Needs your MolTrust API key as the X-API-Key header of the MCP connection (free key:
    POST https://api.moltrust.ch/auth/signup). Counts against your plan like any check.
    Never send Amazon credentials: they are refused.

    Args:
        profile: the `profile` object from ads_mandate_template
        tool: the Amazon Ads MCP tool name, e.g. campaign_management-update_campaign_budget
        arguments: the tool arguments exactly as your agent would send them
        context: your view of the account — campaigns {id: {brand, daily_budget(cents)}},
                 targets {id: {brand, bid(cents)}}, ad_groups, account_daily_total(cents).
                 Values the check cannot derive count as unknown and end in forbid.