Safety
Every bid, explained.
Seven layers stand between the AI and your spend. The Sentinel is the one that watches inventory — when stock runs short, it throttles the bid before the dollar follows the click.
See the seven layersCoupling the Warehouse
to the Auction.
Advertising is a function of supply. The Sentinel monitors the Effective Lead Time (L_eff) and pulls real-time inbound data from SP-API v2024-03-20 to calculate your dynamic Days of Supply (DoS). Unlike humans, it reacts instantly to logistical friction.
Supply Logic Core
Supply Sigmoid
Seven layers · all on by default
What stands between the AI and your spend.
Every bid passes through all seven gates before it reaches Amazon. If any one trips, the bid is suppressed and the trace records why.
- 01Kill switch
One toggle halts all bids — instantly.
Tenant-scoped flag checked before every Amazon write. Trips manually or by ops. Recovery is explicit.
- 02ROAS circuit breaker
If ROAS falls below floor for N hours, the system pauses itself.
Per-marketplace floors. Configurable window (default 6h). Releases only after rolling-window recovery + audit log entry.
- 03Daily spend cap
Hard ceiling per tenant per marketplace. Mirox cannot exceed it — ever.
Pre-write check against rolling 24h spend telemetry. Cap is the limit, not the target. Breach attempts are logged and dropped.
- 04SP-API fault gate
If Amazon's API is unhealthy, the system stops — it does not guess.
Throttle rate, 5xx ratio, and reporting lag are all watched. Faulty conditions trigger backoff or full freeze, not retries that compound.
- 05Optimistic locking
Two agents cannot move the same bid at the same time.
Versioned writes with conflict detection. Last-write-loses is rejected; both writes are reconciled deterministically with the latest fact set.
- 06Recovery floor
After a pause, bids return slowly — not at the level they were paused at.
Re-entry happens at a tenant-set floor (default 70%) and ramps over a configurable window. Prevents whiplash on misread signals.
- 07Per-marketplace gates
DE, FR, IT, ES, NL, BE, PL, SE, UK, US — each has its own thresholds.
ROAS targets, spend caps, and SP-API rate limits are tuned per region, not blended. A misbehaving marketplace can be quarantined without affecting the others.
Walkthrough · the worst-case
What happens if Amazon goes dark for six hours.
SP-API outages happen. The system is built to know that, freeze rather than guess, and recover without overcorrection.
- T+0s
SP-API fault gate trips
Throttle ratio crosses 12% over a 60-second rolling window. The Sentinel marks the marketplace UNHEALTHY and emits an audit entry with the offending request IDs.
- T+1s
All writes are suppressed
No new bids leave the system. In-flight writes finish or fail cleanly under optimistic locking. The Strategist switches the marketplace into Hold mode — read-only telemetry only.
- T+0–6h
Telemetry continues, decisions accumulate
The blackboard keeps writing what the AI would have done. Simulation Mode customers see the would-have-decisions in real time. Live customers see a Hold banner with the trace.
- T+6h
Amazon recovers
The fault gate watches throttle, 5xx, and reporting lag for a stable 5-minute window before clearing UNHEALTHY. No premature recovery — the system waits for proof, not a pulse.
- T+6h05
Recovery floor engages
Bids re-enter at 70% of pre-incident levels and ramp over the configured window (default 30 minutes). Prevents whiplash if the recovery turns out to be partial.
- T+6h35
Full operations · trace exported
Marketplace returns to normal. Every minute of the outage — every gate trip, every suppressed write, every recovery step — is exportable as a CSV trace with the original Amazon IDs.
Amazon 2026 agent policy
Compliant with Amazon's 2026 agent policy.
Amazon now requires automated bidding tools to run on the official SP-API with rate limiting, complete audit logging, and human-in-the-loop control. Mirox was built this way from day one. The tool auditing your account shouldn't be a black box — especially now.
SP-API native, with rate limiting — no scraping, no unofficial endpoints.
A full mathematical trace behind every single bid.
A kill switch and complete audit logging on every action.
Simulation Mode keeps a human in control — nothing executes until you flip to Live.
Watch it run
Trust is a trace you can read.
Run Mirox in Simulation Mode on your real account, read-only, for as long as you like. Every gate trip, every suppression, every recovery step — exportable. Then decide.
Public Simulation Mode opens after the program · one email when the door opens · no drip