Status as of 2 October 2026 · This page is the single source of truth for what is implemented and what is not
A tool that can spend money needs limits that hold even when the operator is careless. Below are the limits this tool is built to — stated as binding commitments — and an honest account of which are already in the code.
Commitments
These hold regardless of build state. They are the shape of the tool, not a roadmap.
- It will never move money. No payment initiated, no payment method changed, no billing setup edited. Spend data is read-only. Accounts are funded by hand in the Google Ads interface.
- It will never enable a campaign on its own. Campaign management, once built, creates every new campaign paused; enabling it, raising a budget, or removing a campaign or keyword each requires an explicit confirmation at the time. No write operation will run on a schedule.
- It will only ever touch accounts the operator owns, linked under the operator’s own manager account. No mechanism will exist to add a third party’s account, because there is no second user.
- It will never create Google Ads accounts or attempt to work around policy review.
- Google Ads data will never be resold, redistributed or published. It is read for the operator’s own accounts and stays on a private server.
Implementation state
The Google Ads integration today reads keyword planning metrics. The reporting and campaign-management features described in the access request are being built, and the safety mechanisms below are being built with them — deliberately before the write features they protect.
| Mechanism | State |
|---|---|
| Credentials encrypted at rest; never returned to the browser in any form, not even masked | In place |
| Workspace is login-only; accounts created by hand, a new account sees nothing until approved | In place |
| Per-credential call counting, so “what used this quota?” has a numeric answer | In place for affiliate network APIs; being extended to Google Ads |
| Account identifiers redacted from error messages before they are logged or displayed | In place for affiliate network APIs; being extended to Google Ads |
| Rate-limit backoff driven by the API’s own response headers rather than guesswork | In place for affiliate network APIs; being extended to Google Ads |
| No billing or payment code exists at all | In place — by absence, which is the strongest form |
| Read-only mode: a single switch makes every write operation refuse to run | Planned |
| Validate-before-write: campaign creation validated against the API first, creating nothing | Planned |
| Append-only audit log of every write — timestamp, account, operation, parameters, request ID | Planned |
| Daily cap on write operations, stopping when reached | Planned |
| Refusing any customer ID outside the list the credentials can reach | Planned |
| Campaigns created paused, with per-change confirmation | Planned — arrives with campaign management itself |
Nothing marked Planned is claimed as present behaviour anywhere else on this site. If you find a page that does, it is a mistake and I would like to know: xuanhinh.affiliate@gmail.com.
Why the order
Safety first is not a slogan here, it is the build order: the audit log, the read-only switch and the operation cap are being written before the first tool that can change a live campaign. A guard added after the feature it guards is a guard that was missing for a while.