Three origins, three rules
Every publish in CreatorBase carries where it came from, and the rules are attached to the origin, not to the AI's judgment. A click in the app is your consent — that publish goes out. A request that comes out of a conversation with Friday is gated by your brand's require-approval setting, which defaults to on: the draft stops at "ready" and waits for you. And an unattended scheduled run can never publish at all. No exceptions, no override flag.
The important part: these rules live in typed code, not in a prompt. The AI can't be talked out of them, by you on a bad day or by anyone else's text that ends up in its context.
The edge cases we sweated
Double-clicks: publishing from the app carries an idempotency key, so a double-click, a second tab, or a retry after a timeout can't post twice.
Timeouts: if the publisher times out mid-request, CreatorBase treats the outcome as unknown rather than retrying blindly — because the one thing worse than a failed post is the same post going out twice.
Schedules: "will it post without me?" has a precise answer. Only through a schedule you created yourself — which is your consent, given in advance — and there's a log of everything that went out.
Why one publisher, not two
CreatorBase publishes through exactly one publishing service, connected to the accounts you choose. There used to be a second adapter, and it was deleted rather than kept as a fallback — two code paths into the same real social accounts isn't redundancy, it's a silent conflict. Your accounts are the one place this product refuses to be clever.