Automation that runs inside limits you wrote down.

On and off is not a control surface

A switch and a daily budget cap leave every real decision to network-reported conversions. A rule firing on those alone keeps funding a campaign whose leads are later disqualified or refunded, because the platform never sees the disqualification, the refund or the thin-margin order. That gap surfaces in collected revenue weeks later, after the budget is spent.

A policy object, checked per action

The Campaign Constitution is a stored, versioned object rather than a settings screen. Evidence thresholds are evaluated first and decide whether there is enough data to act at all; the remaining clauses are evaluated at execution time, and one failing clause blocks the action. Blocks are recorded with the clause that caused them, so a refusal reads as clearly as a change.

Reversible by construction, auditable by default

Prior values are stored with every write, so the last change, a day of changes or one campaign's whole history can be reverted without rebuilding it by hand. Finance can read which limits held and which were hit, against the figures the business metrics service returned at the time. Autonomy widens one clause at a time instead of by trusting a system you cannot inspect.