Guardrails

Limits enforced on every mutation for Spicerack.Market. Enforced server-side, in the executor.

Connected accounts

Sign in once per platform. Every ad account that login can reach is linked automatically; each account is synced and changed with its own credentials.

googleDemo — Spicerack.Market (snapshot)
1 ad account(s)

Connect Google Ads

needs GOOGLE_ADS_CLIENT_ID, GOOGLE_ADS_CLIENT_SECRET, GOOGLE_ADS_DEVELOPER_TOKEN

Connect Meta

needs META_APP_ID, META_APP_SECRET

Dry-run is on

Changes are sent to the platform for validation and then discarded, so you see exactly what would happen — including real rejections — without moving money. Turn this off once the proposals look right.

Authority

Auto-applyLet the agent apply changes without a human pressing Apply.Dry-runValidate against the platform but never commit.Kill switchBlock every mutation, including your own. Overrides everything.

Limits

Max budget changePercent, per single change. A larger move is routed to review.Max bid changePercent, per single change.Min spend before pauseUSD. Nothing is paused before it has had a fair chance.Min clicks before pauseEither threshold satisfies — spend OR clicks.Max actions per dayCaps how much can change in one day.Max daily budget swingUSD. Stops many small moves adding up to a large one.

Change types the agent may auto-apply

Anything unchecked still gets proposed — it just waits for a human.

Protected entities

External ids the agent must never touch, whitespace or comma separated.

Last updated 9/17/2026, 4:09:46 PM

Developer credentials

Environment variables — the fallback for accounts without an OAuth connection, and the app-level keys the Connect buttons need.

LLM

OpenAI-compatible · @zai-org/glm-5.3-flash · ai.findclix.com

google

Google Ads app credentials incomplete — set the developer token and OAuth client.

missing: GOOGLE_ADS_DEVELOPER_TOKEN, GOOGLE_ADS_CLIENT_ID, GOOGLE_ADS_CLIENT_SECRET, GOOGLE_ADS_REFRESH_TOKEN (or an OAuth connection)