Eight conditions. Watched every five minutes.
You know before your client does.

The rules

Eight rules. Severities are fixed, not negotiated. Dedup is severity-aware.

These are the exact rules baked into our stability engine. We tightened the thresholds in two passes of dogfooding. The first pass was too noisy, the second pass missed a real spend spike. The current settings are the ones we'd defend on a customer call.

Anatomy of an alert

What you see when something goes wrong.

An alert has five things, in this order. We don't pad the payload. Every field is something you'll actually use when you decide whether to act.

1. 1

   The account name and which signal tripped.

   "Reply Pilot · SPEND_SPIKE." Not "campaign 12345 anomaly detected." The first three words tell you whether you're going to interrupt your dinner to look at this.

2. 2

   The numbers behind the trigger.

   "Yesterday: $8,420. 7-day average: $3,950. Ratio: 2.13×." We don't show you the chart; you'd open the dashboard for that. We give you the four numbers that made the decision.

3. 3

   A one-line AI-generated context summary.

   Plain-English version of what's happening, generated by Claude Haiku at send time from the signals. Always under one tweet long. Not generated to fill space. It's generated because the difference between "your spend doubled" and "your spend doubled because three new audiences activated overnight" matters when you're deciding whether to wake up the client.

4. 4

   A deep-link to the relevant view in Advino.

   One click. Goes to /shield/alerts/[id] with all the context expanded. From there you can mark resolved, snooze, or click into the Meta account.

5. 5

   (For writes only) An approval URL.

   If the alert suggests an action (pause this ad set, raise a budget cap), the action is a separate URL that has to be confirmed in the web app. Email + Slack alerts never execute the action themselves.

Above: clicking any alert opens this view. Approval URL is the only path to executing a write action.

How it lands in Slack

The same alert delivered to a Slack channel of your choice. Buttons go to the same approval URL.

Auto-pause

Default off. Approval-gated when on. Never a silent execution.

On Studio and above, Shield can route certain Critical alerts through an auto-pause flow. The flow is not what most products mean by "auto-pause." Here's what actually happens:

1. An alert fires, say a Critical SPEND_SPIKE.
2. Shield creates a pending action, a draft pause that will execute if approved.
3. You get the alert with a one-click confirm URL. The URL opens /shield/alerts/[id] with the proposed action pre-filled.
4. You click Confirm. Meta gets called. The ad set pauses.
5. If you don't click within the dedup window, the pending action expires. Nothing happens.

Why this design? Because the bug semantics we want are "Advino didn't pause when it should have," not "Advino paused without permission." The first kind of bug costs you part of a day. The second costs you a client.