Connector Permissions and Approvals: Can an AI Assistant Publish or Spend Without Asking?

It can only do what the connector has been given permission to do, and whether it asks first depends on the approval settings, not on the assistant. Some connectors only read information. Others can also change things: Meta's ads connectors, for example, are described as supporting write actions as well as reading. Before you connect anything, find out which permission level you are granting and where the approval step sits.

By Dance Technologies · Updated 2026-11-08

The short answer

A connector is the link that lets an AI assistant work with another service, such as a website platform or an ad account. Meta describes connectors as apps and services, from Meta or third parties, that you can choose to connect to its assistant. The choice is yours, and so is the scope of what you allow.

So the honest answer to "can a connector publish or spend without my approval?" is: it depends on the connector and on how you set it up. A read-only connector cannot publish or spend, whatever the assistant is asked to do. A connector with write permission can change things. Whether a human has to confirm each change depends on the approval steps built into the connector or the account behind it.

This page gives you the questions to ask. It does not test or rank any provider. For the wider evaluation, use the buyer's checklist.

Permission levels explained

Documentation rarely uses the same words twice, so it helps to sort what a connector can do into four levels. Providers may name or group them differently, and some offer only one or two.

Read. The assistant can look at information: site content, analytics, campaign performance. It cannot change anything. Risk: data exposure. Ask: which data can it see, and does that include customer details? Look for: a list of exactly what is shared.
Draft. The assistant can prepare changes, such as page copy or an ad concept, that are saved but not live. Risk: low, as long as drafts really stay unpublished. Ask: where do drafts sit, and can anything go live from there without a person? Look for: a clear statement that drafts are separate from published content.
Publish. The assistant can make changes that visitors or customers see: editing a live page, posting, changing an ad. Risk: unwanted or incorrect public edits. Ask: is there a confirmation step, and can I undo a change? Look for: version history, rollback, or an approval prompt before anything goes live.
Spend. The assistant can create or change anything that costs money, such as ad budgets, or make purchases. Risk: unplanned cost. Ask: are there budget caps, and does a person have to approve each spend action? Look for: spending limits set in the paying account itself, not just in the assistant.

The levels build on each other. A connector that can publish usually can also read and draft. Meta's own ads connectors have been described, in a community write-up, as supporting write actions such as creating or changing ads and ad sets, not only reading performance data. That is a good reason to check the level before you connect, not after.

A related point: Meta's assistant products can also browse and make purchases, according to Meta's Muse page. Spend is not a theoretical level.

Approval steps to ask for

Permissions say what is possible. Approvals say who has to agree first. When you read a provider's documentation or ask them directly, look for answers to these:

Is every write action confirmed by a person? Or can the assistant act on its own once connected?
Is there a separate approval for spending? Ideally spend is limited by the account itself, such as a budget cap on the ad account, so a connector error cannot exceed it.
Can I choose the scope when I connect? Some connections let you pick what to share. Prefer the narrowest scope that does the job.
Does a change leave a record? You want a log or version history showing what was changed, when, and through which connection.
Can I undo a change? Rollback matters more than any promise that mistakes won't happen.
Which account does the connector act as? Use a login or role with only the access the task needs, not your main owner account where you can avoid it.

A useful comparison is how Meta describes its customer-facing Business Agent: the owner sets guardrails for what it answers and when to step in. That is a different product from a connector, as explained in Meta AI Connectors vs Meta Business Agent Platform, but the principle is the same. Good setups give the owner a say over what happens automatically and what needs a person.

What "safe" does and doesn't cover

Permissions and approvals deal with unwanted edits and spend. Data exposure is a separate question, and it has its own checks:

What data leaves your systems? Read access to a customer list or order history is a privacy matter, not just a convenience.
Who runs the connection? In technical terms, a connector often runs through an MCP server, the piece that exposes a set of actions to an assistant. Ask who operates it, where credentials are stored, and what the provider's security documentation says.
Is the connector reviewed? One third-party author notes that for Muse, a connector is optional, reviewed and not guaranteed. Review by a platform is not the same as a security audit of the provider, so still read the provider's own documentation.

If a provider cannot explain these points in plain language, treat that as information.

Revoking access

Before you connect, find out how to disconnect. Don't wait until something goes wrong.

A connection usually exists in two places, and it is worth checking both:

In the assistant. Connected apps are typically listed in the assistant's settings. One third-party list says Muse's connectors sit under Settings, then Connectors. Check Meta's help documentation for the current steps, as this changes.
In the account or service being connected. If you issued a key, token or login for the connector, delete or disable it there too. Removing it only on the assistant side may leave a working credential behind.

Steps to put in place:

Write down where the connection, key or token lives before you start.
Give the connector its own credential so you can cancel it without affecting your team's logins.
Change a shared password or key if a person with access leaves.
After revoking, ask the assistant to perform a task and confirm that it fails.

If the documentation does not say how to revoke access, ask the provider before you connect.

Testing before launch

Treat the first connection as a trial, not a launch.

Use a copy where you can. A staging copy of your website, a test page, or a separate test ad account lets you see what the connector does with no public effect. Not every platform offers one, so ask.
Start read-only. If the connector offers a read-only mode, begin there and move up only when you trust the results.
Test one small change. Ask for a minor edit to an unimportant page. Check whether it asks for approval, whether the result is as requested, and whether you can undo it.
Set spend limits first. If an ad or payment account is involved, cap the budget in that account before the first test.
Check the record. Confirm you can see what changed and when.
Practise revoking. Disconnect once during the test and confirm access stops.

Only after that should you connect real accounts or give the connector publish or spend permission.

Applying it to any connector, with a disclosed Dance example

Run any connector through the same five questions: which levels does it have, where is approval needed, how do I limit scope, how do I revoke, and how can I test safely. Put the answers next to the rest of your buyer's checklist criteria, such as site ownership and export.

Disclosure: This site is published by Dance Technologies, which also owns two connectors: an AI Website Builder and a Digital Marketing + SEO connector. The site is not independent and is not a Meta product. It has not tested or ranked providers, including Dance's own. Dance's connectors are examples to look at where they fit, not winners of an evaluation.

The fair way to apply this page to Dance's connectors is the same as for any others: read their access key documentation and ask which of read, draft, publish and spend each connector can do, where approval sits, and how a key is revoked. This page does not make claims about those details, so check them with Dance's documentation directly. The comparison of Dance's two connectors explains which job each is meant for. For SEO limits that remain with a person whichever connector you use, see Does an AI Website Connector Handle SEO?.

Questions

What is the difference between read and publish access?

Read access lets an assistant view information, such as site content or campaign data, without changing it. Publish access lets it make changes that visitors can see, such as editing a live page or changing a live ad. Read mainly risks data exposure; publish risks unwanted public changes, so it needs approval steps and a way to undo.

Can a connector publish or spend money without my approval?

It can if it has write or spend permission and no confirmation step is required. Meta's ads connectors have been described as supporting write actions, not just reading. Check what permissions you grant, whether each change needs confirmation, and set budget caps in the paying account itself.

How do I revoke a connector's access?

Remove it in two places: the assistant's connected-apps settings, and the account or service where you issued the key, token or login. Then test that the assistant can no longer do anything with it. Confirm the current steps in the provider's and Meta's help documentation before you connect.

Can I test on a copy of my site?

Often, but it depends on your platform and the connector. A staging copy, a spare test page or a separate test ad account all work. Ask the provider whether it supports this. If not, start with read-only access and one small, low-risk change.

Is a read-only connector completely safe?

It cannot edit or spend, but it can still expose data. Check which information it can see, who operates the connection and what the provider's security documentation says about storing credentials.