SocialSeed.ing — Sealed Run

SocialSeed.ing · Sealed Run

brand-data isolation: ON ✓ data did not leave the boundary campaign #SS-7741 · ADK multi-agent

The Sealed Campaign boundary

🔒 INSIDE THE VAULT — encrypted at rest, need-to-know scoped

What the agent works with — and nothing of it is shipped to TikTok or third parties:

📦 product brief v3 💰 budget deposit $4,000 📈 TikTok Shop GMV signal (aggregate) 🎯 strategy doc 🪪 creator tokens (no raw PII) 📊 k-anon view buckets

🚫 Never ingested: TikTok user profiles · device graph · per-viewer watch history · your customer list · creator real names/emails (until logged hand-off). The agent runs against mock TikTok endpoints + a metrics simulator — no live personal data crosses in.

👁 What each sub-agent can & cannot see (consent panel — revoke any scope mid-run)

Sub-agent (A2A)	CAN see	CANNOT see
Strategy	brief, budget, aggregate GMV	creator tokens, raw analytics
Creator Sourcing	region tier, audience-size band, tokens #c8f2	real handles, follower lists, contact info
AI Brief / Caption	brief, brand voice, #ad disclosure rule	creator identity, budget, GMV
Publish hand-off	token → real handle (just-in-time, logged)	customer data, GMV, other creators
Measurement	k-anon watch-time buckets, click counts	per-viewer behavior, device IDs, PII
Reallocation	cohort CPV, budget cap state	raw analytics, creator identity

✓ Least-privilege enforced by Agent Engine — each scope is a signed capability token; revoking one pauses that agent, not the run.

🪪 Creator PII minimization

Creators exist to the agent as tokens + coarse buckets. Raw handles surface only at the human hand-off moment, and that reveal is written to the audit log.

Token	Region tier	Audience band	State
#c8f2	Tier-2 EU	10k–50k	brief sent
#a190	Tier-1 US	50k–250k	posted
#7b3e	Tier-2 US	10k–50k	sourced
#f042	Tier-3 SEA	1k–10k	candidate

Raw handle for #a190 revealed 2026-05-11 14:02 UTC for publish hand-off — see audit entry L-0188.

🧾 Audit log — append-only, hash-chained

14:02Publishrevealed handle for #a190 → hand-off (op: rachelb)

13:51Briefsent brief v3 to #c8f2 — #ad disclosure clause attached ✓

13:40Sourcingadded candidate #f042 (Tier-3 SEA, 1k–10k)

13:10Reallocateshifted $300 from cohort B→A (cohort CPV $0.011→$0.009)

12:58Measureingested k-anon bucket batch #44 (no PII, k≥50)

11:30Budgetcap check: 247,900 verified views × $0.01 = $2,479 / $4,000

🔗 chain head 0x9f3a…c2 · verify chain · export signed log

💰 Verified-view ledger — billed from anonymized aggregates, never from tracked individuals

247,900verified views

$0.0099actual CPV

$2,479spent of $4,000 cap

k ≥ 50min cohort size per bucket

Hard budget cap: the agent stops spending when verified-views × $0.01 reaches your deposit. Cap enforced inside the boundary — no override path.

How a view becomes "verified" — without tracking anyone:

watch-time only counted in k-anonymous buckets (≥50 viewers, ≥3s threshold)
dedup & source-anomaly run on cohort distributions, not user IDs
no device fingerprint, no cross-app graph, no per-viewer profile stored

watch-time distribution (bucketed) — billing reads the shaded mass above 3s

Fraud filter — cohort-level flags

Cohort C · burst pattern at 02:00 UTCheld for review

Cohort A · watch-time distribution normalcleared

Cohort D · source mix within boundscleared

Cohort B · dedup ratio 1.4% (norm <3%)cleared

Flags describe cohorts, never people. Held views aren't billed until cleared.

🧑‍🎤 Creator / data-subject portal — what a creator sees when they open their link

You hold token #c8f2 in 1 active campaign:

Brand campaign	What they sent you	What they hold about you
#SS-7741 (DTC skincare launch)	brief v3 + #ad caption template	token, Tier-2 EU, 10k–50k band — no name/email retained

"Forget me" purges your token and bucket label immediately. Action-hashes in the audit log are kept (no PII in them) so the brand can still prove what was done — your identity is gone, the accountability record stays.