Every campaign launches paused

Ask most people what they want from marketing automation and they will say some version of "launch my campaigns for me." Say the same wish back to them plainly — "spend my money on ads automatically, without asking" — and watch it stop sounding like a feature. Those are the same sentence. The gap between how the first one feels and how the second one feels is the entire subject of this post, because an autopilot for a marketing engine is, underneath the friendly framing, a machine you have wired directly to your bank account.

So SiteOps has one rule it does not bend, ever, regardless of how confident the plan looks or how routine the campaign seems: every ad campaign it builds goes live paused. The system can research the audience, draft the creative, set a budget, pick a bid strategy, and push the whole thing to Google or Meta as a real, ready campaign — and it will arrive in the ad account spending exactly zero, because it lands in a paused state. The last inch, the one that turns spending on, is a switch a human flips. The machine builds the campaign. A person starts it.

The reason is an asymmetry, the same shape that governs a scheduler that can decline to send. A campaign that launches an hour late costs you almost nothing — an hour of ads you will run anyway. A campaign that launches wrong costs you continuously and silently: a targeting mistake, a budget with an extra zero, a creative pointing at a broken page, and the meter runs all night against an audience that was never going to convert. Sending late is cheap. Spending wrong is expensive, and it compounds every hour nobody is looking. When the downside of acting wrong is that much larger than the downside of acting slow, the safe default is not to act until someone confirms.

"Paused by default" sounds like a small UI choice — a toggle's starting position — and it is actually a security posture. Defaults are where real behavior lives, because the default is what happens on the busy day when nobody reads carefully. If campaigns defaulted to live and you had to remember to pause the questionable ones, then the day the AI misreads a budget and the day you are distracted are the same day, and the money is gone before anyone notices. Defaulting to paused inverts that: the dangerous outcome — money actually moving — is the one that requires a deliberate act, and the safe outcome is the one you get for free. That is the identical instinct behind treating a missing secret as a locked door rather than an open one. You make the permissive thing the one someone has to choose on purpose.

autopilot that spends money has to default to off. the plane flies itself; it still does not take off without a pilot saying go.

This is where "autopilot" and "approval gate" stop sounding like a contradiction. An autopilot is not a machine that acts without a human — it is a machine that does all the work up to the decisions that matter, and hands those decisions to a person at the moment they matter. Our autopilot drafts the campaign, assembles every part of it, and presents it ready to go; what it does not do is commit the one action that cannot be uncommitted. That commit surfaces as an explicit confirmation the operator taps — the same consent-per-action discipline that governs what our assistant is allowed to do when it drives the app. The assistant can compose an action down to the last detail and still leave the firing to a human finger. Launching paused is that exact rule applied to money: the engine may prepare an irreversible thing, but it does not pull the trigger alone.

Reversibility is the quiet principle underneath all of it, and money is the least reversible thing the system touches. A draft email is reversible until it sends; a scheduled post can be unscheduled; a plan can be rewritten. Spend is different — an ad platform does not un-charge you because the campaign was a mistake. Once the auction has run and the impressions are bought, that money is simply gone, in a way that an unsent email never is. So spend earns the strictest gate we have, because it is the action with no undo. The rule scales with the stakes: read-only things — show me the numbers, list what is connected — happen instantly, because their worst case is a wasted query. Actions that reach real people get a confirmation. Actions that spend real money get a confirmation and a paused landing, so that even after you approve the build, nothing moves until you separately choose to start it.

Be honest about the cost, because it is real and a certain kind of buyer will dislike it: this means the autopilot is not, in the fullest sense, automatic. Someone has to flip the switch. A campaign the system built perfectly at three in the morning sits paused until a person wakes up and starts it, and if that person never looks, nothing ships. We have chosen a system that can fail by doing nothing over one that can fail by spending your budget on a mistake — and doing-nothing is the failure we are comfortable with, because it is loud, obvious, and free. A campaign that never launched is a question you will ask by lunchtime. A campaign that launched wrong is an invoice you read next month.

There is a discipline this forces on the surrounding design, too. A paused campaign nobody can find is nearly as useless as no gate at all, so the pending campaign has to be visible — sitting where the operator already looks, labeled plainly as built and waiting, not buried in the ad platform's own console among everything else. The gate only works if the switch is somewhere a human actually passes by. An approval nobody sees is a send nobody consented to, wearing better manners.

The takeaway is one sentence, and it is deliberately absolute: if a system can spend money on its own, the moment it spends it must belong to a person, every time, with no exception earned by how good the plan looked. Build the campaign automatically. Draft it, cost it, aim it, and set it ready. Then stop, and let the last inch — the one with no undo — be a human choosing to begin.