in the dashboard, and nothing goes live without you. Pick Draft only if you're new to running ads through an agent.
- Open Agent Permissions with the right project selected.
- Under Default Agent Access, click Change access, pick a level, and save.
Only workspace admins can change this, because it affects every agent in the project at once.
Set a level for one agent
Any agent can have its own level instead of the project default. The usual case is a reporting agent: put it on Read-only so it can pull numbers but never touch a live ad, while your other agents keep publishing.
- Open Devices & Keys. It lists everything connected to AdKit.
- Find the agent. Its level is in the Access column. Default means it follows the project default.
- Click the sliders icon on that row, turn on Custom access, pick a level, and save.
The new level applies from the agent's next action. To put it back on the project default, open the same dialog and turn Custom access off. API keys you created by hand on that page, for the CLI or your own scripts, work the same way.
Set a level and the agent is still refused? Your own role is probably the cap.
Your workspace role sets the maximum
An agent connects through your account, so it can never do more than you can. Your role is set under Settings → Members (see Team members and access levels), and it limits every agent you connect, whatever level you picked for it:
| Your role in the workspace | Highest level your agents can get |
|---|---|
| Read only | Read-only (agents can't change anything either) |
| Write | Draft + Publish |
| Admin or Owner | Draft + Publish |
Questions? Reach out and we'll help.