Illustrative workflow preview
The proof
One credential. Two clients. One of them refused.
An agency manager account can reach every client under it. That is exactly the problem. Here is the same credential being allowed for one client, refused for another, and finishing a real piece of work — in one sequence.
Last updated:
In short — illustrative preview
One agency credential can safely serve many client accounts when the workspace, not the agent, decides which account it may touch.
This walkthrough shows three results in sequence: the approved client account allowed, a different client refused with RESOURCE_ID_NOT_ALLOWED before any backend call, and an approved creative delivered. The receipts below are an illustrative preview using demo data, not production evidence — authentic redacted receipts will replace them.
The sequence
- 01
One credential
A single agency manager account that can technically reach every client under it.
- 02
Two workspaces
Each bound to exactly one client account. Neither can borrow the other’s.
- 03
One allowed
The approved account returns a redacted result.
- 04
One denied
A different client’s account is refused before any backend call.
- 05
One delivered
An approved creative reaches the client destination.
Three results, one after another.
These receipts use demo data.
They show the shape of each result and what the audit records, so the workflow can be read end to end. They are not captures from a production run. Customer IDs, audit IDs, destinations and file details render as redaction blocks — those are never invented, only ever removed from something real.
Approved client account — allowed
allow demo dataThe agent asks to read the ad account its workspace is bound to. Policy checks the binding, the credential is used host-side, and a redacted result comes back.
- workspace
- client-a
- service
- google_ads
- operation
- account-scoped read
- login_customer_id
- redacted
- customer_id
- redacted
- decision
- allow
- http_status
- 200
- secret_exposed
- false
- audit_id
- redacted
The agent receives the result. It never receives the credential that produced it.
A different client account — denied
deny demo dataThe same agent, the same credential, a customer ID belonging to another client. One agency manager account can technically reach it. Policy refuses before any backend call.
RESOURCE_ID_NOT_ALLOWED
- workspace
- client-a
- service
- google_ads
- requested_customer_id
- redacted
- bound_customer_id
- redacted
- decision
- deny
- denied_before_backend_call
- true
- secret_exposed
- false
- audit_id
- redacted
The denial is the point. It is written to the audit exactly like the allow was.
Approved creative — transferred
complete demo dataA large creative moves from approved storage to the client destination the workspace is bound to. The file passes through the approved path; the credential stays host-side.
- workspace
- client-a
- source
- approved media root
- destination
- redacted
- transport
- streamed
- file_size
- redacted
- decision
- allow
- transfer_state
- complete
- secret_exposed
- false
- audit_id
- redacted
The agent finished the job. Nobody had to move the file by hand at the last step.
What this shows — and what it doesn't.
What it shows
- One credential can serve many clients without the agent ever holding it.
- The boundary is enforced by policy, not by the agent behaving well.
- A denial is a normal, audited outcome — not an error state.
- Work finishes end to end, including the file, without a human doing the last step.
What it does not show
- That every provider or account topology behaves identically. Google Ads manager accounts are the model tested most thoroughly.
- Anything about campaign performance, spend, or results. Outloop routes access; it does not run marketing.
- A guarantee that an agent will never get stuck. It completes more of the workflow without a human handing over credentials.
How the enforcement works: workspace-to-resource binding · the Google Ads setup and its proof steps · where this sits in the product.
Run this against one of your own client accounts.
Bind a workspace to one client, then try it with another client's ID and watch it refuse.