The whole design, in writing
Every step of the build above, written out: the problem each piece solves, the option that was taken and the ones that were not, the numbers, and how it fails in production.
The big idea
A platform built ON generative models, not just serving them
Generating one nice-looking ad image is a solved problem — plug into any image model. What's genuinely hard is everything AROUND that: generating dozens of testable variants, making absolutely sure none of them violates ad-platform policy (a violation can get the whole account suspended), tracking commercial usage rights, and actually learning from real performance data instead of guessing.
We'll build the product layer: programmatic variant generation, a fail-closed compliance gate, rights tracking, dynamic budget allocation across variants, and a real performance feedback loop.
What the new pieces do
- Advertiserclient
- A brand or marketer wanting many tested creative variants fast, not one hand-designed ad that may or may not perform.
Step 1 · The baseline
One hand-designed creative per campaign
Simplest version: a designer manually produces one ad creative per campaign. What's the real limitation?
One manually-designed creative per campaign. What's the core limitation for a real advertiser?
Advertising performance varies enormously by wording, imagery, and CTA in ways that are genuinely hard to predict up front — a single creative, however well-designed, is a single untested guess about what will actually convert.
Advertisers fundamentally need to TEST — run multiple variants against real audiences and let actual performance data reveal what works, which a single hand-made creative structurally can't provide.
Production speed for ONE creative is a secondary concern — the deeper limitation is the complete absence of any tested alternative to compare it against.
A single hand-designed creative is an untested guess — real ad performance depends heavily on wording, imagery, and CTA choices that are hard to predict without actually testing alternatives against real audiences. The platform's value is enabling that testing at scale.
Why this piece earns its place
One creative in market produces one number, and nothing in that number separates a weak headline from a badly chosen audience or a bid that never won the auctions worth winning. Every post-mortem becomes an argument between the people who made each of those three decisions, and none of them can be settled with the evidence on hand. Running variants concurrently removes the time-and-market confound — comparing this month’s creative to last month’s compares the market as well — but it does not remove the delivery one, because the ad platform still chooses who sees each variant, which is the problem Step 5 has to pick up again. This framing also fixes the unit the rest of the platform addresses: the brief, not the creative. Compliance, rights, budget and formatting all hang off a brief and its children, and retrofitting that parentage later is genuinely painful. Where the baseline still wins: a flagship campaign whose creative is the asset — a shot film, a licensed face — cannot be tested into existence, and in a regulated category where every line needs legal sign-off before it runs, a wide batch costs more in review than the test can return.
What the new pieces do
- Creative APIgateway
- Accepts a creative brief (brand guidelines, product, goal) and orchestrates everything that turns it into tested, live ad variants.
Step 2 · Programmatic variant generation
Many variants, not one "best" guess
Should the platform try to generate the single best creative from a brief, or something else entirely?
Given a creative brief, should the platform aim to generate ONE optimal creative, or many?
No generation process can reliably predict real-world ad performance in advance — "best judgment" is still a guess, and a single output gives advertisers nothing to actually TEST against, defeating the entire empirical value proposition from Step 1.
Generating many genuinely different variants gives advertisers real alternatives to test against actual audiences — the platform's job isn't to guess the single winner, it's to produce a good pool of candidates and let real performance data determine which one(s) actually win.
Making variance opt-in misses the point — testing multiple variants against each other IS the core value proposition, not an optional extra most advertisers would need to specifically ask for.
Build a Variant Generator that programmatically produces many creative variants from a single brief — different headlines, images, and calls-to-action — explicitly to enable real testing, not to guess a single "best" answer up front.
Why this piece earns its place
Diversity has to be engineered; it does not fall out of sampling the same model repeatedly. Turn the temperature up and you mostly get rewordings of one idea, and a batch whose variants differ only in phrasing is a batch whose real differences are tiny — separable in principle, but only at a traffic cost far past what the campaign has to spend, which in practice means the test ends without a verdict. So vary along named axes: the hook, the image subject, the call-to-action verb, the offer framing. Bigger axes open bigger gaps, and a gap is what a finite budget can actually resolve. Write the axis and its value onto each variant as structured metadata at generation time, because a feedback loop can only learn from attributes it can name, and a variant pulled later can only be traced to its siblings through them. The last thing experience teaches is that batch size is bounded by traffic, not by generation cost — arms need impressions before they mean anything — so it belongs in the campaign’s own parameters, sized against the budget that campaign actually has.
What the new pieces do
- Variant Generatorservice
- Programmatically produces many creative variants from one brief — different headlines, images, and calls-to-action — for real A/B testing, not just one "best guess."
Step 3 · The compliance gate fails closed
One violation can suspend the whole account
Every generated variant needs to be checked against brand guidelines and ad-platform policy before going live. If that check is temporarily unavailable, should variants publish anyway?
The compliance check is briefly unavailable. Should variant publishing continue without it?
A single generated variant that violates ad-platform policy (a prohibited claim, restricted content) can get the ENTIRE ad account suspended — a consequence wildly disproportionate to whatever delay a brief compliance-check outage would cause. This isn't a trade worth making.
Given the asymmetric stakes (a brief delay vs. a potential account suspension affecting every campaign that account runs), blocking publication until the gate is healthy again is the only defensible default — this is the same fail-closed principle used for spam filters and model-eval gates elsewhere, applied here because the downside of failing open is severe.
Sampling still lets some fraction of violating content through — for a risk this asymmetric (one violation can suspend the whole account), partial checking isn't meaningfully safer than no checking.
Make the Brand-Safety Gate fail closed: while unavailable, generation and drafting continue, but no variant can be published to a live ad platform. The stakes — a single violation risking suspension of the entire ad account — make this the only defensible default, regardless of the inconvenience of a delay.
Why this piece earns its place
Failing closed makes this gate the availability floor for the entire product: an hour of gate downtime is an hour in which nothing ships, so its own uptime is now the number you defend. That argues for keeping it small and dependency-light — a chain of third-party model calls in the publish path buys accuracy and sells availability. It also checks two things that behave nothing alike. Brand rules belong to the advertiser: written down, versioned, changed on their schedule. Ad-platform policy belongs to the platform and moves without telling you, so there is no platform version number available to stamp. What is stampable is your own snapshot of that policy — the encoded ruleset the gate actually ran, carrying an id — and every approval should record it. That will not tell you which of the platform’s rules moved; it tells you what each live creative was cleared against, which turns the Step 8 re-check from a sweep of everything into a much smaller set. The failure to watch for is not the violation, it is strictness: a gate that rejects too much trains advertisers to export the creative and upload it by hand, and every variant that leaves through that door takes its performance data with it.
What the new pieces do
- Brand-Safety Gateservice
- Checks every variant against brand guidelines AND ad-platform policy before it can go live — the highest-stakes gate, since a violation risks account suspension.
Step 4 · Rights and commercial licensing
Generated doesn't automatically mean usable
A generated image might resemble a real person, use elements that echo a trademark, or come from a model whose outputs have ambiguous commercial usage rights. Is passing brand/policy checks alone sufficient to publish?
A variant passes brand-safety and platform-policy checks. Is that alone sufficient to clear it for a paid ad?
Brand and platform-policy checks assess CONTENT appropriateness — they don't verify whether the specific generated asset is actually licensed for commercial advertising use, or whether it inadvertently resembles a real person's likeness or a trademarked design, which are separate legal risks entirely.
Rights and licensing is a genuinely distinct concern from content-policy compliance — a perfectly brand-appropriate, policy-compliant image can still carry real legal risk if it wasn't actually licensed for commercial use, or if it incidentally resembles a real person's likeness without consent.
Generated content's commercial usage rights depend on the specific model/training data and licensing terms involved — this is far from automatic, and assuming it away invites real legal exposure.
Maintain a Rights & Licensing tracker separate from content-policy checks: it verifies a generated asset is actually licensed for commercial ad use and flags likeness or trademark risk before publishing — a distinct legal concern from whether the content is appropriately worded or policy-compliant.
Why this piece earns its place
Rights is a record-keeping problem more than a checking problem. The check runs once; the obligation lasts as long as the ad runs and well beyond it. So what this component must produce is not a pass flag but a provenance record — which model, which model version, which prompt, which source assets, who approved it — written at generation time. Months later a letter arrives naming one image, and a boolean is not evidence. The second-order consequence is that today’s answer may not survive the year. Terms attach to a model version, and a vendor can revise the terms it offers — normally binding what you generate next rather than reaching backwards, but the moment one lands, everything already live under the old terms has to be re-examined rather than assumed. Your own upgrade is the cleaner case: it moves the position for future generations only, which is precisely what the provenance record lets you demonstrate instead of argue. The tracker therefore needs a sweep — show me every running creative produced by this model version — and not only a per-asset lookup, and it needs to have been built before the day you need it. You can skip most of this when generation draws on a closed catalogue you already license: then the rights answer is constant and one license per source carries it.
What the new pieces do
- Rights & Licensingdata
- Tracks whether a given generated asset is actually licensed for commercial ad use, and flags likeness/trademark risk before publishing.
Step 5 · Dynamic budget allocation
Beyond a fixed A/B split
Many approved variants are ready to run. Should ad spend be split evenly across all of them for a fixed test period, then pick a winner?
Several approved variants are ready. Split budget evenly across all of them for a fixed period?
A fixed even split spends real advertising budget on clearly-underperforming variants for the ENTIRE test duration, even once it's become fairly obvious they're losing — wasting spend that could have gone toward variants that are actually converting.
A bandit allocator treats each variant as an "arm" and continuously reallocates spend toward whichever is currently performing best, based on accumulating real data — this captures much more value from the SAME total budget than a fixed even split that only reacts at the end of the test period.
Random daily rotation doesn't use performance DATA to inform allocation at all — it's not meaningfully better than a fixed split and actively wastes budget on days a clearly weaker variant happens to be selected.
Use a Bandit Allocator: rather than a fixed even split, continuously shift spend toward variants demonstrating stronger real performance and away from weaker ones, using accumulating data throughout the test rather than only reacting at a fixed test's conclusion.
Why this piece earns its place
The algorithm is the easy part. The reward signal decides whether this helps or quietly hurts. A click is recorded the moment it happens; a purchase lands later, often after the session that caused it has closed. The allocator converges on whatever you feed it — give it clicks and it will reliably find the variant that wins the click and loses the sale, and every dashboard the allocator itself reports on will read that as success. So pick the metric whose delay you can tolerate, and say out loud that arms keep drawing budget throughout the window in which their own outcome is still unknown. Worth remembering too that spend is a bid, not an impression: the ad platform’s own optimizer sits between the two and decides who sees what, so an arm’s result is confounded by the audience the platform chose to send it. The knob that belongs to the campaign rather than the platform is the exploration floor, the share of spend held back for arms that currently look weak. And a variant added mid-flight has no history, so it must be seeded deliberately or it starves the moment it is born.
- fixed A/B splitwastes spend on the fixed period's losers
- bandit allocationcontinuously reallocates toward winners
- same total budgetmore value extracted
What the new pieces do
- Bandit Allocatorservice
- Shifts spend toward better-performing variants in real time, rather than splitting budget evenly across all of them for a fixed test duration.
Step 6 · Close the performance feedback loop
Learn from what actually converted
Performance data accumulates on every variant. Should that just sit in a dashboard, or feed back into anything?
Feed Performance Metrics back into future Variant Generation: not retraining the underlying generative model per campaign, but using observed patterns (which styles, tones, or structures tended to convert) to bias what kinds of variants get generated for future briefs — the system gets measurably better at proposing promising variants over time, informed by real outcomes rather than generating blind every time.
Why this piece earns its place
A closed loop feeds on its own output, and that is the risk worth naming. The allocator can only spend on variants that were generated, and generation is now biased by what the allocator spent on, so an approach nobody tried accumulates no evidence and stops being tried. The pool narrows onto a local optimum while average performance keeps rising — which, from the outside, is exactly what improvement looks like. The defence is structural: reserve part of every batch for variants deliberately off the learned distribution, and judge the loop by whether attributes new to an account still win sometimes, rather than by a mean that will climb either way. Scope matters as much as mechanism. What converts is specific to an advertiser and their audience, so learning pools per account by default; a brand’s winning hook surfacing in a competitor’s generated variants is the kind of thing that ends a contract. And version the learned bias like any other input to generation — when a week of output gets worse, you want to roll back a named set, not guess which outcomes taught it that.
What the new pieces do
- Performance Metricsdata
- Tracks which variants — and which style/attribute patterns — actually converted, closing the loop back into future generation.
Step 7 · Platform-specific formatting
One approved creative, many required shapes
An approved creative needs to run on Instagram Stories (vertical), a Google Display banner (wide), and a feed post (square) — each with different required dimensions and format constraints.
A Platform Formatter automatically adapts approved creative into each target platform's required aspect ratios and format specs — generating the necessary crops/resizes rather than requiring the advertiser to manually reformat one creative for every channel it needs to run on.
Why this piece earns its place
Reformatting is not a lossless transform, and that is the sharp edge under an otherwise clean separation. A crop can drop the disclaimer, the legal line, the logo, or the part of the frame that made a claim defensible — and the result is content nobody approved, wearing an approval. The workable rule: a format that preserves every approved element inherits the approval, while one that drops or reflows an element is new content and goes back through the gate. That distinction is only cheap to make automatically if the formatter works from a layered composition — background, subject, headline, legal, logo, each with its own safe region — rather than re-cropping a flat rendered image, which reaches back into how Step 2 generates in the first place. Platform specs are the second trap. File-size caps, text-in-image limits and duration rules are external and change without asking you, so hold them as versioned data the formatter reads, not constants compiled into it. A rejection at upload then reads as a stale spec, which is a fix, rather than a formatter bug, which is a hunt.
What the new pieces do
- Platform Formatterservice
- Auto-adapts approved creative into the exact aspect ratios and formats each ad platform (Stories, Display, feed) actually requires.
Step 8 · The sharp edges
Winning isn't the same as safe, and generation isn't free
Two real pressures: a variant that's genuinely winning on clicks but reads as manipulative once more people see it, and the real cost of generating dozens of variants, especially video, before knowing which will actually perform.
Run ongoing compliance re-checks on live, high-performing variants, not just a one-time gate at generation — a variant can start looking manipulative or attract complaints only once it's seen by a wider audience, and a metric win doesn't override a compliance failure discovered later. For cost, use tiered generation: generate cheap image/copy variants first, gather early performance signal cheaply, and only generate expensive formats (full video) for the variants that have already shown promise — rather than producing every format for every variant up front.
Why this piece earns its place
Pulling a variant is an external action, and that is where this gets operational. The creative is already live on platforms you do not control, so the pull is an API call that can be rate-limited, rejected, or silently slow — which means there is a window in which your database says stopped and real people are still being shown the ad. Treat the kill path as its own queue, with retries and a verified terminal state, and never let a status in your own tables stand in for what a platform is actually serving. The unit of the pull matters too. Variants from one brief share attributes, so whatever read as manipulative in the flagged one probably sits in its siblings — recall the attribute, not the single variant, or the allocator promotes its twin at the next reallocation and you meet the same complaint under a new id. Re-checking everything forever is wasted compute; the triggers worth paying for are the three things that change the answer for content that already passed: exposure crossing a threshold, a platform policy update, and complaints arriving.
You did it
You just designed an AI ad creative platform.
Everything you assembled, in order
- A single hand-designed creative is an untested guess — the platform's value is enabling real, data-driven testing at scale.
- Variant generation aims for a good, diverse candidate pool, not a single predicted "best" creative.
- The compliance gate fails closed given the asymmetric stakes — a policy violation can suspend an entire ad account.
- Rights and licensing tracking is a distinct concern from content-policy compliance, covering commercial usage rights and likeness/trademark risk.
- A bandit allocator continuously shifts spend toward better-performing variants, extracting more value than a fixed even A/B split.
- A performance feedback loop lets the platform compound in quality over time, informed by what actually converted.
- Approval and platform-specific formatting are separate concerns — approve once per concept, format many times per platform.
- High-performing variants still need ongoing compliance re-checks, and generation cost is controlled by tiering expensive formats behind early cheap-format signal.