Google Ads connects via OAuth in Settings → Integrations. Like every Magistry integration, it starts read-only: the first thing the connection buys you is reporting — spend, conversions, search terms, campaign structure — with nothing changed on your account.
Read first, write later
Read access is the default grant and it powers everything the Campaign Specialist proposes: budget suggestions, bid analysis, negative-keyword candidates, dayparting patterns. You can run on read access indefinitely. Write access is a separate, deliberate step — it's tied to enabling the Campaign Manager's automation, and Magistry never asks for it as part of the initial connect.
Approval-only mode
Granting write access does not mean changes start flowing. In approval-only mode, every proposed budget or bid change lands as a pending row and waits for you. You approve, it executes; you decline, it's logged as declined. Most operators run approval-only for weeks before letting any action class run autonomous — and even then, autonomy is per action type, not all-or-nothing.
Checking what's actually granted
Settings shows a scope-gap check for every integration: exactly which scopes are granted, which the current automation level needs, and where the gap is. If the Campaign Specialist proposes something it can't execute, the scope gap is why — and the check tells you precisely which grant is missing rather than failing quietly.
- Connect via OAuth → read access → reporting works immediately.
- Enable Campaign Manager automation → prompted for write scopes → approval-only by default.
- Promote individual action types to autonomous as the decision record earns it.
Write access to your ad account is not an onboarding step. It's a decision you make after the proposals have been right for a while.