Every guide in this library assumes the same foundation: access to your data, a place to work on it, and rules decided before anything runs. Set it up once and every build starts at the interesting part instead of a week of access requests — with governance built into the environment, not bolted onto each workflow afterwards.
Each guide ships two build paths. The manual path runs on exports and a spreadsheet — you are the automation, and it genuinely works. The MCP path connects Claude to your stack through read-scoped connections that act within caps you set, log everything, and wait for your approval. The layers below serve both.
Everything here assembles around the tools you already run — nothing below asks you to replace your stack.
Data access & exports
Everything downstream depends on clean, repeatable access to your ad platforms, analytics, and CRM. Start read-only everywhere: you can diagnose, plan, and build an entire workflow before anything needs permission to change an account. Write access comes later, per workflow, with caps attached.
Google Ads — Install Google Ads Editor and download your campaigns for offline review, or pull search terms and performance reports from the web interface. The step that matters: create a dedicated read-only user on the account instead of sharing an admin login — you can widen its access later, and every guide here starts from what that user can see.
Meta Ads — Grant analyst-level (read) access through Business settings rather than adding another admin, then export campaign and ad-set reports from Ads Manager. Confirm the export includes the conversion columns you actually optimize against before you build anything on top of it.
GA4 — Grant Viewer access on the property and export the reports your workflows need — landing pages, conversions, traffic sources. Before you trust any export, verify your key conversion events are firing; an automation built on a broken event fires confidently in the wrong direction.
CRM (HubSpot, Salesforce) — Set up a read-only user or profile and export the lists and reports your workflows draw on — lifecycle stage, source, last activity. Agree on which fields are canonical first, so every workflow reads the same definition of a lead.
API credentials (when a guide calls for them) — Some builds use the Google or Meta ads APIs directly. Request read scopes first, store the credentials in your integration platform's credential store — never in a spreadsheet or a chat thread — and record who holds them.
The spreadsheet workspace
The manual path of every guide runs in a spreadsheet, and a well-structured one is a legitimate automation environment — it just runs on your schedule instead of a trigger. Set the structure once and every export drops into the same shape.
One Google Sheet per workflow — Resist the mega-spreadsheet. One file per workflow keeps each build portable, shareable, and safe to hand to a teammate. Name files by workflow and date range, not "final-final".
A standard tab structure — Raw, Working, Output, Log — in that order. Paste exports only into Raw tabs and build formulas only in Working tabs, so a fresh import never overwrites a month of logic.
A change-log tab — Date, what changed, who approved it. This is the manual version of the audit log the agent path keeps automatically, and it is the habit that makes the upgrade painless — you already know what a good log looks like.
Looker Studio for the shared view — When someone else needs to see results, connect Looker Studio to the Output tab only. Stakeholders get a live dashboard; your working formulas stay untouched.
Integration platforms
When a workflow proves itself manually, an integration platform runs it on a schedule. You need one, not all three — pick based on how much control you want over complexity and where your data lives, and set up alerting before the first run, not after the first silent failure.
Zapier — The fastest route for simple, linear connections — a new lead lands, a row gets added, a notification fires. Set it up under a team account with shared ownership, not someone's personal login that leaves when they do.
Make — Visual scenarios with real branching and error routes, a good fit once workflows have conditions and multiple outcomes. Turn on error notifications for every scenario before you activate it — a workflow that fails quietly is worse than no workflow.
n8n — Self-hostable, which means full control over where your data flows and sits — often the deciding factor for agencies handling client data or teams with data-residency requirements. Decide who hosts it and who can edit workflows before you build the first one.
Shared credentials, wherever you land — Store every platform connection in the tool's credential store under the read-only users you created in the first layer. When a workflow later needs write access, that becomes a deliberate, visible upgrade — not a default.
A lightweight warehouse
You do not need a data warehouse to start — a well-kept Sheet is one. But there is a predictable moment when you outgrow it, and knowing the growth path in advance means you never rebuild from scratch.
Google Sheets as warehouse zero — For a single workflow reading a weekly export, a Raw tab is your warehouse. It stops being enough when multiple workflows need the same data, or the export outgrows what a spreadsheet handles comfortably.
BigQuery as the growth path — GA4 links natively to BigQuery, landing raw event data you can query directly. Set up the link early even if you will not query it for months — the export begins the day you connect it, and you cannot backfill what was never collected.
Scheduled loads for everything else — Ad platform and CRM exports can flow into BigQuery on a schedule through your integration platform or available connectors. One load, many workflows reading from it — instead of the same export pasted into three sheets.
The graduation signal — When you catch yourself pasting the same export into more than one spreadsheet, or manually joining two exports every week, that is the signal. Move that dataset to BigQuery and point the sheets at it.
The agent layer
This is where the MCP path in each guide runs: Claude connected to your stack, reading real data and either recommending actions or taking them inside limits you define. It is autonomous within bounds, not a black box — the governance pieces here are not optional extras, they are the setup.
Claude with MCP servers — Connect Claude to each data source through an MCP server — one per ad platform, one for analytics, one for your CRM. Start every connection read-scoped: the agent can read live data, diagnose problems, and draft recommendations without the ability to change anything.
An AGENTS.md instruction file — A plain-text file that defines what the agent may do, what it must never touch, and where its thresholds sit. Write it before you grant any write scope, and keep it in version control so changes to the rules are as visible as changes to the accounts they govern.
Approval gates — Decide up front which actions execute automatically and which queue for a human — by dollar amount, by percentage change, by action type. A sensible starting posture: the agent recommends everything and executes nothing until you have watched its judgment for a few cycles.
Spend caps and scope limits — When you do grant write access, attach hard limits at the same moment: a daily spend cap, a maximum change per run, a bounded set of accounts or campaigns it may touch. Caps live in the environment, so no single workflow can quietly exceed them.
The action log — Every recommendation and every action gets recorded — what triggered it, what was done, what changed as a result. Put the log somewhere the whole team can read without asking. If an action is not in the log, it did not happen inside the system.
Scheduling & monitoring
A workflow you cannot see and cannot stop is not automated — it is unattended. The last layer makes every workflow observable and reversible, which is what lets you extend its autonomy with confidence rather than hope.
Cadence that matches the decision — Schedule each workflow to the rhythm of the decision it supports, not "as often as possible." Faster than the decision cycle just generates noise nobody reads; each guide names its own cadence.
Alerts on failure and on silence — Route errors and threshold breaches to a channel someone actually watches. Then alert on silence too: a workflow that stops running produces no errors, and its absence is the failure you will notice last.
A kill-switch you have tested — One documented step that stops everything — deactivate the scenario, revoke the credential, pause the agent. Test it before go-live and make sure more than one person can pull it. Reversibility is what makes bounded autonomy safe to extend.
A standing log review — Put fifteen minutes on the calendar each week to read the action log: what ran, what it changed, what queued for approval. This is how thresholds earn loosening — the agent gets more room because the log shows it deserves it.