Workflow

How Mavlers Agency turned Google Ads permissions into a 24/7 watchdog

Project Overview

Function

Google Ads account access security, monitored continuously

Use Case

Detect every access and permission change across a Google Ads MCC portfolio in real time, separate the routine from the risky, and alert the team before a quiet permissions gap becomes a security incident

Products / Services Used

  • Google Ads API (Basic Access)
  • Python
  • Supabase
  • Google Chat
  • Cloud-hosted service

Access to Google Ads accounts never stays still. New team members join, agency partners come on board, contractors get temporary permissions, and third-party tools request connections. Each request is reasonable on its own, but together they create a permissions landscape that shifts constantly and that almost nobody is actively watching. A contractor keeps access long after a project ends. A temporary permission never gets revoked. Because Google Ads does not flag these changes in a way most teams track, they usually surface in a manual audit that happens quarterly at best, well after something has already gone wrong.

We built MCC Watchdog to close that gap. It is a continuous monitoring service that keeps constant watch over who has access to every account across a portfolio, comparing each check against the last known state so any addition, removal, or privilege change gets caught the moment it happens. High-risk changes, like the granting of admin access, get flagged and prioritized, alerts land directly in the team's chat with the context needed to act, and scheduled digests build an audit trail with zero manual bookkeeping.

Performance Insights

Key results

Mins, not hrs

Detection window for an unauthorized access change

24/7

Continuous monitoring with nothing to check manually

Zero

Manual audits needed to catch a permission change

One view

Every account in the portfolio, watched centrally

Client Objectives

The access gap nobody is watching

1.
Permissions shift every day, and nobody's tracking it

New hires, agency partners, contractors, and third-party tools all request access. Each request is reasonable on its own, but together they make the permissions landscape change constantly.

2.
Access outlives the reason it was granted

A contractor keeps their login long after the project wraps, and a temporary permission is rarely revoked on schedule.

3.
Google Ads doesn't surface the changes that matter

Permission changes aren't flagged in a way most teams track, so there is nothing prompting anyone to look until it's too late.

4.
Manual audits catch problems after the damage is done

Quarterly audits, at best, mean an unauthorized change can sit undetected for months, altering campaigns or pulling data the whole time.

5.
An unnoticed access gap is a trust problem

For any agency managing spend on a client's behalf, unmonitored access isn't just an operational risk. It's an accountability issue the moment something goes wrong.

Mavlers Strategy

How MCC Watchdog works

1.
Continuous access tracking

A Python-based service runs around the clock in the cloud, integrated directly with the Google Ads API through official, Google-approved Basic Access, keeping an always-current picture of who has access to every account and at what permission level.

2.
State-to-state comparison

Every check gets stored in Supabase, so the system reliably compares the current state against the last one and detects exactly what changed: an addition, a removal, or a privilege change.

3.
Risk-based prioritization

Routine changes get separated from high-risk ones, like the granting of admin access, so the team's attention goes where it matters first.

4.
Instant alerts in the existing workflow

The moment an event is detected, a notification lands in Google Chat with clear detail on what changed and where. No separate dashboard to check.

5.
Audit-ready digests

Scheduled summary digests build a rolling audit trail automatically, with zero manual bookkeeping.

Results

What this means for agencies managing client spend

Threats caught in minutes, not months

The window for an unauthorized change to go unnoticed shrinks from a quarter to a matter of minutes.

The whole portfolio in one view

Every account is monitored continuously and centrally, with no checking accounts one by one.

Zero manual effort

Oversight runs around the clock with no audits to schedule or remember.

A defensible access history that builds client trust

A rolling record of every change supports compliance and turns account security into something the agency can prove, not just promise.

Related Case Studies

Results that speak
for them selves.

Migrating 9,000+ pages across 12 languages

Successful migration of 9,000+ pages across 12+ languages, with no critical downtime.

80% CPR reduction and 3x ROI over 6 years

Multi-channel strategy driving 50%+ monthly registration growth.

35% cost reduction while scaling SEO delivery globally

Ogilvy needed to scale SEO delivery across multiple markets without expanding headcount. Mavlers stepped in as their invisible production partner.