The AI proposes. You approve. Then it acts.

Why this is the feature and not a footnote

Read-only integrations are safe because they are useless. The valuable half of this job is acting: building the campaign, pausing the loser, moving the budget. That is also where the risk is, which is precisely why the safety model has to be a design decision rather than a paragraph in the terms.

We are not going to pretend an AI should be trusted to spend money unattended. Language models misread things. They misread them rarely, confidently, and occasionally at scale. The correct response is not to promise better models. It is to make the expensive actions structurally require a human.

We would rather be the tool that asks than the tool that explains what went wrong afterwards.

Three layers

The protection is not one switch. It is three, and each one covers a different failure.

• Read by default. 71 of the 149 tools cannot change anything. The free tier is 25 read-only tool calls a month, so the starting posture of an account is look, do not touch. Writes require a paid plan, which means nobody accidentally arrives at write access.
• Created paused, forced server side. Every campaign, ad set, ad and Amazon entity Muze creates is created paused, and the status is forced by Muze's API rather than set by the assistant. create_meta_campaign describes it as an MCP safety rail. create_meta_campaign_flow builds four layers and pauses all of them. The Google launch tools force the status server side. launch_amazon_wizard forces paused over MCP. launch_meta_ads_bulk leaves the staging ad set paused so a batch cannot leak.
• Confirmation on the dangerous ones. 13 tools are classed as destructive, and they behave differently. pause_ad, to take the clearest case, requires confirm=True and its own description instructs the assistant to ask you first when it is false. Pausing, resuming, archiving and disconnecting all sit in this class.

The tools that warn you in their own description

The part of this design we are most pleased with is not visible in the UI, because it is in the tool metadata. The warnings are written where the model reads them.

archive_amazon_campaign states that archiving is irreversible on Amazon and tells the assistant to use set_amazon_campaign_state with PAUSED instead if the goal is merely to stop spend. apply_google_campaign_action states that spend changes take effect immediately. update_meta_ad_set notes that budget changes affect spend immediately, and specifies that the amount is in minor currency units, which is the kind of detail that turns a fifty dollar budget into a five thousand dollar one when nobody writes it down. update_google_autopilot_settings and update_amazon_autopilot_config both carry an explicit caution about authorizing autonomous changes.

The effect is that a well-behaved assistant is warned before it acts, not after. That is worth more than a confirmation dialog nobody reads, because the model is the one making the mistake you are trying to prevent.

What it does not protect you from

An approved change is still your change. Confirm-gating protects against misunderstanding, not against being wrong.

Autopilot is an explicit exception you opt into. Enabling it authorizes scheduled changes without a per-change confirmation, and both enabling tools say so.

Some platform actions cannot be undone by anyone. Archiving an Amazon campaign or ad group is irreversible on Amazon's side, which is why those tools are classed as destructive and why they suggest the reversible alternative in their own text.

Access is scoped to the accounts you authorize during OAuth and is revocable. disconnect_amazon revokes Muze's stored Amazon credentials, and your campaigns keep running while Muze simply loses access. disconnect_merchant_center does the equivalent for Merchant Center.

And the commercial part, since it is also a safety question

Muze never takes a percentage of ad spend. You pay for software, your budget stays in your own ad accounts, and Muze never touches or holds it. Tools and agencies paid as a share of spend are paid more when you spend more, and we think that is a conflict of interest sitting inside the recommendation engine.

Connection is OAuth. No developer account, no API token to mint, no platform passwords handed to a third party.

What to type

These are prompts, not commands. Any MCP client will do: ChatGPT, Claude, Cursor or anything else that speaks the protocol.

• “Show me what you would change before you change anything.”
• “Pause the three worst ads, one at a time, and confirm each with me.”
• “Build this campaign but leave everything paused so I can review it in Ads Manager.”
• “What can you currently change in my account without asking me?”
• “Is autopilot enabled anywhere on my accounts right now?”

The tools behind it

149 tools: 71 read, 65 write, 13 destructive. The split is not cosmetic. It determines what an assistant is allowed to do without stopping to ask.

• pause_ad (destructive, confirmation required): Requires confirm=True. Its description tells the assistant to ask first.
• create_meta_campaign (write): Always created paused. Described in the tool as an MCP safety rail.
• create_meta_campaign_flow (write): Four layers, every one created paused.
• launch_amazon_wizard (write): Forced paused over MCP so nothing spends until enabled.
• archive_amazon_campaign (destructive, confirmation required): Irreversible on Amazon, and the tool says so and offers the reversible alternative.
• apply_google_campaign_action (write): Warns in its own description that spend changes take effect immediately.
• disconnect_amazon (destructive, confirmation required): Revokes Muze's access. Your campaigns keep running.
• get_my_usage (read): Plan, monthly limit and remaining units, so quota is never a surprise.

Platforms covered. All four: Meta Ads, Google Ads, Amazon Ads and Shopify.

Nothing spends without you

• Every write previews first and waits for explicit confirmation.
• New campaigns are always created paused, enforced server side rather than by the assistant.
• 13 tools are classed as destructive and require confirmation: the pausing, resuming, archiving and disconnecting tools.
• Access is scoped to the accounts you authorize at OAuth and can be revoked at any time.
• Muze never takes a percentage of ad spend and never holds your budget.

Frequently asked questions

Can Muze spend my money without asking?

No, unless you have deliberately enabled autopilot. Every write previews and waits for confirmation, new campaigns are created paused, and enabling a paused campaign is a separate action classed as destructive.

What does created paused actually mean?

It means the paused status is forced by Muze's API before the request reaches the ad platform, rather than being a field the assistant fills in. A launch produces a campaign sitting in your account doing nothing, waiting for you to review it in the platform's own interface.

Can I give an AI read-only access to my ad accounts?

Yes, and that is the default. 71 of the 149 tools are reads, and the free tier is 25 read-only calls per month. Write actions require a paid plan, so read-only is where every account starts.

What happens if the AI misunderstands my instruction?

In the worst realistic case you get a paused campaign that is wrong, which you delete. The actions that could cost money immediately are the ones that require explicit confirmation, and several of them warn the assistant about their consequences in the tool description itself.

Are there any actions that cannot be undone?

Yes. Archiving an Amazon campaign or ad group is irreversible on Amazon's side. Those tools are classed as destructive and their descriptions point at the reversible alternative, pausing, before you commit.

Can I revoke access?

At any time. Access is scoped to the accounts you authorized during OAuth. disconnect_amazon revokes Muze's Amazon credentials and your campaigns keep running normally, and disconnect_merchant_center does the same for Merchant Center.

Does Muze take a percentage of my ad spend?

Never. You pay for the software and your budget stays in your own ad accounts. A tool that earns more when you spend more should not be the one recommending that you spend more.

Read next

Other features

Or see every Muze feature.