Guardrails

Some guarantees are enforced in the shared tools, not in a transport, so they hold for MCP, REST and the dashboard alike. Others are rules the server instructions give the agent. This page says which is which.

PAUSED is the draftCopy Anchor Link

Meta's API has no draft object. meta_launch_ads creates the campaign, ad set and ads paused and records a launch. Nothing spends until meta_activate. Launching needs no approval grant because it cannot spend. See Paused is the draft.

Changing spend needs the approval grantCopy Anchor Link

meta_activate, meta_pause_launch, meta_set_ad_status, meta_update_ad_set_targeting and meta_relink_launch change what delivers on Meta. Each executor checks the grant, so a key that may launch drafts cannot put them live. The grant is a boolean, separate from the read, write and admin scopes.

The human's go-aheadCopy Anchor Link

The grant is the technical control. The server instructions add the human one:

• Never activate without the human saying so in this conversation. The same goes for meta_set_ad_status with ACTIVE.
• A cut verdict from meta_suggest_next is advice. The human picks what to pause.
• Ask before any delete, and before meta_update_ad_set_targeting (one call per ad set, because each call restarts learning).
• Show a launch's strategyCautions.

There is no tool or endpoint that edits an existing campaign's budget.

What launching does for youCopy Anchor Link

• Every Advantage+ enhancement is opted out on every creative, so Meta does not rewrite approved copy.
• A non-canonical ad name is refused before any upload.
• A form ad set is refused a website destination, and the reverse. A CTA that Meta does not offer on a form is refused too.
• When the free trial has ended and no plan is active, launching, turning ads on and changing live ads are refused. Pausing and reads still work.

Evidence rulesCopy Anchor Link

The instructions tell an agent to:

• start every review with meta_get_evidence_health and quote its warnings;
• compare funnels on their own goal, not Meta's "Results";
• treat low delivery as inconclusive, not a loss;
• describe findings as patterns, because Meta chose who saw each ad.

Tests are protected structurally. A committed Test's intent cannot be updated, Observations are append-only, and a Conclusion is final. A database trigger enforces all three. See The Test loop. A test, a brief or an Observation never touches delivery.

Quotes and strategyCopy Anchor Link

• Verbatims are quoted exactly. An agent must not invent a quote.
• Strategy an agent inferred goes in as mode: "suggest", which a human accepts or dismisses. Save an operator's copy correction the same way or it is lost.
• A learning that reads as an observation is rewritten with meta_update_learning.
• A brief or copy may quote only numbers its evidence carries.

Credentials never travel over MCPCopy Anchor Link

No tool takes or returns a secret. The Meta System User token is entered by an admin in the app, and API keys are minted there. Keys are stored as a hash. Meta tokens are stored encrypted and never returned.

Tools kept off MCPCopy Anchor Link

addResearchSource and refreshResearchSource fetch third-party content on the caller's say-so, so they are not exposed over MCP. They stay in the dashboard (Settings → Customer research) and on REST. An agent reads what was added with meta_list_verbatims.

Tool annotationsCopy Anchor Link

Each tool carries MCP annotations that describe what it does:

• readOnlyHint for reads. A write tool never carries it.
• destructiveHint when the outcome changes live delivery, spends, or is lost: activating, pausing, relinking, deleting, merging, closing a Test, and every in-place overwrite that keeps no version. Launching is not destructive, because it creates paused.
• openWorldHint when the call reaches a system Win & Scale does not control: Meta live, the Ad Library, or a caller-supplied link.
• idempotentHint on reads and on the set_, update_ and switch_ writes.