New workspaces start in Suggest only. Executable modes can run supported creative actions, but only after policy allows them. New ad copies are always created and verified as
PAUSED; PlainRouter exposes no activation action in this release.The governed loop
1
A person authorizes one account
A workspace owner issues an execution token for the exact Meta ad account and tier the agent may use. The agent cannot replace that account ID in a tool call.
2
The agent reads evidence
The agent can read Signals context and the approved account’s creative library. Creative proposals cite an account-bound asset record or frozen staged-asset manifest.
3
The agent submits a proposal
Each batch includes typed actions, a plain-language rationale, exact evidence fields, a stable idempotency key, and a human-supplied target.
4
PlainRouter applies policy
Policy evaluates the proposal against protected entities, quiet hours, provider state, and the selected execution mode. Unknown execution-critical state blocks execution.
5
A person or policy approves
Creative proposals require a person at proposal time. In Suggest only, approval records agreement without execution. Executable modes queue the approved batch for a fresh policy check.
6
PlainRouter executes and verifies
The execution worker rechecks current policy before any provider write. It records a durable receipt, reads the exact provider object back, and marks the action verified only when the receipt-addressed state matches.
7
The result becomes audit history
Proposals, policy decisions, approvals, provider reads, verification, compensation, outcome checks, and rollback events enter the workspace’s versioned audit chain.
Supported action types
Use
get-creative-library, upload-asset, and duplicate-ad-with-creative for the supported creative workflow. The convenience tools create proposals; they do not perform a Meta write inside the MCP request.
Execution modes
The mode is frozen into each proposal. Before execution, PlainRouter also evaluates the current policy. A newly protected target or unavailable critical provider state blocks the queued action before a write.
Verification and Landed
Landed means every action in the batch has an exact, durable provider receipt and a matching verification read. A provider write alone is not Landed. Most verification settles in the immediate bounded read window. A paused Meta ad that remainsIN_PROCESS can move to Executed pending verification. PlainRouter then performs scheduled receipt-addressed reads for up to 48 hours. It remains Not Landed during that period.
If verification finds contradictory state or cannot complete inside the safety window, PlainRouter fails closed and attempts verified compensation. A failed or incomplete restoration is surfaced as Rollback incomplete for operator attention.
For synchronous verification, the receipt state, verification summary, terminal action state, and audit events commit atomically. If local terminal persistence fails, PlainRouter can replay its durable classified evidence without another provider mutation or provider read. If retry exhaustion occurs after durable verified-creation evidence exists, PlainRouter suppresses destructive compensation and records the case for manual remediation.
Evidence boundaries
Signals reads provide aggregate account and dataset evidence. They do not prove campaign CPA, spend, budget, learning phase, or target-level performance.get_signal_health is diagnostic and cannot support a proposal containing a budget, status, or creative-spend action. Use get_performance for admissible stored reconciliation evidence. A batch is treated as spend-affecting when any action in it can affect spend or delivery; only an upload-only asset proposal may retain signal-health context.
Modeled and portfolio-only events are excluded from reconciliation-derived proposal evidence. PlainRouter does not blend them into observed performance used by governed actions.
Creative-library evidence proves the selected asset’s identity, approved-account ownership, readiness, and status. Although the library response includes last-30-day performance, that performance is excluded from the durable proposal citation and cannot be used as a winning-creative claim.
A human-supplied campaign, ad set, ad, or asset establishes selection only. PlainRouter re-reads execution-critical provider state instead of treating the supplied ID as current state.
Next steps
Connect an agent
Connect an MCP client with a workspace execution token for one advertising account.
Use creative actions
Read assets, stage an image, and propose a paused ad copy.
Review proposals
Read evidence, policy results, and execution state before deciding.
Configure policy
Set hard workspace boundaries for proposals and execution.