Policy & red lines

These rules are permanent. Most of them are enforced by architecture, not by promise — the contract has no field that could violate them.

Data, never directives

The sponsored payload is three strings: label, text, url. There is no instruction to any model anywhere in the contract — no "please display", no rendering hint, nothing addressed to the host. The host model decides, on its own judgment, whether an offer is worth surfacing.

Disclosed, always

label is hardcoded to the literal string "Sponsored" in every SDK. There is no undisclosed mode. Removing the label isn't forbidden — it's impossible.

CPA / CPC, never CPM

We never sell impressions. See Economics & payouts.

Where ads never appear

• On tool error results — adapters only attach to successful calls
• On medical, security, or fact-checking surfaces
• Inside Claude sessions or Anthropic directories via injection — the only path into a conversation is a host model choosing to render a labeled data field from a tool the user installed

Privacy

Six allowlisted context keys (tool, category, query, route, locale, country), values truncated to 200 chars, filtered client-side before a request is built. No transcripts, no profiles, no cookies, no cross-session identifiers — the schema has nowhere to put them.

Inventory honesty

What demand partners buy is exactly what it says it is: labeled slots inside agent tool responses. Misrepresenting traffic or inventory — in either direction — is a permanent ban with clawback.