Concepts and vocabulary

An agency has one account and a brand per client. An in-house team has one account and a brand per brand they own. Either way a campaign is an initiative inside a brand.

Accountaccounts

The agency, or the company. Seats, billing, API keys and the governance register live here, and so do the house rules — the standards that are true whoever you are working for.

Brandworkspaces

A client, or a product line. Its own identity, its own regulatory regime, its own sources, its own record. Most regulatory rules belong here rather than above: an indication constraint belongs to the product and a closed period to the listed entity.

Campaignprojects

An initiative inside a brand — a launch, an always-on line. Carries a brief, an audience, an embargo and the claims approved for this one thing.

Postcarousels

One piece of work. The thing that gets checked, reviewed, signed off and released.

Rules can be set at the first three, and travel downward. The test for where one belongs is whose obligation it is: a rule sits at the level of the party who carries the risk of breaking it. Push a client’s regime up to the account and the agency applies Client A’s rules to Client B’s content — not a leak, but a governance error that fires false positives on every other client and trains people to override findings. A rule everybody overrides is worse than no rule. See rule inheritance.

The interface says brand and campaign. The schema and the wire format say workspace and project, and during the rename each of those moved down one level: what was called a workspace became an account, and what was called a project became a brand.

The tables were renamed to match the product’s words, because a codebase where project_id in a security policy means a brand while every screen uses project to mean a campaign is a codebase that produces a wrong-tenant bug in its second year. In a product whose failure mode is showing one client’s content to another, the names are load-bearing.

What did not move is the wire format. workspaceId on the review API names a brand, and projectId is refused rather than accepted as an alias — it now names a campaign, which is a real id at a different level, and one wire name meaning two levels depending on who sent it is the ambiguity the rename existed to remove.

Switching account changes the governance regime — different rules, different colleagues, different audit trail. Switching brand changes which client you are working on. Switching campaign changes which initiative. Those are three different acts.

A rule is one of nine kinds, a statement in the account’s own words, a severity — blocking or advisory — and the list of content roles it reaches. A rule that names no role reaches all of them.

A finding is one rule meeting one piece of text. It carries the rule that caught it, the statement as it read at that moment, the severity, the tier, the offending excerpt, and — where a pattern matched — a half-open character range into the block so the exact words can be marked.

Kind

What sort of check this is. Nine of them, and it decides what code can settle about the rule.

Severityblock · warn

Whether a finding stops a release or is noted beside it.

Role

What kind of text a block is — artwork, body, caption, metadata, alt text, notes. Platform-neutral, so one rule reaches a slide headline, a document heading and a frame title alike.

Classtext · visual

Whether a rule is about words or about how something looks. A surface declares which classes it checks rather than being assumed to check everything.

Tier

What established this finding, or what failed to establish anything about this rule. The single most important field in the system.

Location

What a person reads in an audit record: “Frame 3 · title”. Overrides are keyed to it, so it is a wire format rather than copy.

An override is a person disagreeing with a finding, and it carries a class saying what they are disagreeing with. See overrides and set-asides.

A seat is held in an account. A grant is held on one brand. The difference is the whole agency proposition: a consultant hired for one client holds a limited seat and a grant on that client’s brand, and the account’s other brands do not exist as far as the database is concerned.

Account owner

Everything, every brand, and the only seat that can change account rules or issue an API key.

Account editor

Every brand in the account, and may edit.

Account viewer

Every brand, read only. Cannot comment or sign off — the policies refuse both.

Limited

No account-wide reach at all. Sees exactly the brands it holds a named grant on. This is the outside consultant: a person inside somebody else’s account, bound by that account’s rules, scoped to the clients they were hired for.

Review link

No seat and no account. A token that resolves to exactly one post and is not a door into the brand or the campaign around it. Expired and revoked both fail closed, and an unknown token is indistinguishable from a revoked one.

None of this is enforced by hiding buttons. See tenant isolation for what is actually asked of the database.

Three things are written and none of them can be edited afterwards.

Release record

One per release. What went out, its fingerprint, which rules were in force with the wording they had at that moment, what each of them established, every finding including the ones set aside, and who signed for it.

Governance register

Every change to a rule, at any level, naming the hand that made it and what it said before. Also who added a source, who turned a rule on, who withdrew an approval.

Override ledger

Every time somebody disagreed with the checker, with the class of disagreement and the reason given.

read   ✓
insert ✓
update ✗   affects no rows, for anyone
delete ✗   affects no rows, for anyone

Including the account owner who released, and including us. A wrong entry is corrected by a later entry that says so, never by editing the first — a history that can be tidied before an audit answers nothing.