1. Turn the paid advertising goal into a testable operating question
1.1 Start with the order outcome, not the impression
A paid advertising plan should not begin with “spend the budget.” It should state the operating question: acquire a defined kind of qualified visit, create a first purchase, bring an existing customer back, or test whether a market deserves more investment. The question needs observable events such as a qualified session, product view, add-to-cart, checkout start, order confirmation, refund, or cancellation. That makes it possible to place activity records, orders, and cost records on one reconciliation timeline instead of treating clicks as business results.
Use Shopify's campaign creation guidance to check the objects, fields, and constraints visible in the store at implementation time. The documentation explains product capabilities and reporting vocabulary; it does not promise traffic, orders, or revenue for a particular store. Write the goal as a testable hypothesis and name the evidence that could disprove it.
1.2 Define success as a set of gates
A useful goal has at least four parts: audience or market, approved budget ceiling, observation window, and stop-or-continue conditions. For example, a team can require a complete reporting cycle that validates the event chain and contribution-margin definition. It should not promise a fixed growth percentage. The former can be judged honestly when data is incomplete; the latter can turn noise into a commitment.
The goal record should also list what cannot be inferred. Cross-device behavior, consent refusal, ad blocking, overlap with organic visits, and delayed reporting create unobservable areas. Put recorded orders, attributed orders, and estimates in separate fields. An estimate needs assumptions, version, and owner; it must not be presented as a native Shopify fact.
2. Put revenue, cost, ROAS, and CAC on one vocabulary
2.1 Split revenue and expense fields before calculating a ratio
Keep order totals, discounts, shipping, taxes, refunds, returns, payment costs, advertising spend, and fulfilment costs as separate fields. Media spend follows an invoice period, time zone, and currency, while Shopify reports use store settings and order timestamps. When they do not line up, preserve the raw values and document the converted analytical values. Do not overwrite a source value simply to make a dashboard balance.
| Definition | Calculation object | Useful for | Must not imply |
|---|---|---|---|
| Gross revenue | Original order and product revenue aggregate | Order scale | Cash received or profit |
| Net revenue | Gross revenue less defined discounts, refunds, and related items | Attribution and period reconciliation | Contribution margin |
| Advertising spend | Recorded media cost in the billing window | ROAS and budget pacing | Incremental revenue |
| Contribution margin | Revenue less stated product, fulfilment, payment, tax, and related costs | Affordable acquisition cost | Company net profit |
| CAC | Defined acquisition spend divided by qualified new customers | Efficiency comparison | A causal order from one ad |
Use Shopify's marketing activities and marketing analytics pages to verify the current fields and report behavior. Record the report time, filters, market, currency, and whether refunds are included. The same order can have different roles in different reports because reporting and attribution rules are not identical.
2.2 ROAS is a ratio, not a promise
ROAS is often described as attributed revenue divided by advertising spend, but both terms need definitions. Revenue could mean gross revenue, net revenue, or revenue observed after a refund window. Spend may or may not include platform fees, agency fees, production, and tax. Display numerator, denominator, window, and filters together so another reviewer can reproduce the ratio. A higher ROAS does not prove higher contribution margin, and it does not prove that a larger budget will preserve the ratio.
CAC is another management view. Tie it to a qualified-new-customer definition and exclude browsing-only records, repeat orders, or identities that cannot be verified. If new-customer recognition is incomplete, label the denominator as identifiable new customers and show the missing portion. Never turn a ratio into a guaranteed return; bring each decision back to cost, revenue quality, refunds, and the defined window.
3. Use contribution margin to constrain affordable acquisition
3.1 Pull direct costs into the reconciliation
An advertising panel can show spend and attributed outcomes, but it does not automatically unify product cost, fulfilment, payment, tax, and refund accounting. Every contribution-margin field needs a source, currency, event time, and estimate flag. If a cost is unknown, do not enter zero. List it as missing and make the gap part of the stop gate.
Cross-border stores must not mistake tax or currency conversion differences for an advertising-efficiency change. Product margin, destination tax, refund timing, and billing periods can fall on different dates. Keep order time, refund time, and settlement time separately, then select a window for the decision. Show original-currency values before the analytical currency and retain the rate source and conversion time.
3.2 Decide with ceilings, payback, and uncertainty
An organization may define an affordable CAC as a contribution-margin amount multiplied by an approved payback rule, less an explicit risk or service reserve. That is a business decision rule, not a Shopify-native threshold. When a new market has not reached a mature refund window, use a conservative range and record the reason. Do not let one attractive average hide differences between countries, products, and new or returning customers.
A sound financial gate answers when to pause if revenue falls, refunds rise, or a cost is missing; who fills a delayed field; and which evidence remains usable when attribution is unstable. The purpose is to make it safe to stop the budget, not to force more spend to defend an earlier opinion.
4. Put attribution windows and unobservability next to the result
4.1 Fix the window and keep the raw touchpoint
Attribution is an interpretation that connects touchpoints to orders under a rule; it is not an innate property of an order. Keep touchpoint time, source, medium, campaign identifier, order time, refund state, and attribution-window version. Shopify's marketing analytics documentation helps a team understand current dimensions, but windows and available data can change with the product, settings, and consent state.
| Evidence layer | Fields to retain | Interpretation | Risk |
|---|---|---|---|
| Touchpoint | Time, source, medium, activity key | A visit or interaction was recorded | Does not prove incrementality |
| Session | Device, page, event time | Whether a path is complete | Cross-device paths can break |
| Order | Order time, market, currency, status | Revenue and refund reconciliation | One order can have several explanations |
| Window | Start, end, version, filters | Reproducing a report | Changing it changes the result |
| Blind spot | Refusal, blocking, missing, delay | What is unknown | Do not fill it with zero |
4.2 Separate “not observed” from “did not happen”
No pixel event does not mean no visit. No attributed touchpoint does not mean an advertisement had no effect. No returned order does not mean no order occurred. Keep observed, unattributed, delayed, and unknown separate and assign a follow-up action to each. For cross-device, cross-domain, or consent-refused cases, report what can be verified and do not replace raw evidence with a model output.
Save marketing-performance snapshots with their filters and versions. If data is still delayed, mark the daily value provisional and update it in the weekly report when confirmed. Keep both snapshots and the reason for the difference. This prevents overstatement and tells the budget owner when the evidence is ready for a stop-or-continue decision.
5. Keep campaign setup to the smallest runnable configuration
5.1 Check the object, market, and owner first
Before creating an activity, write a configuration summary: goal, product set, market, store currency, budget ceiling, observation window, owner, approver, and stop gate. Follow the campaign setup workflow to check what is currently available; do not infer today's fields from an old screenshot. Use a stable, readable activity name instead of an opaque sequence.
5.2 Bind the activity to a measurement contract
Each activity should reference a measurement contract that defines primary and supporting events, the UTM combination, the order deduplication key, the revenue definition, and exception handling. Another person should be able to reproduce spend, touchpoints, and orders from the exports. If an activity covers several countries, market and currency are required fields. If one creative crosses markets, split reporting by market instead of blaming an exchange-rate or tax difference on the advertisement.
An activity enters its observation window only after configuration, event, and small-sample checks pass. Successful creation does not prove that a pixel sends correctly or that a report has finished its delay. Label the first cycle as a verification period and do not use its ratio as a stable baseline.
6. Validate pixels, customer events, and data sharing in layers
6.1 Separate pixel code, event semantics, and report fields
Shopify's pixel guidance and customer-events guidance define the current event concepts, visibility, and configuration entry points. The Web Pixels API is useful for implementation and test cases. None of these sources means that every advertising channel has identical return data.
Test in three layers: whether the event fires, whether its fields meet the minimum matrix, and whether the report receives and attributes it as expected. Use controlled sessions and test orders for the business events needed by the decision. Do not collect personal data just to fill a panel. Each test records time, environment, test marker, and expected result.
6.2 Failure-test a custom pixel
Use the marketing pixels developer documentation as the implementation boundary. Test duplicate firing, page refresh, refunds, no-consent states, missing fields, and script-load failure before deployment. A test order must be distinguishable from production revenue. When a field is unavailable, mark it unavailable and stop at human review; do not treat an empty value as zero.
| Test surface | Input | Evidence expected | Failure action |
|---|---|---|---|
| Trigger | Controlled page and order | Event time, name, test marker | Pause spend and inspect loading |
| Deduplication | Refresh and repeated callback | Deduplication result for one business event | Isolate duplicate records |
| Fields | Product, order, currency | Minimum field matrix and missing flags | Do not invent fields |
| Consent | Allowed, refused, withdrawn | Configuration state and event difference | Policy review |
| Reporting | Export after the delay | Report fields reconciled to orders | Mark provisional |
| Fault | Blocked script or timeout | Error log and fallback path | Close change and revert |
7. Make UTM naming and order deduplication reproducible
7.1 Use a bounded naming dictionary
UTM values are readable keys between a touchpoint and a report; they are not proof of return. Establish a dictionary for source, medium, campaign, content, and market with casing, separators, reserved words, and missing-value behavior. Do not mix spellings in one activity. If an old link cannot be changed, map its value to the normalized value without erasing the original.
Run a static check before a link is published: required parameters, spaces or hidden redirects, market and currency match, and landing-page route. A missing value is unknown; it is not an invitation to guess from the page title. Keep the raw export and transformation version so a future number change can be traced to data or to a rule.
7.2 Use an order-level key for duplicates and delay
The reconciliation table needs a stable order identifier, order state, first touchpoint, and attribution version. Add refund, cancellation, and partial-refund events instead of overwriting the first order record. When an order has several touchpoints, apply the approved rule and show the unallocated portion. Never add revenue from several attribution models together.
Group orders, advertising spend, activity reports, and pixel events by day, market, and currency. Before each aggregation, check duplicate keys, time boundaries, and export row counts. If the row count changes without an explanation, pause the report. Reconciliation is meant to expose and explain a difference, not to force every total to match.
8. Treat consent, privacy, and data minimization as gates
8.1 Collect only what the decision needs
Use Shopify's pixel privacy settings and marketing-data-sharing guidance to check the current store controls, consent state, and sharing choices. Privacy implementation must follow applicable policy and organizational review. This article is not legal advice and cannot decide a region's legal conclusion for a merchant.
First list required and optional fields. If event time, activity key, market, and an anonymized order summary are enough, do not collect names, addresses, complete email addresses, or complete payment details. Keep only the summary needed for troubleshooting, assign access by role, expire exports, and record who approved the extract.
8.2 Put consent state into QA
Run the event matrix once for allowed, refused, withdrawn, and undecided states. Record which events were sent, which fields were omitted, and how the report labels the unknown. A script loading successfully is not a legal-compliance conclusion. A privacy owner should review implementations that need personal data, and the team should pause unverified sharing or spend when a store setting changes.
The developer access-scopes documentation and privacy compliance documentation help engineers ask about least privilege, data access, and app obligations. They do not replace legal review or a merchant's internal approval.
9. Put cross-border currency, time zone, and tax on one timeline
9.1 Preserve original currency and document conversion
Keep the order currency, advertising-billing currency, and analytical currency as separate values. Each conversion records its rate source, rate date, rounding rule, and market. Do not add several countries' spend and compare it with an unconverted order total. When there is no comparable basis, show the currencies side by side and label the limitation.
9.2 Isolate tax, refunds, and time boundaries
Order time, billing time, refund time, and settlement time may use different time zones. Define the business-day boundary before normalizing and keep the original timestamps. Tax is part of order economics, but an advertising team must not infer registration responsibility or tax conclusions from a ratio. For each target market, separate destination, product, order-state, and tax fields; send missing tax facts to the responsible owner.
| Dimension | Raw record | Normalized field | Reconciliation check |
|---|---|---|---|
| Currency | Order and billing currency | Analytical-currency amount | Rate source and date exist |
| Time zone | Original timestamp and source zone | Business day | Boundary is consistent |
| Tax | Order tax and applicability flags | Separate tax amount | Not mixed with ad spend |
| Refund | Refund time, reason, amount | Matured net amount | Initial order not overwritten |
| Market | Country, catalog, target market | Market dimension | No unmarked cross-market sum |
| Rounding | Source precision | Report precision | Difference has a threshold note |
10. Set budget, experiment, and stop gates before spending
10.1 Manage the budget by ceiling and pacing
The budget record separates approved ceiling, daily pace, committed cost, consumed cost, and pending settlement. Use Shopify's marketing performance guidance to check current performance fields and use the platform invoice as a second cost source. Fast spend does not prove demand, and slow spend does not prove failure. Interpret either with event coverage, inventory, market, and reporting delay.
10.2 Change one primary variable
Before an experiment, record the hypothesis, market or audience, primary event, observation window, budget ceiling, success gate, stop gate, and owner. Change one primary variable, such as landing-page version or bidding rule. If the creative, audience, UTM, and checkout settings all change, the result cannot be explained. Keep report fields, time boundaries, and refund maturity the same for comparison.
| State | Continue when | Pause when | Record |
|---|---|---|---|
| Configuration | Object, market, budget, access checked | Field missing or goal unclear | Approval and version |
| Event validation | Key events and minimum fields pass | Missing or duplicate event | Test-order evidence |
| Small observation | Data arrives and can be reproduced | Ceiling exceeded or data unexplained | Daily snapshot |
| Experiment | One variable and window intact | Stop signal is triggered | Hypothesis and change |
| Period decision | Cost, margin, refund reconcile | Blind spot too large or vocabulary drifted | Weekly report and decision |
| Exit | Result is reviewable and next action exists | Safe continuation cannot be shown | Close reason |
A stop gate is not a declaration of failure. It protects budget, customer data, and judgment. Pause when there is metric drift, duplicate pixel firing, a consent-branch error, missing cost, a refund anomaly, or spend above the approved ceiling. Never skip the gate to preserve an attractive ROAS.
11. Make daily and weekly reports answer different decisions
11.1 Daily reporting handles freshness and incidents
The daily report asks whether the operation is safe today: spend is within pace, key events arrive, orders and refunds show no unexplained anomaly, exports completed, and no consent or script fault is open. Every number carries data time, time zone, provisional status, and owner. If a feed is delayed, write “pending confirmation” instead of reusing yesterday's number.
11.2 Weekly reporting handles vocabulary and budget decisions
The weekly report uses a complete observation window and shows spend, net revenue, contribution margin, identifiable new customers, CAC, attribution window, refund maturity, and the unobservable portion. Split by market, currency, product set, and customer status. Explain changes caused by definitions or exchange rates. Compare periods only when fields and maturity are stable; do not compare one immature window with one matured window and claim fixed growth.
Use Shopify's default marketing reports to review report fields, filters, and export behavior. Keep the raw download and review record. If an owner changes a definition, update the dictionary, calculation, and future comparison baseline together.
12. Isolate an anomaly before explaining it
12.1 Classify the difference
Classify a mismatch as a time boundary, currency conversion, refund delay, duplicate event, missing UTM, order deduplication, access problem, or failed export. Each class needs an original file, first-seen time, impact, owner, and next action. Before classification, do not call it “channel volatility.” The advertising system, Shopify report, and internal order table can all be internally correct while using different windows.
12.2 Close a difference with verifiable work
Close an anomaly only after a re-export, recalculation, or approved evidence makes it explainable. Copy the inputs before changing a rule, record the old and new rule, recalculate a small sample, then compare order keys, spend, and refunds. If the issue cannot be reproduced, keep it open and lower confidence. Do not delete an inconvenient row.
| Anomaly | First isolation | Verification evidence | Revert action |
|---|---|---|---|
| Spend spike | Pause budget expansion | Invoice, activity, timeline | Return to approved ceiling |
| Duplicate order | Lock order key | Raw event and order state | Remove duplicate aggregate only |
| Missing UTM | Label unknown source | Link and landing-page check | Disable noncompliant link |
| High refund | Delay mature conclusion | Refund detail and product set | Use a net-revenue range |
| Missing pixel | Stop attribution claim | Event test and log | Restore prior configuration |
| Currency/time error | Freeze cross-market rollup | Conversion table and boundary | Recalculate normalized fields |
13. Make acceptance and rollback repeatable
13.1 Use a pre-launch acceptance list
Before launch, check the activity object and market, budget approval, UTM dictionary, pixel and customer-event behavior under allowed consent states, minimum fields, order key, separate refund and tax fields, reproducible daily and weekly reports, least privilege, and an owned exception queue. Keep the activity in verification status when any check fails.
Fix the acceptance inputs: test order, market, currency, time range, and consent state. Record expected events, received events, report appearance time, and decision. Seeing a tag fire once in a browser is not proof of revenue attribution; cross-check the event, report, order, and touchpoint layers.
13.2 Roll back with an evidence chain
Rollback means stopping the current change, restoring the last approved configuration, isolating the affected aggregate, marking the time range, and notifying budget and privacy owners. Preserve the raw invoice, orders, refunds, events, and UTM files as read-only evidence. Keep new and old calculations separate so a repair cannot overwrite the prior snapshot.
14. Make operating governance accountable
14.1 Assign an owner to every field
The marketing owner maintains the goal, budget, and stop gate. The data owner maintains the metric dictionary, attribution window, and aggregate. The engineering owner maintains pixels, events, and access. Finance or operations maintains costs, refunds, and tax reconciliation. A privacy owner reviews consent and data minimization. One person may hold more than one role, but each role needs a named backup.
14.2 Update three records when anything changes
When an activity, pixel, UTM rule, or report definition changes, update the configuration record, test evidence, and report annotation together. Save version, time, reason, approver, affected market, and rollback point. If Shopify help or developer documentation changes the capability boundary, recheck the relevant fields and tests rather than treating an old page as a permanent guarantee.
To make the process usable across shifts, split a paid cycle into six states: define, configure, validate, observe, settle, and review. Each state has an entry condition and an exit artifact. The define state stores the objective and vocabulary; configure stores the activity and access; validate stores event tests; observe stores daily snapshots; settle stores refund maturity; and review stores the budget decision. These are team operating labels, not Shopify guarantees, but they prevent an unverified number from being promoted into a management report.
The metric dictionary should carry a field name, business definition, raw source, transformation, time zone, currency, refund treatment, allowed-null condition, and owner. A simple “revenue” field therefore says whether discounts, tax, shipping, refunds, and cancellations are included and what order state was present at extraction. A “new customer” field says how identity is recognized, how an unrecognized record is labeled, and how repeat customers are treated. When the definition changes, do not reuse one unversioned column name for both meanings.
An attribution snapshot should be reviewable without logging into an advertising console. Preserve the activity export, order export, event summary, filters, window boundaries, and generation time. Keep raw files read-only and put transformed values in a separate location. A reviewer checks row counts, unique keys, and time boundaries first; then revenue and refunds; and only then ROAS or CAC. If any step differs, pause the ratio interpretation and record the difference class and impact.
Pixel QA should include a real browser, refresh, back navigation, repeated clicks, variant changes, purchase completion, and a low-bandwidth load. Give every test a unique marker. If duplicate events appear, isolate them in the aggregate instead of deleting the event. If an event is delayed, retain both the business time and receipt time. This separates browser failure, processing failure, and reporting delay rather than collapsing all three into one advertising conclusion.
Consent QA treats “undecided” as its own state. The test record says not only whether an event was sent but also which minimum fields were sent, which were omitted, whether later sharing stopped after withdrawal, and how the report labels the gap. If an anonymous summary is used, state its generation boundary and retention period. Do not bypass a consent branch just to make a cross-border report look complete; the gap belongs in the daily and weekly confidence note.
For cross-border cost control, produce two layers for each analytical day. The first lists orders, invoice spend, refunds, and tax in original currencies. The second applies the approved conversion rule for the analytical currency. Both layers retain row keys and aggregate checks. If a market looks abnormal near a day boundary, recalculate from original timestamps before interpreting it. When rate date and refund maturity differ, delay cross-market ranking rather than manufacturing comparability with one conversion number.
The budget owner should make only a few high-value daily decisions: whether pace is exceeded, whether unapproved spend exists, whether key events are complete, whether a high-risk incident is open, and whether data is fresh enough. The data owner maintains the delay queue and field gaps; engineering maintains scripts and access; operations explains orders and refunds. Write each decision beside its evidence location so a new operator can reproduce it without relaxing a gate because someone remembers the history.
An experiment review can deliver “uncertain” as a valid result. Record the original hypothesis, actual changes, reach, usable observation time, excluded records, refund maturity, attribution blind spots, and stop reason. If consent refusal or a technical fault reduces usable data, report the reduction and the repair for the next cycle. Do not call an inconclusive result a failure, and do not call a short fluctuation fixed growth; the valuable output is stronger evidence for the next budget decision.
Close an anomaly only after a second person or equivalent approval reviews it. One person reproduces the inputs; another checks the rule, order key, original-currency amount, refunds, and report filters. The close note references the input snapshot and repair version, states the affected date range, and says whether a weekly report must be rerun. If protected data, elevated access, or external sharing is involved, pause and request the appropriate review instead of using reporting urgency as an exception.
Keep a small rehearsal for every fallback path. Use a test activity, an anonymized summary, and a simulated fault to verify pausing spend, restoring the prior pixel or naming rule, isolating the affected aggregate, notifying owners, and reopening the observation window. A rehearsal proves that the process is executable; it proves no return. In a real incident, preserve raw evidence, mark scope, restore the approved configuration, and only then decide whether measurement can restart.
Data availability can also be governed in levels. Level one means a raw file arrived but has not passed validation. Level two means fields and unique keys pass but refunds are not mature. Level three means the window, costs, and orders have been reviewed. Only level four is a stable snapshot for a budget decision. The daily report shows the level and its gaps; the weekly report compares only periods that meet the agreed level. This is not a quality label. It tells each owner which decision is safe and which one is premature.
When reviewing a report, ask five questions first: what is the time range, which currency is used, are refunds deducted, does the denominator contain only identifiable new customers, and which visits or events are unobservable? If any answer is unclear, lower the conclusion to pending confirmation. When sharing a file with an external team, include the dictionary, filters, and anonymization rule so the recipient does not see one ROAS number and infer a meaning it does not have.
Recalculation should use deterministic inputs where possible. Retain the download filename, generation time, row count, and a digest; retain the transformation version and parameters; and retain the reason for each manual exclusion. On a repeat run, compare input digests before intermediate tables and results. If identical inputs produce different results, pause publication and inspect rules, time-zone libraries, and access changes. Reproducibility does not prove correctness, but a non-reproducible number should not carry budget responsibility.
When an activity ends, run an exit review. Compare actual spend with the approved ceiling, list pending cost and refunds, check key-event coverage, state whether the attribution blind spot is acceptable, decide whether temporary access or pixels remain, and identify rules worth carrying into another experiment. Close the activity record without deleting raw evidence. A later restart uses a new version and observation window rather than merging unlike cycles into one historical average.
15. Official evidence and same-language reading paths
15.1 Closed official source index
This page uses only the following Shopify official sources for verifiable facts. Pages, permissions, report fields, and availability can change; recheck them at implementation time:
- Create marketing activities
- Marketing activities
- Marketing analytics
- Marketing performance
- Pixels
- Pixel privacy
- Customer events
- Marketing data sharing
- Marketing analytics reports
- Default marketing reports
- Web Pixels API
- Marketing pixels
- Access scopes
- Privacy law compliance
- ShopifyQL query
15.2 Keep related links in the same language
For further store-market, product-page, and technical implementation context, use these same-language pages. They are navigation paths and do not change this page's paid-advertising definitions:
- WESWOO services
- Shopify Markets global selling guide
- Advanced Shopify Liquid guide
- Shopify headless
- Shopify Plus
16. Frequently asked questions
FAQ 1: Does a high ROAS mean the budget should always increase?
No. Check the revenue and spend definitions, refund maturity, contribution margin, attribution window, unobservable portion, and budget pacing first. More spend can change traffic mix and marginal cost, so the old ratio cannot be projected automatically. Use an approved experiment and stop gate instead of treating history as a return guarantee.
FAQ 2: Can we conclude that advertising produced no orders when pixel events are missing?
No. Missing events may be caused by consent state, blocking, script failure, cross-device behavior, or reporting delay. Reconcile orders, marketing reports, UTM values, and observable events, and label the unknown portion. Do not make a causal claim until the event chain is repaired or the limitation is explicitly accepted.
FAQ 3: Can all cross-border amounts be added directly across countries?
Only after original currencies, rate dates, time zones, taxes, refunds, and rounding are normalized and recorded. Preserve original-currency values and conversion evidence. If the markets are not comparable, show them separately rather than hiding a currency difference inside an efficiency metric.
FAQ 4: If consent is refused, can another field be used to recover the customer's identity?
Do not do that. Collect the minimum data needed for the decision and follow the store's applicable policies for allowed, refused, and withdrawn states. Event QA should show which fields were omitted. Personal-data designs need privacy-owner and appropriate legal review; this article is not legal advice.
FAQ 5: Can an old report be overwritten after a reconciliation problem is fixed?
It should not be. Preserve raw exports, old and new rules, input snapshots, and the difference note. Recalculate a small sample before publishing a new aggregate. This makes it possible to see what changed in order keys, spend, refunds, and currency conversion and to return to the last approved result if the new rule is unsafe.