Start here
The safety model
Every rule that stands between a calculation and a real price change, and why each one exists.
A pricing tool that can write to your store is holding a loaded instrument. These are the rules that constrain it, in the order they apply.
Reading is separate from writing
Connecting a store, importing a catalogue, calculating every market, previewing a matrix, and approving a recommendation are all read-only. None of them can change a price.
Google's regional price conversion — the call that produces the store baseline column — is itself a non-mutating endpoint. It asks Google what a price would convert to. It does not set anything.
Writes are default-off
Live publishing is disabled unless it is explicitly enabled for the deployment. The default state of a production install is that no write path is reachable at all.
Approval is not publication
Approving a recommendation records a decision. It does not queue a write, and it does not schedule one.
Turning approved recommendations into a change requires a separate, deliberate action that builds a deployment draft. Turning that draft into a store write requires a third.
Every write is an exact diff
A deployment is not "apply the strategy". It is a list of specific items, each with a stated before price and a stated target price. You see the exact diff before anything happens.
The store is re-read immediately before writing
Between building a draft and publishing it, the store may have changed — someone edited a price in Play Console, or a product was withdrawn.
The deployment re-reads the live state immediately before the write and refuses if what it finds no longer matches what the diff was built against. A stale diff is never applied.
Withdrawn products are excluded, not silently retried
If the store stopped listing a product or plan, any recommendation about it can no longer be approved — there is nothing upstream left to reprice. It stays visible so it can be dismissed, rather than vanishing or failing the whole batch.
Low confidence abstains
Below a confidence of 0.60 the system does not recommend a change at all. It says what evidence is missing instead. Between 0.60 and 0.75 a recommendation is marked provisional and requires explicit acknowledgement.
A recommendation whose change is smaller than 5% is not surfaced either — it is noise. See Confidence.
Protected markets keep their price
A market marked protected retains its existing price regardless of what the strategy computes. The calculation still runs and is still explained, so you can see what would have happened, but the recommendation is the current price.
Exchange rates cannot authorize a write
Economic drift produces a recommendation for a human to review. It never directly triggers a store change. A currency moving 8% overnight raises a flag; it does not reprice your catalogue.
Every write is verified by reading it back
After a write, the store is read again and the result compared against what was intended. Per-item failures are isolated: one rejected market does not roll back or hide the twelve that succeeded, and each item reports its own outcome.
What is not yet true
Two safety properties are specified but not implemented:
- Rollback as a new forward deployment. Today, reverting means staging the inverse change manually.
- Stale publishing-claim recovery after a worker crash mid-publish.
Until both ship and a controlled real-account write has been proven, live publishing remains in controlled beta. See Staging and publishing.