---
title: The safety model
nav: Safety model
description: Every rule that stands between a calculation and a real price change, and why each one exists.
group: start-here
order: 3
status: shipped
updated: 2026-09-21
---

A pricing tool that can write to your store is holding a loaded instrument. These are the rules that constrain it, in the order they apply.

## Reading is separate from writing

Connecting a store, importing a catalogue, calculating every market, previewing a matrix, and approving a recommendation are all **read-only**. None of them can change a price.

Google's regional price conversion — the call that produces the store baseline column — is itself a non-mutating endpoint. It asks Google what a price _would_ convert to. It does not set anything.

## Writes are default-off

Live publishing is disabled unless it is explicitly enabled for the deployment. The default state of a production install is that no write path is reachable at all.

## Approval is not publication

Approving a recommendation records a decision. It does not queue a write, and it does not schedule one.

Turning approved recommendations into a change requires a separate, deliberate action that builds a deployment draft. Turning that draft into a store write requires a third.

## Every write is an exact diff

A deployment is not "apply the strategy". It is a list of specific items, each with a stated before price and a stated target price. You see the exact diff before anything happens.

## The store is re-read immediately before writing

Between building a draft and publishing it, the store may have changed — someone edited a price in Play Console, or a product was withdrawn.

The deployment re-reads the live state immediately before the write and **refuses** if what it finds no longer matches what the diff was built against. A stale diff is never applied.

## Withdrawn products are excluded, not silently retried

If the store stopped listing a product or plan, any recommendation about it can no longer be approved — there is nothing upstream left to reprice. It stays visible so it can be dismissed, rather than vanishing or failing the whole batch.

## Low confidence abstains

Below a confidence of 0.60 the system does not recommend a change at all. It says what evidence is missing instead. Between 0.60 and 0.75 a recommendation is marked provisional and requires explicit acknowledgement.

A recommendation whose change is smaller than 5% is not surfaced either — it is noise. See [Confidence](/guidelines/confidence).

## Protected markets keep their price

A market marked protected retains its existing price regardless of what the strategy computes. The calculation still runs and is still explained, so you can see what would have happened, but the recommendation is the current price.

## Exchange rates cannot authorize a write

Economic drift produces a recommendation for a human to review. It never directly triggers a store change. A currency moving 8% overnight raises a flag; it does not reprice your catalogue.

## Every write is verified by reading it back

After a write, the store is read again and the result compared against what was intended. Per-item failures are isolated: one rejected market does not roll back or hide the twelve that succeeded, and each item reports its own outcome.

## What is not yet true

Two safety properties are specified but **not implemented**:

- **Rollback** as a new forward deployment. Today, reverting means staging the inverse change manually.
- **Stale publishing-claim recovery** after a worker crash mid-publish.

Until both ship and a controlled real-account write has been proven, live publishing remains in controlled beta. See [Staging and publishing](/guidelines/dry-run-and-publish).