Access and autonomy

Open Team & agents to manage the authority GTM Brain revalidates before every business mutation. This is the tenant control plane for people and agents. Workspace membership establishes identity; a GTM access profile establishes operational authority.

Safe rollout

New tenants begin in Observe mode. Profiles and policy changes are recorded while administrators prepare the access model. Observe is a bounded bootstrap and recovery state, not the normal production posture. Complete administrator profiles and select Enforce profiles before the first live campaign or autonomous agent execution.

Before selecting Enforce profiles:

1. assign the GTM Administrator role to every workspace owner and administrator;
2. review campaign scope for each person;
3. review enabled agent registrations, execution grants, and expiration;
4. test a permitted and a denied action; and
5. confirm another administrator can return the tenant to Observe mode.

Enforce mode makes the current profile authoritative inside Platform Host. A missing, suspended, expired, or insufficient profile fails closed. Returning to Observe mode is an audited recovery control; it does not delete profiles or events.

Human roles

Named roles have canonical capability sets. Saving a named role with a different capability set is rejected by the action schema.

An empty campaign scope means Tenant-wide. Selecting campaigns narrows the profile. Actions that do not resolve to an authoritative permitted campaign fail closed for a campaign-scoped profile. Suspension and expiration are checked at execution time, including delayed Temporal activities and recovery. Campaign pickers show one current active version per logical campaign. Superseded, draft, paused, retired, and system-owned campaigns stay out of ordinary human and agent delegation controls.

Agent controls

The same surface shows every tenant agent registration:

• definition and immutable version;
• status and autonomy level;
• model provider and model;
• campaign scope;
• registration-bound credential state; and
• operational webhook state.

Administrators can suspend or enable a registration, pause all tenant agent execution, and disable all external-agent access. The tenant-wide switches are rechecked at the final Host mutation boundary, so a queued activity does not retain stale authority.

A suspended registration cannot start or resume agent work and cannot use its grant to mutate GTM. The registration remains as audit evidence and, when its lifecycle permits, can be reviewed and re-enabled by an administrator. Revoked or expired enrollment records are final history; replace them through a new invite rather than reactivating the old identity. The console keeps these inactive records collapsed by default.

External credentials are bound to one registration. Only their hash is stored, and a rotated credential is shown once. Execution grants can be required to have explicit campaign scope and an expiration. A catalog response or successful HTTP admission is never permanent authority: registration status, grant, scope, budget, and tenant policy are checked again immediately before mutation.

External connection uses a separate pairing and review lifecycle. Pairing and claim tokens are hashed before the Platform boundary; the gateway key is held only in an encrypted, expiring reveal envelope. Approval provisions the same canonical tenant registration and integration-secret records used by administrator-created callers. The effective-access preview runs the final authorization evaluator with an in-memory, non-persisted preview admission. It never creates an invocation, admission, grant, or credential and cannot be used as authority.

Governed API

The console uses the same tenant-aware API available to other authorized clients:

The access mutation endpoint accepts only:

• gtm.set_human_access_profile
• gtm.set_tenant_autonomy_policy

It requires an organization administrator, verifies that a human target is a current member, derives login identities server-side, requires a caller-issued command ID, stages the immutable command, and executes it through Temporal and Fabric Platform Host. Agent registration status changes use gtm.configure_tenant_agent through that same durable path.

Audit and recovery

The Audit tab projects immutable:

• GtmHumanAccessProfileChanged
• GtmTenantAutonomyPolicyChanged
• GtmTenantAgentConfigured

events. Events retain actor, tenant, command, correlation, subject, and version evidence without storing credentials. Exact command replay converges on the original event; reusing a command ID with different parameters fails.

Access decisions are enforced in two Host authorization phases and again at resource-sensitive agent boundaries. Private staging is transport state only and cannot grant authority or change a business projection.

To create and deploy a finite external operator with the same governed experience as Hermes, follow Build a Fabric Harness agent.