spec(media-buy): get_media_buys MUST return all account-owned buys#2993
Merged
Conversation
Tightens the scope of get_media_buys, get_media_buy_delivery, and update_media_buy to be bounded by account ownership, not by the surface through which a buy was created. Sales agents MUST NOT partition their inventory into "AdCP-created" and "non-AdCP" subsets for account-scoped tasks, and MUST NOT refuse reporting or updates on the basis that a buy was booked outside AdCP (direct ad-server entry, legacy APIs, manual trafficking). Rationale: enterprise adoption needs existing ad-server state to be addressable without rebuilding through AdCP; brownfield Tier-2 conformance (#2965) depends on being able to discover live campaigns and attach a verification reporting_webhook; and "protocol onto the ad server" is the premise of the spec. Business constraints on specific operations remain expressible via valid_actions. Closes #2963 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
Schema Link Check ResultsCommit:
|
This was referenced Apr 24, 2026
This was referenced Apr 24, 2026
Merged
bokelley
added a commit
that referenced
this pull request
Apr 24, 2026
… partitioning belongs (#3016) Post-#2993 follow-up surfaced by expert review of the Tier-2 conformance PR. The merged #2993 text says sellers MUST return every account-owned buy and MUST NOT mark non-AdCP buys read-only — but also that an action MAY be omitted from valid_actions for "business reasons." Those two clauses together let a seller technically comply by returning non-AdCP buys with systematically empty valid_actions, which is indistinguishable from hiding the buy. Two clarifications: 1. Creation surface is not a business reason. MUST NOT omit an action from valid_actions solely because the buy was created outside AdCP. A systematically empty valid_actions on non-AdCP buys is non-conformant. 2. Partitioning belongs at the account boundary. When a seller has a legitimate reason to hide a set of buys (child-seller models, NDA-scoped PMP deals, privacy partitions), the correct mechanism is a separate account the caller is not authorized on — not within- account filtering. Within-account filtering reintroduces the shadow-ledger problem #2963 forbade. Updates specification.mdx (new subsection under Account Ownership vs. Creation Surface), get_media_buys.mdx, update_media_buy.mdx. No schema changes. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tightens the scope of
get_media_buys,get_media_buy_delivery, andupdate_media_buyso account-scoped tasks are bounded by account ownership, not by the surface through which a buy was created. Sales agents MUST NOT partition their inventory into "AdCP-created" and "non-AdCP" subsets for these tasks, and MUST NOT refuse reporting or updates on the basis that a buy was booked directly in the ad server, via legacy APIs, or via manual trafficking.Closes #2963.
Why
The spec was previously silent on this. Nothing forbid "AdCP only returns what AdCP created" — an interpretation compatible with the letter of the spec but fatal in practice:
get_media_buys→ discover a live campaign →update_media_buywith a verificationreporting_webhook. Partitioning by creation surface collapses Path B.Changes
docs/media-buy/task-reference/get_media_buys.mdx— new Scope of Results section: sales agents MUST return every account-owned buy regardless of creation surface; MUST NOT mark a buy read-only on that basis. Business constraints expressed viavalid_actions, not by hiding buys.docs/media-buy/task-reference/update_media_buy.mdx— new Scope section: operates on anymedia_buy_idreturned byget_media_buys; creation surface is not a supported axis of authorization.docs/media-buy/task-reference/get_media_buy_delivery.mdx— new Scope section: delivery reporting covers any buy returned byget_media_buys; sellers return zero/partial metrics rather thanMEDIA_BUY_NOT_FOUNDfor account-owned buys.docs/media-buy/specification.mdx— new Account Ownership vs. Creation Surface core concept, cross-referenced from theget_media_buys,update_media_buy, andget_media_buy_deliveryrequirements lists. Updates themedia_buy_iddefinition to call out that it identifies any ad-server order the account owns.Test plan
#account-ownership-vs-creation-surfaceresolve on the specification pageFollow-ups
Part of a 3-issue series on brownfield conformance:
get_agent_capabilities+attestation_verifierscope + RBAC error codes🤖 Generated with Claude Code