Who's watching your AI agents?: AI agents in marketing, and the access you give them

On its earnings call on 8 October, TCS described an "agentic control plane" as a key layer for its clients: one place to govern agents, track their cost and performance, and manage them from launch to retirement. Tech Mahindra used its 15 October call to talk about traceability and red teaming. HCLTech announced on 28 September that it plans to buy Robotiq.ai, a Croatian firm that coordinates agents across business software.

Cognizant went furthest. Its AI Nexus, unveiled on 23 October, gives each agent its own identity, permissions and memory, logs every task, and asks a person to sign off on important decisions. Elets CIO has the full round-up, drawing on a report in Mint.

Phil Fersht of HFS Research named the problem these products address. Agents tend to inherit the access rights of the person or app that set them up, and most of the controls on them are still manual.

The figures come from a survey of 184 marketing and advertising professionals by the ad software firm Basis, reported by PPC Land. The same survey found that 65% of respondents do not measure AI's return, plan to start, or do not know.

Ad accounts are the clearest case. Since April, Meta has offered AI connectors, in open beta, that let Claude and ChatGPT read an ad account and act on it: create campaigns, ad sets and ads, change budgets and targeting, and pause or switch on ads. Jon Loomer's review of the connector notes that it takes on all the access of the Facebook user who connects it, which can include accounts that clients or partners have shared with that user.

Then there are the agents most owners never set up. CRM tools draft and send follow-up emails, website chat tools answer buyers in the brand's name, and the ad platforms themselves now make changes by default.

From 12 October, Google Ads switched on automated promotions for some advertisers' Search and Performance Max campaigns. Google reads coupons and deals from the advertiser's own website and shows them with the ads. Each promotion runs for under 24 hours and renews while the offer is still on the site, so a Diwali banner left up after the sale keeps feeding the ads. The opt-out sits in account-level automated assets.

On 28 October, Meta turned on product browsing in existing Facebook and Instagram ads. A person who taps an ad may see product details and suggestions inside Meta's apps before reaching the advertiser's website. Advertisers who missed the opt-out can still switch it off for each ad in the Advantage+ Creative and Destination settings.

On 30 October, Meta's revised Commercial Terms take effect. A new section on AI features makes the advertiser "solely responsible" for changes Meta's AI makes to its ads, including features Meta switches on itself. Nobody signs the new terms: running ads after the notice counts as acceptance. PPC Land reports that agencies have found Meta's AI adding sitelinks, translating copy and generating images in ads where nobody had enabled those features.

Each of these is a change inside your account, made by the platform, and each needs someone on your side to check the setting.

Take a founder who connects an AI assistant to Meta with their own admin login and asks it to "scale what's working." The assistant can raise budgets on three campaigns, duplicate the best ad into new audiences and pause the rest. Each step may be sensible. Together they can double the week's spend before anyone opens Ads Manager.

The same applies to a CRM agent that sends a discount to the wrong segment, or a website chat tool that quotes last year's price. In each case, the mistake is visible to customers before it is visible to the business.

The Act calls that business the data fiduciary, and it remains responsible for processing done on its behalf by a data processor. An AI tool that reads your CRM or sends emails to your customer list is processing personal data for you. EY's summary of the Act and Rules covers the duties, including contracts with processors and access logs.

The Rules were notified on 13 November 2025, and most duties apply from 13 May 2027. They require reasonable security safeguards, and the penalty for failing to take them goes up to ₹250 crore. They also ask businesses to keep processing logs for at least a year. An agent with its own login and a change history to read is easier to account for than one running on the founder's password.

Write down each AI tool, plug-in and automation that can read or change your ad accounts, CRM, email platform and website. Next to each, note whose login it uses, what it can change, and who checks its work. Most businesses find at least one tool that nobody remembers connecting.

Then switch off what you are not using and apply the five controls to the rest. Setting up and checking the tools connected to a website, CRM and ad accounts is part of what we do. For the other side of AI in marketing, how assistants decide which brands to name, read our guide to generative engine optimisation.