Ad serving - an auction inside a page load

Ask these before drawing anything

• What is the latency budget, and who enforces it? If the publisher drops the slot at 100 ms, then 100 ms is a correctness requirement and not a performance goal, and every design decision below follows from it.
• Is the advertiser billed per impression or per click? Per click means the auction must rank on predicted click-through rate times bid, which introduces a model into the money path and makes prediction quality a revenue number.
• What happens when a campaign goes over budget? "It cannot happen" is not an answer at this latency. The real question is how much over-delivery is acceptable and who absorbs it, and it should be a written number.
• Must a paused campaign stop immediately? Immediately is expensive. Thirty seconds is nearly free. Somebody has to pick, and they should know they are picking.
• Is this a first-price or second-price auction, and are there external demand partners? A real-time bidding call to an external exchange spends half the budget on somebody else's network.
• What are the brand safety and legal constraints, and are they hard filters? An ad shown next to the wrong content is not a quality problem, and it must be filtered before the auction, never scored inside it.

Functional

• Fill an ad slot within 80 ms at p95, or return empty rather than late.
• Select from roughly two million active campaigns by targeting rules - geography, device, audience segment, context, frequency cap.
• Run a second-price auction on expected value: bid times predicted click-through rate, with a floor price.
• Pace each campaign so that its daily budget is spent roughly evenly across the day rather than by mid-morning.
• Never bill an advertiser more than their budget, even when more than their budget was delivered.
• Log every impression and click with the auction that produced it, and reconcile against the spend ledger hourly.
• Give the advertiser reporting that is at most a few minutes behind, and a final billable number that is stable once a day closes.

Non-functional

• p95 80 ms, p99 120 ms, measured at the ad server including its dependencies. Any dependency without a timeout is a bug, not a risk.
• No component on the serving path may perform an unbounded read. The campaign index is in memory, the counters are local, and the model is co-located.
• Over-delivery under 0.5 percent of spend, measured daily. It is never zero, and a target of zero produces a design that under-delivers instead, which is worse.
• The spend ledger is the financial system of record and must lose nothing. It is the only component here with that property, and it is deliberately off the serving path.
• Availability 99.95 percent for serving. An empty slot is lost revenue for that impression only, which makes this one of the few systems where failing fast is genuinely the right call.

Out of scope

• Creative rendering and viewability measurement, which happen in the browser and have their own unpleasant realities.
• Fraud and invalid traffic detection. It is essential, it is a whole system, and it sits between the impression log and billing rather than inside the auction.
• Attribution and conversion tracking, which run on an entirely different clock - days, not milliseconds.