MolTrust for Amazon Ads — Agency engineering

// Agency engineering

Ten minutes to the first verdict

The guard wraps the call your agent already makes. You keep your MCP client, your Login with Amazon tokens and your account selection. The guard needs three things: the mandate, your view of the account (current budgets and bids, brand per campaign) and the function that sends the call.

pip install "moltrust-enforce[client]>=0.7"

from moltrust_enforce import EnforceClient
from moltrust_enforce.adapters.amazon_ads import AmazonAdsGuard, Forbidden, HoldRequired

guard = AmazonAdsGuard(EnforceClient("https://api.moltrust.ch", api_key=KEY), profile)

try:
    guard.call(tool, args, send_to_amazon, context=account_state)
except HoldRequired as e:
    approval_queue.put(e.outcome)       # a person signs, then the call runs
except Forbidden as e:
    log.warning(e.outcome.reason)       # names the limit, e.g. daily_budget 5,000.00 outside 0.00..500.00

// What MolTrust receives

The tool name and a handful of numbers

Sent per check	Example
Tool and kind of change	`campaign_management-update_campaign_budget`, `budget_daily`
Ad account ID and brand	`ENTITY1ABC`, `Acme Outdoor`
The limited values, in cents or basis points	new daily budget, account total after the change, bid change
Decision minute	for the mandate's validity window

Not sent: tokens, client IDs, campaign names, targeting, creatives, reports or any response from Amazon.

// Behaviour

What the guard does in the awkward cases

Batch calls. Amazon's write tools take lists. A call that changes five campaigns is checked per campaign; one forbidden item stops the whole call.
Unknown values. A campaign the guard cannot place, a missing current bid or an unreadable amount counts as unknown, and unknown ends in forbid.
Lite endpoint. On /mcp/lite every operation arrives as amazon_ads_mcp-invoke_tool. The guard unpacks it and checks the inner tool. Amazon does not document the wrapper's argument names yet; anything the guard cannot read is forbidden.
MolTrust unreachable. The guard fails closed: no verdict, no call.
Server and local result differ. The guard recomputes every verdict locally; a mismatch is forbid.
User access. Tools that change who can act on an account (user permissions, invitations, manager account links) cannot be put into a mandate.

Encoding and the Amazon tool facts behind it: aae-ads-profile.md. Example repository: moltrust-ads-example.

Quickstart →