01
Connect
Link ad accounts and supply paths. Credentials are scoped, rotated, and stored as references — never in prompts.
How it works· one control model
From signal to settled invoice.
A single loop, visible at every step. Humans can perform every essential operation manually; agents are optional interfaces over the same deterministic services.
01 / THE LOOP
Six steps, each with an artifact.
Each step produces something durable: a plan, a warrant, a receipt, a measurement record, a journal entry. Nothing important lives only in a dashboard.
02
Plan
Define audiences, channels, budgets, and hypotheses. Forecasts carry input snapshots and explicit uncertainty.
03
Authorize
Request a spend warrant. Thresholds may require dual control. The signing service emits a verifiable warrant; edge nodes get only public keys.
04
Execute
Bids run against signed snapshots. Reservations are atomic; an unknown or stale lease stops new bids.
05
Measure
Observed outcomes, modeled lift, and attributed contribution stay separate and labeled.
06
Reconcile
Provider invoices meet the internal journal. Corrections are compensating entries, never edits to history.
02 / A BID IS A PROMISE
The command envelope.
A bid is not a recommendation. It is a conditional promise to pay, bounded by tenant, campaign, warrant, reservation, authorization, consent, and a reversible state.
jsonPOST /v1/decisions/bid
{
"tenant_id": "tnt_acme",
"campaign_id": "camp_88f1",
"impression": { "exchange": "fixture", "floor_micros": 1200 },
"warrant_id": "w_7f3a",
"expected_revision": 14,
"idempotency_key": "0f3c…"
}The response contains a decision, a reservation reference, the policy revision used, the warrant digest, and a receipt ID. If any precondition is stale, the system returns a conflict — it never silently applies a weaker check.
Financial invariants. Internal USD is integer micro-dollars. Balance arithmetic is checked, never saturating. Double-entry legs must balance; idempotency keys include tenant, provider reference, event type, and version.
03 / CONTROL POINTS
Where the system says no.
Refusals are features. Each control point is testable and has a corresponding failure-mode test.
| Control | Question | Default on doubt |
|---|---|---|
| Warrant | Is there a valid, unexpired, signed envelope for this campaign and channel? | No-bid |
| Budget | Does an atomic reservation fit available funds? | No-bid |
| Consent | Is the audience signal permitted for this purpose? | No-bid |
| Supply | Is the inventory authorized and brand-safe? | No-bid |
| Ledger | Is the authorization ledger's state certain? | Halt new liability |
| Deployment | Has the target acknowledged the matching revision? | Not deployed |