Internal agency operations console
Meta operations proof console
This reviewer console shows how Signal helps authorized agency operators manage client business portfolios, Facebook Pages, Instagram placement eligibility, ad accounts, ad groups, ads, placements, reporting, and human-approved campaign changes.
Requested access
Permission coverage map
System-user authorization context
Authorization and asset grant path
Signal is an internal agency operations app. It does not use a public consumer Facebook Login flow in this demo. Access is granted through Meta Business Manager by installing the app for the business, assigning assets to a system user, and issuing Signal-scoped system-user tokens.
| Workflow step | What Meta should see | Why no public login appears |
|---|---|---|
| Business Manager grant | System user is installed for the verified TCM business portfolio. | System-user flow is server-to-server based. |
| Asset assignment | Assigned Pages and ad accounts are read back from the API. | Client assets are granted in Business Manager, not selected by a public user. |
| Permission proof | Each requested permission is shown in the live evidence log. | The demo uses app-scoped system-user tokens, never browser-exposed tokens. |
Permission proof: business_management
Business portfolio and asset access
Loading redacted live Meta readbacks from the Signal app.
| Asset | Type | Access check | Workflow use |
|---|---|---|---|
| The Contractors Marketing | Business portfolio | Awaiting live readback | Client identity, permissions, asset ownership |
| The Contractors Marketing | Facebook Page | ADVERTISE task | Ad identity, Page posts, engagement context |
| TCM Demo Ad Account | Ad account | Read and manage | Campaigns, ad groups, ads, reporting |
| Instagram placement inventory | Instagram account | Placement check | Feed, Stories, Reels, Explore placement planning |
Permission proof: pages_show_list
Business Manager assigned Page list
This pages_show_list proof uses the Pages assigned to the Signal system user in Meta Business Manager. The selected Page is then bound to ad identity, placement planning, and Page engagement checks before campaign setup.
The Contractors Marketing
Primary client Page used to validate Page access before campaign setup.
| Content source | Signal | How the app uses it |
|---|---|---|
| Facebook Page profile | Page name, masked Page ID, category, tasks | Confirm the Business Manager-assigned client Page before ad setup. |
| Page engagement metrics | Followers, fans, talking-about count | Validate the Page health signal before campaign setup. |
| Recent Page posts (optional) | Recent post rows, if available | Optional content context when the Page token returns post rows. |
| Instagram business account | Account connection and placement eligibility | Show whether Instagram placements can be used for ads. |
Permission proof: ads_read
Campaign reporting and object readback
Permission proof: ads_read
Loading campaign-level ads_read insight metrics from the authorized reporting proof account.
| Campaign insight row | Spend | Impressions | Clicks / reach |
|---|---|---|---|
| AgencyAI Proof | $0.00 | Checking | Checking |
| Campaign object | Status | Object readback | Relationship |
|---|---|---|---|
| AgencyAI Proof | Paused | Campaign object | Related to campaign-level insight rows above |
Permission proof: ads_management
Public writes are blocked unless the private proof code is entered. The gated proof action can rename the parent PAUSED proof campaign and then reads the campaign, ad set, and ad back as PAUSED.
This action updates only the proof campaign name, then verifies PAUSED readback.
If this panel shows IN_PROCESS, wait for Meta to finish processing and click Open live readback until the campaign, ad set, and ad all show PAUSED/PAUSED. The proof action is blocked during processing so no delivery or spend can be triggered.
Signal paused proof ad
Draft creative is created or updated only as PAUSED. The console shows the selected Page, destination URL, ad group, placements, and readback status.
Marketing API Access Tier + audit trail
Operations evidence log
| Step | Permission | Operations evidence | Safety control |
|---|---|---|---|
| 1. Validate app token | public_profile | Signal app ID, operator identity, granted scopes | Secrets are never exposed in the UI |
| 2. Select business | business_management | Business portfolio and assigned assets read back | Only authorized client assets are displayed |
| 3. Select Page | pages_show_list | Business Manager-assigned Pages listed for the connected business | Wrong Page selection blocks ad setup |
| 4. Read Page engagement | pages_read_engagement | Page and content engagement is shown for planning | Data is retained only for authorized workflow needs |
| 5. Read campaigns | ads_read | Spend, impressions, clicks, reach, campaigns, ad sets, ads, and creatives read back | Reporting views do not mutate delivery assets |
| 6. Stage paused draft preview | ads_management | Campaign, ad group, creative, ad, URL, and placements are prepared | Human approval and PAUSED status required |
| 7. Run paused proof update | ads_management | Proof-code-gated server action renames the parent configured PAUSED proof campaign | Name-only update; proof campaign, ad set, and ad must remain PAUSED |