Built for the person who owns the budget

A dashboard reports and cannot act. A script acts and cannot be reviewed. Once one actor can both read the numbers and change the account, the open question is what happens between its decision and the spend.

Tempio puts a draft there. Every write an agent makes is written as a change request first: what it wants to change, on which entity, from which value to which value, and why. The request is checked against your guardrails when it is written, and checked again at the gate. Nothing reaches a live account until something with the authority to clear it says so: you, from the review queue, or a rule you wrote and can read back.

The draft is part of the architecture, so the record exists whether a person opened the queue or a rule cleared the request in a second. A month later, the question of what changed, when and on whose authority still has an answer that does not depend on anyone remembering. A change stored as a request also carries the value it replaced, which is what makes it reversible.

The gate also limits the product’s own reach. A key can be minted that reads and drafts and nothing else, and the built-in agent holds no approval of its own.

Every platform will hand you a cost per click. Ask two of them the same question over the same dates and the answers disagree, because each one computed the ratio somewhere you cannot see, under a rounding rule and a reporting window it never showed you.

So Tempio stores none of them. What lands in the warehouse is the base counts: impressions, clicks, spend as an integer in minor units with its currency attached, conversions, conversion value. Every ratio a screen shows is computed at the moment you read it, from those counts, in front of you.

A ratio with nothing to divide by comes back blank, not zero. Money never silently crosses currencies, and a figure that blends two of them is labelled an estimate and says which. Any total you are shown can be walked back to the rows it came from. It is more work than storing the pretty figure once and serving it forever.

The easy version of this product writes itself: point it at your accounts, let it run, look in when you feel like it. We are not building that one, because autonomy with no record is indistinguishable from a mistake nobody has found yet.

The framing we hold to instead is governed autonomy. You decide how much of it there is, in increments, and every increment is written down. Clear one draft at a time while you are still learning what the agent is good at. Write a rule that covers a whole class of change (under this amount, on this account, inside these hours) once you have seen enough to be comfortable. Withdraw the rule in an afternoon if it turns out to be wrong. Whatever cleared a change is attached to the change, so the record reads the same either way.

Software can plainly act by itself. On this system it acts on terms you set, in a form you can read afterwards, and nothing about the arrangement is permanent.