Every tool that touches your ad accounts holds a credential. The interesting question — the one that almost never appears on a pricing page — is what that credential can reach when somebody else is holding it.
For a lot of AI marketing tools, the honest answer is: everything. One key, one integration, every account under management. It works beautifully right up until the morning it does not.
Blast radius is the only number that matters
Security people have a plain way of putting this. Do not ask whether a credential will leak; assume it will, then ask what it reaches when it does. That is the blast radius, and it is a design decision you make long before anything goes wrong.
A single platform-wide key has the worst possible answer: one leak is every client. A per-account key has a much duller one: one leak is one account, and you can tell the client exactly which.
Three ways to narrow it
There are only really three levers, and a serious tool pulls all three.
Scope the key to one business. Not to the agency, not to the organization — to the single business whose data it is for. In Marketing OS a business-scoped key is denied by default on organization-level routes: it cannot list your other clients, because the authorization check runs before the handler and answers no. Scoping is not a filter applied to a response; it is a door that never opens.
Scope the key to reading. Most integrations only ever read. A dashboard, a reporting script, an internal tool — none of them need permission to spend money. A key that can only read cannot pause a campaign, publish a post or raise a budget, no matter what is holding it or what it has been asked to do.
Separate the key from the agent. This is the one people miss. If your AI assistant acts using the same credential your reporting script uses, then your reporting script has an AI's permissions. Marketing OS keeps the agent's ability to act inside its own tool registry, where every action carries a risk tier and the high tiers stage into an approvals inbox rather than executing.
What this looks like when an agency uses it
Say you run marketing for eleven clients.
- Each client's business has its own key. A key leaked from client four's Zapier account reaches client four's data and nothing else.
- The strategist who works on two accounts sees two accounts. Per-business grants mean access is granted per client, not per employee-and-then-hope.
- The MCP connection your team drives from Claude or ChatGPT is one URL, and what it may do is decided by the same permission ladder and the same guardrails as the app.
- When something does go wrong, the audit trail says which key, which business, which call — so the disclosure conversation is a fact rather than a shrug.
The uncomfortable question to ask a vendor
Next time you evaluate a tool that wants access to your ad accounts, ask this, in these words:
If your database leaked tonight, which of my clients' accounts could the person holding it spend money on?
A good vendor has a specific answer with a small number in it. A vague answer — "everything is encrypted", "we are SOC 2 aligned", "our team follows best practices" — is not an answer to the question you asked. Encryption at rest protects you from someone stealing a disk. It does nothing about a working credential.
Least privilege is not paranoia, it is arithmetic
None of this is exotic. Least privilege is the oldest idea in the field, and the only reason marketing tools skip it is that one key is faster to build than a key system.
The bill for that shortcut is paid once, by the customer, on a Monday. Ask early which model your tool uses — there are only two, and the difference shows up entirely on the worst day of the year.