Ad automation for franchises: who approves what

Why franchise ad ops is structurally different

A single-location advertiser has one owner, one set of campaigns, and one person clicking approve. A franchise network has a corporate brand, regional co-ops, and potentially hundreds of individual operators — each of whom has a legitimate stake in the ad account that covers their territory.

The problem is not campaign creation. Any platform can do that. The problem is who can approve a budget change, who can pause a campaign, and what happens when HQ pushes a creative update the franchisee disagrees with. Most tools ignore this entirely and hand everyone admin access.

The three-tier permission structure that works

SpendSignoff models franchise hierarchies with three roles: org owner (HQ), member (regional manager or franchisee), and read-only (auditors, agency partners). The critical rule is that only org owners can issue approvals on campaigns tagged scope:brand. Members can approve changes within their own scope:local account only.

Every proposed change is a typed draft with a before→after diff. HQ can draft a brand campaign and assign it to franchisee accounts for approval — but the franchisee sees exactly what will change before clicking confirm. There is no silent override.

• HQ role — draft brand campaigns, push creative updates, set spend floors and ceilings for all accounts.
• Franchisee role — approve or reject HQ drafts for their account, draft local extensions, approve local changes.
• Read-only role — view campaign state and audit log, no draft or approve access.

Audit trail for the legal team

Franchise agreements often require documentation of who authorized a spend change, when, and from which account. SpendSignoff's KMS-signed audit log records every draft and every approval as a tamper-evident entry. Each log entry includes the actor's Clerk identity, the affected account, the before/after state, and the timestamp.

That log is exportable. When your franchisee dispute attorney asks "who approved the $800/day budget on the Denver account," the answer is three seconds away, not three days.

Setting up a franchise org in SpendSignoff

The setup is flat: one SpendSignoff org per franchise network. Each franchisee ad account is connected via their own OAuth grant — they authenticate against Google or Meta directly, so their credentials are never shared with HQ or the platform. Sub-accounts are organized by a location_id tag that maps to your internal franchise ID system.

# SpendSignoff account metadata (set at connect time)
{
  "account_id": "google:123456789",
  "location_id": "franchise:denver-co-01",
  "scope": "local",
  "spend_ceiling_daily_usd": 500
}

Where this still requires human judgment

Automation does not resolve brand versus local disputes — it surfaces them clearly so a human can decide. If a franchisee rejects an HQ draft for the third consecutive week, that is a relationship conversation, not a permissions change. The tool's job is to make the disagreement visible before money is spent, not to pick sides.