The four things that contain it
Containment is architectural. It is decided before the system is allowed near a live account, and it is not something a model can be asked nicely to observe.
Scope limits. The system cannot spend above a ceiling, cannot move more than a set share of a budget in one day, and cannot touch campaigns outside the set it was given. A limit that is enforced outside the model cannot be talked out of.
Approval tiers. Routine changes run on their own. Significant ones queue for one tap. Strategic decisions are not available to the system at all. The tiering is the useful part: a system that asks about everything gets approved blindly within a week, and a system that asks about nothing gets switched off.
A written record. Every action carries the data it was based on, the check that produced it and the reasoning. Without it a bad decision is not just bad, it is unexplainable, and the next thing that gets paused is the whole system.
Reversal. Bids, budgets, statuses and negatives can be put back where they were, because the previous state was recorded before the change.
Simulation mode is how you find out first
The honest way to answer "what if it gets it wrong" is to run it without letting it act. In simulation the system reads live accounts, produces every decision it would have made, and executes none of them. After two weeks you have a list to argue with: the calls you agree with, the ones you do not, and the pattern in the difference.
That list is worth more than any accuracy figure a vendor quotes, because it is computed on your account, your margins and your seasonality.
What reversal does not cover
Spend is spent. If a system raised bids on a campaign for six hours before anyone noticed, restoring the bids restores the settings and does not restore the money.
Three other things do not come back cleanly:
- Learning phases. Pausing and restarting a campaign resets the algorithm's learning on Google and Meta both, and the cost is days of unstable delivery, not a click of undo.
- Deleted history. Removing a keyword or an audience discards its performance record. Recreating it starts from nothing.
- Sent messages. An email or a live ad that reached an audience has reached them.
This is the real reason the limits matter more than the reversal. Undo is a consolation, and the ceiling is the protection.
What good looks like when it does go wrong
A system that is behaving correctly on a bad call will: stop at the limit rather than at the outcome, tell you the same day rather than in the monthly report, show which check produced the decision, and let you exclude that check from autonomous execution without switching the whole system off.
The last one is the tell. If the only control is on and off, every incident costs you the whole product.
Questions worth putting to a vendor
- What is the largest change the system can make without asking?
- Where do the limits live, in the model or outside it?
- Can it run in observation only for two weeks?
- When something goes wrong, what does the record show, and can I see one?
- Can a single check be demoted to approval-only, or is it all or nothing?
Vague answers here are the finding. The mechanics of restraint are much easier to describe than the mechanics of intelligence, so a vendor who cannot describe them is a vendor who has not built them. The prior question, what a system can reasonably run on its own, sets the ceiling on how much of this you need.