--- title: 'Meta ad account access for tools: keep it read-only' description: 'Separate business asset access, ad account roles and app permissions before connecting a Meta ads tool. Includes an anonymized real Read-tier result.' canonical: 'https://plainrouter.com/library/meta-ad-account-access-for-tools' format: Guide published_at: '2026-10-21' last_updated: '2026-10-21' --- # What access does a tool need on our Meta ad accounts, and how do we keep it read-only? A tool needs access to the intended business assets and ad account, plus app permissions for the operations it performs. To keep reporting read-only, limit the asset and account access, use ` ads_read ` rather than ad-management permission where the integration supports it, and separately restrict the credential your AI agent uses. ## Which layer controls what the tool can do? Business access chooses the assets a person or partner can reach; the ad account role chooses permitted tasks on that account; app permissions authorize API operations. One layer does not replace the other two. | Layer | Who grants it | What read-only looks like | | --- | --- | --- | | Business portfolio and partner access | A person with the required full control shares specific assets and tasks | Share only the required ad account and reporting tasks, not the whole business by default | | Ad account role | The account administrator or authorized business-asset manager | Analyst can view ads and reports; Advertiser and Admin also have editing powers | | App permissions at Meta sign-in | The authorizing person grants requested permissions, subject to Meta's app access requirements | ` ads_read ` is the reporting permission; ` ads_management ` enables management operations. Inspect any additional permissions separately | Checked 21 October 2026 against Meta's [partner-access instructions](), [ad account permission roles]() and [permission reference](). The standalone Ads Manager role labels and Business Suite's task-based asset controls are different interfaces; choose the corresponding reporting-only tasks where that is what your account shows. ` business_management ` concerns business assets and administration. It is not a synonym for reporting access, nor does its presence by itself establish that a tool may edit every ad. Ask which specific workflow needs it and check the assets granted alongside it. ## Can the agent answer budget questions without write access? Yes: reading an existing budget or spend report and changing a budget are separate operations. Confirm that the connector exposes the required reporting read, then give the agent its Read tier or equivalent tool allowlist. Do not grant writes merely because the question contains the word “budget.” An AI client's instruction to “only analyze” is not the same as a restricted credential. Check both the connector's effective access and the Meta authorization behind it. Revoking an agent credential and removing the provider's Meta business integration are also separate actions. ## What did a real Read-tier check return? On 21 October 2026, ` list_workspaces ` returned this effective tier. This is a real read from a Plainrouter workspace, identifiers and names omitted; the excerpt preserves the returned structure and tier. ```json { "workspaces": [ { "tier": "read" } ] } ``` It shows the credential's effective workspace tier, not the complete Meta permissions granted to Plainrouter's underlying connection. No write or refusal test was performed. ## Where Plainrouter fits Plainrouter provides a Read tier for account analysis, separately from the Meta connection's grants. Its public [connection guide]() documents ` ads_read ` for reporting, and its [MCP setup]() documents ` ads_management ` for eligible creative management; the reviewed pages do not enumerate the complete requested-permission list on the Meta sign-in screen. A Read-tier result does not certify that the provider's underlying Meta authorization is itself read-only. ## Frequently asked questions ### Is ` ads_read ` the same as the Analyst role? No. One is an app/API permission; the other is an ad account role. Both the authorized account access and the app permission must fit the requested operation. ### Do we have to make the tool a business administrator? Do not infer that from a reporting requirement. Use the specific asset and task access documented for the integration, and check any request for broader authority before accepting it. ### Does read-only access solve every AI-agent safety problem? It prevents the permitted read credential from becoming general write authority, but does not answer data handling or later approval questions. Use the [Meta AI-agent safety guide]() for those safeguards. ### Does the tool need App Review? That depends on the app's use and access requirements; an advertiser connecting a provider is not the same as developing the provider's app. The [Meta Ads API guide]() covers developer access and review separately. ## Sources Checked 21 October 2026: Meta's [business partner access](), [ad account roles](), [permission reference](), Plainrouter's [Meta connection](), [workspace tiers]() and [MCP tools](). The real read above is one credential observation, not a test of every role or Meta permission.