# Safety Model

Every guardrail Adsap applies to automated actions on Meta Ads and Google Ads, what each one stops, and where it applies (web app, AI copilot, rules, recommendations).

Canonical: https://adsap.ai/docs/reference/safety-model
Updated: 2026-09-13

Adsap automates Meta Ads and Google Ads with guardrails on every action. Nothing goes live without an explicit instruction. You can preview every write first. Adsap records every action, and automated rules refuse to act on thin evidence. This page lists each guardrail, what it stops, and where it applies.

## Paused by default

Every campaign, ad set and ad that Adsap creates starts **paused**, in the web app, in Ad Sheets and in the AI copilot. Nothing spends until you activate it. The copilot sets something to active only when you say so in plain words ("launch", "go live", "activate"). An assistant guessing that you meant to launch is not enough. You can change the web app default in [Launch Settings](/guides/account-defaults/launch-settings). Leave it on paused, so you review a bulk launch of forty ads before it spends, not after.

## Confirmation before creating

In the AI copilot, creating a campaign structure shows a [card](/guides/ai-copilot/interactive-cards) that summarizes what the copilot is about to build. You press Confirm inside the card. ChatGPT adds its own confirmation step before any action that changes campaigns. [Recommendation buttons](/guides/recommendations/apply) on the Performance page open a confirmation that shows what will change. Each button does only the one thing the card suggested: pause one ad, or edit one campaign's keyword list.

## Preview before every write

You can preview any write in the copilot first. Adsap checks the request (required fields, that the account belongs to your workspace, template overrides, and the obvious Meta rule violations). It then returns the fully resolved payload without calling Meta or Google. A preview is not a guarantee. Meta's cross-entity rules, ad review and account-specific limits apply only when the real request goes out. The preview response lists warnings for anything it noticed but let through.

## Ownership checks

Before any request runs, Adsap checks it against the ad accounts connected to your workspace. It refuses an action that names an account that is not yours. Repeated failures of that kind trip an enumeration guard (15 in five minutes) that alerts the Adsap team.

## Request deduplication

Copilot writes carry an idempotency key. If the same key arrives twice, for example because an assistant retried, Adsap returns the original result instead of creating a second campaign, ad set or ad.

## Rate limits

Each copilot connection gets 200 reads and 50 writes per five minutes. Separately, every Meta-calling workflow checks a per-account daily allowance of Meta API calls. It backs off when Meta reports the account above 80 percent of its API capacity, so one busy session cannot exhaust the account's access for everyone else. These are API budgets, not spend budgets. Adsap does not cap how much money a campaign can spend; set that on the campaign or ad set itself.

## Audit log

Adsap records every copilot action: the tool used, the entity and account it touched, the request, the outcome, and how long it took. Confirmations, activations and cancellations in the copilot also go back into the conversation, so the record lives in the chat and not only on the server.

## Automation rules

A [rule](/guides/automation/rules) can only turn something off or tell you about it. It never turns anything on or raises a budget. Every rule carries four guardrails, shown on the rule itself:

- A spend floor you must set. Adsap rejects a rule without one.
- A cooldown of once every 24 hours per entity by default.
- A conversion-lag buffer that ignores the most recent day on Meta and the two most recent on Google Ads.
- On Meta, a hold while an ad set is still in its learning phase or had a change in the last two days.

The [Activity log](/guides/automation/activity) records what each rule did and why it left things alone.

## Access scope

The copilot authorizes through OAuth with two scopes, tools and write. The Adsap server holds the tokens. Your assistant never sees your Meta or Google credentials, and you can disconnect from the assistant's connector settings at any time.

## What the safety model does not do

It does not review ad policy, predict Meta's approval, cap spend, or replace reading a card before you confirm it. It makes every automated action visible and reversible before money moves.