Safety
Every bid, explained.
Seven layers stand between the AI and your spend. The Sentinel is the one that watches inventory — when stock runs short, it throttles the bid before the dollar follows the click.
See the seven layersCoupling the Warehouse
to the Auction.
Advertising is a function of supply. The Sentinel monitors the Effective Lead Time (L_eff) and pulls real-time inbound data from SP-API v2024-03-20 to calculate your dynamic Days of Supply (DoS). Unlike humans, it reacts instantly to logistical friction.
Supply Logic Core
Supply Sigmoid
Seven layers · all on by default
What stands between the AI and your spend.
Every bid passes through all seven gates before it reaches Amazon. If any one trips, the bid is suppressed and the trace records why.
- 01Kill switch
One toggle halts all bids — instantly.
Tenant-scoped flag checked before every Amazon write. Trips manually or by ops. Recovery is explicit.
- 02ROAS circuit breaker
If ROAS falls below floor for N hours, the system pauses itself.
Per-marketplace floors. Configurable window (default 6h). Releases only after rolling-window recovery + audit log entry.
- 03Daily spend cap
Hard ceiling per tenant per marketplace. Mirox cannot exceed it — ever.
Pre-write check against rolling 24h spend telemetry. Cap is the limit, not the target. Breach attempts are logged and dropped.
- 04SP-API fault gate
If Amazon's API is unhealthy, the system stops — it does not guess.
Throttle rate, 5xx ratio, and reporting lag are all watched. Faulty conditions trigger backoff or full freeze, not retries that compound.
- 05Optimistic locking
Two agents cannot move the same bid at the same time.
Versioned writes with conflict detection. Last-write-loses is rejected; both writes are reconciled deterministically with the latest fact set.
- 06Recovery floor
After a pause, bids return slowly — not at the level they were paused at.
Re-entry happens at a tenant-set floor (default 70%) and ramps over a configurable window. Prevents whiplash on misread signals.
- 07Per-marketplace gates
DE, FR, IT, ES, UK, US, JP — each has its own thresholds.
ROAS targets, spend caps, and SP-API rate limits are tuned per region, not blended. A misbehaving marketplace can be quarantined without affecting the others.
Walkthrough · the worst-case
What happens if Amazon goes dark for six hours.
SP-API outages happen. The system is built to know that, freeze rather than guess, and recover without overcorrection.
- T+0s
SP-API fault gate trips
Throttle ratio crosses 12% over a 60-second rolling window. The Sentinel marks the marketplace UNHEALTHY and emits an audit entry with the offending request IDs.
- T+1s
All writes are suppressed
No new bids leave the system. In-flight writes finish or fail cleanly under optimistic locking. The Strategist switches the marketplace into Hold mode — read-only telemetry only.
- T+0–6h
Telemetry continues, decisions accumulate
The blackboard keeps writing what the AI would have done. Shadow Mode customers see the would-have-decisions in real time. Live customers see a Hold banner with the trace.
- T+6h
Amazon recovers
The fault gate watches throttle, 5xx, and reporting lag for a stable 5-minute window before clearing UNHEALTHY. No premature recovery — the system waits for proof, not a pulse.
- T+6h05
Recovery floor engages
Bids re-enter at 70% of pre-incident levels and ramp over the configured window (default 30 minutes). Prevents whiplash if the recovery turns out to be partial.
- T+6h35
Full operations · trace exported
Marketplace returns to normal. Every minute of the outage — every gate trip, every suppressed write, every recovery step — is exportable as a CSV trace with the original Amazon IDs.
Watch it run
Trust is a trace you can read.
Run Mirox in Shadow Mode on your real account, read-only, for as long as you like. Every gate trip, every suppression, every recovery step — exportable. Then decide.
Public Shadow Mode opens Q3 2026 · one email when the door opens · no drip