Every tool in this category now says "AI" on the homepage. That word covers everything from a dashboard that writes a sentence about last week to software with permission to move your budget, and the demo will not tell you which one you are buying.
These are the eleven questions that separate them. We wrote them to be asked of us too, and a couple of them have answers we would rather were shorter.
What it may do
1. What can the AI change without a human? Get this as a list of verbs, not an adjective. "Autonomous" is marketing; "may pause an ad set, may not raise a budget" is an answer.
2. How is that list changed, and by whom? If the answer is a support ticket, the vendor controls your risk. It should be a setting you own, with rungs you move one at a time.
3. Can the AI widen its own permissions? The only acceptable answer is no, and it should be structural rather than a promise about a prompt. In Marketing OS a grant only moves within an action's risk tier — it never promotes the tier itself.
4. What are the money guardrails? A daily or monthly spend cap, a ROAS floor, allowed geographies, angles that are off-limits. Ask where they are enforced. If the answer is "in the prompt", they are suggestions. They must be enforced where the action executes, so that no prompt, no setting and no model can talk past them.
What happens when it goes wrong
5. What does a high-risk action look like before it happens? Ideally a card in an inbox with the change, the reasoning and the money on the line, that a person approves or rejects.
6. Can I see every change it made, and undo one? A per-entity timeline and a revert button. Without it you are reconstructing history from ad-platform change logs at exactly the moment you have no patience for it.
7. What does the tool do when an API fails? The answer you want is that it reports the failure. A system that reports success it did not achieve is worse than one that does nothing.
8. Who gets told, and how fast? Blocked actions, failed publishes, a pixel that stopped firing, spend running hot. An alert that arrives weekly is not an alert.
What you are actually buying
9. Which channels does it really read and write? "Multi-channel" hides a lot. Ask for the list, and ask which are read-only. Ours today: Meta and Google Ads, GA4, Search Console, Shopify, the social platforms we publish to, and AI answer surfaces. Read-only where it says read-only.
10. What is the credential model? One key for every client, or per-business keys that can be scoped to read-only? This is the question with the biggest gap between vendors and the least coverage in reviews. We wrote about why.
11. Can I drive it from the tools I already use? If the only interface is their dashboard, every workflow you have gets rebuilt inside it. An MCP endpoint means your team can drive it from Claude, ChatGPT, Cursor or an editor, with the same permissions the app enforces.
The answers that should end the conversation
Three specific responses mean you are being sold a demo rather than a system:
- "It's fully autonomous" with no list of what it may do. Autonomy without an inventory is an unbounded promise about your money.
- "The AI won't do that" as the entire safety answer. Models are probabilistic; guardrails are not supposed to be.
- "That's on the roadmap" about the safety features specifically. Roadmapped guardrails are unguarded spend today.
One more, for yourself
What will you do with the hour this gives back? The honest failure mode of this whole category is a tool that generates more recommendations than anybody has time to read. If a platform's output is a longer list of things you are not doing, it has moved the bottleneck rather than removed it.
Buy the one that acts inside limits you set, tells you when it did, and lets you take it back.