> ## Documentation Index > Fetch the complete documentation index at: https://plainrouter.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Action policy and safety > Configure workspace safeguards for proposals, creative execution, verification, and rollback. Open **Settings** → **Action policy** to review the workspace's non-negotiable boundaries. Agents can supply reasoning and proposals, but they cannot edit or bypass policy. Only the workspace owner can save policy changes. Other workspace members can review the current settings. When the owner changes a policy setting, PlainRouter appends a workspace-scoped `policy.updated` event to the v2 audit chain. The event identifies the owner and records the complete policy before and after the change. Saving the same values again does not add a duplicate event. Policy changes that allow execution are saved atomically with their audit event. If audit-ledger integrity prevents the event from being appended, PlainRouter does not save the executable change. You can still switch to **Suggest only** as a safe fallback, but PlainRouter warns that the audit ledger requires repair if it cannot record that change. ## Execution mode | Mode | Behavior in this release | | ---------------------- | ---------------------------------------------------------------------------------------------------------- | | **Suggest only** | Every passing proposal waits for a person. Approval records the recommendation without execution. | | **Auto within limits** | Supported creative proposals require human approval, then queue execution under all hard stops. | | **Full auto** | Uses the same hard safeguards. Supported creative proposals still require human approval at proposal time. | New workspaces default to **Suggest only**. The selected mode is copied into each proposal as an immutable snapshot. Executable modes currently support only JPEG/PNG image upload and `duplicate_ad_with_creative`. Budget changes, delivery-status changes, video upload execution, and ad activation remain disabled. ## Two policy gates Executable creative work passes policy twice: 1. Proposal-time policy decides whether to block or request human approval. 2. After approval, execution-time policy re-reads authoritative provider state and must return `allow` before any write. Changing policy does not promote or rewrite an existing proposal. A newly protected target, quiet-hours window, missing driver, unavailable critical field, or other non-`allow` result blocks the queued batch before provider execution. ## Spend boundaries ### Maximum budget change The maximum percentage change allowed per budget action, measured from the target's current daily budget. ### Hard account daily cap The maximum projected combined daily budget for the account. Leave it blank for no configured cap. Budget actions remain non-executable in this release. Their current account and target state is reported honestly as unavailable rather than inferred from aggregate Signals data. ## Protected delivery ### Protected entities Add one platform-native entity reference per line: ```text theme={null} campaign:120012345 ad_set:120067890 ad:120098765 ``` Supported prefixes are `campaign`, `ad_set`, and `ad`. An exact match blocks the proposal. The execution-time recheck also stops an approved batch if its source ad becomes protected before the worker runs. ### Protect learning phase When enabled, PlainRouter blocks applicable delivery changes while the target is learning. Creative duplication re-reads the source ad and nested ad-set learning state from Meta. If the required learning state is unknown, execution is blocked. Image upload does not require target learning-phase state. ## Timing and outcome safety ### Quiet hours Set both a start and end time. PlainRouter evaluates the window in the advertising account's timezone, falling back to the application timezone if the account has none. Quiet hours can cross midnight. For example, `22:00` to `06:00` blocks proposals and execution during the overnight window. ### Outcome check after Sets the delay before checking a verified creative action's provider outcome. The accepted range is 1–168 hours. ### CPA anomaly threshold Sets the percentage threshold that classifies a provider outcome as anomalous. A verified anomaly can trigger automatic compensation. Aggregate Signals reconciliation is never substituted for target-level provider outcome data. ## Verification and compensation PlainRouter does not treat a successful provider response as proof that an action Landed. It persists an execution receipt and re-reads the exact object. * Image upload verification matches the receipt asset, frozen content hash, and provider readiness. * Ad-copy verification matches the receipt ad, approved account, selected creative, and permanent `PAUSED` state. * An `IN_PROCESS` copy can enter durable asynchronous verification for up to 48 hours. * Hard mismatches, provider rejection, verification expiry, or later anomaly trigger compensation. * Compensation is itself verified: an uploaded image must be absent after deletion, and a copied ad must be `ARCHIVED` after rollback. If commit state is unknown, PlainRouter reconciles before retrying. It does not issue unsafe compensation without a trustworthy receipt target. ## Current enforcement boundary | Check or action | Current result | | ------------------------------------------------------------------------ | ------------------------------------------------------------------------ | | Human approval for executable creative proposals | Enforced. | | Proposal-time and execution-time policy | Enforced. | | Protected entity and quiet hours | Enforced. | | Provider account, source, asset readiness, and applicable learning state | Re-read and fail-closed. | | Image upload and paused ad duplication | Executable with receipts, verification, outcome reads, and compensation. | | Duplicate-ad activation | Not exposed. | | Budget and status execution | Disabled. | | Video upload execution | Disabled. | | Unknown provider commit | Reconciled before any retry or compensation. | This boundary preserves suggest-only recommendations while allowing a narrow, receipt-addressed creative execution path.