Browser automation on Facebook kept hitting sign-in checks on my agent box, so I switched the agent to the Graph API. The catch is that a Page token can do a lot, so I wrapped it: reads are free, but every change is written to a plan file with the current values and a short fingerprint, and the apply step only runs with the fingerprint a person approved. If the plan was edited or someone changed the Page by hand in between, it refuses. It also covers the one-time token exchange (ending in a Page token that doesn’t expire on a timer), retries on rate limits, and keeps tokens out of logs. One thing I learned: posts the Page made itself years ago can’t be deleted or hidden through the API at all. Repo: GitHub - globe-teck/fb-page-guard: Approval-gated Facebook Page client for AI agents: plan, fingerprint, human approve, then apply, with changelog and token redaction (stdlib Python). · GitHub