Governance and delegated control

GTM Brain treats governance as executable workflow behavior. Prompts may instruct a model to be careful, but only code and durable policy can prevent an action from occurring.

Control layers

Actor-aware approval

Actions carry actorType and actorId. Agent-initiated prospect touches route to needs-approval even when confidence is high. A low-confidence verdict escalates rather than sending automatically.

External agents use the same pipeline and therefore receive no side door.

Governance by exception

An administrator may move repeated review into the background for one low-risk campaign by approving an autonomy-envelope artifact, choosing Bind autonomy envelope on the draft campaign version, and enabling Campaign autonomy under Team & agents → Advanced. A normal Confirm campaign details refresh never enables autonomy implicitly. The envelope is revision-hash pinned, independently evaluated, limited to 31 days, offer/proof/recipient scoped, and revalidated against current suppression and account history immediately before its immutable decision is committed. The explicit bind records the campaign approval policy as delegated_envelope_allowed; ordinary bindings remain human_required.

The decision commit atomically consumes the campaign-wide rolling-24-hour and one-per-account budgets. Those budgets span campaign versions and envelope revisions. Pausing the tenant switch stops new background decisions immediately; an already committed decision may only finish its exact dry-run approval checkpoint, which prevents a crash or pause between commit and resume from wedging the draft. Bound envelopes cannot be archived or have approval withdrawn. Operators retire one by pausing the tenant switch and creating a replacement campaign version without the envelope.

The default remains paused. Missing evidence, unsupported copy, an ineligible or suppressed recipient, proof or manifest drift, an expired/out-of-scope envelope, or any evaluation error leaves the draft in the human queue with a reason. This first release applies only to dry-run approval: live delivery continues to require the existing natural-person canary approval.

Suppression

Suppression protects accounts and domains that must not be contacted. Sources include:

• day-zero seeded domains such as databricks.com;
• explicit organization suppression;
• unsubscribe outcomes;
• domain-aware policy checks.

Run the seed command during environment setup:

GTM_OPERATOR_ACTOR_ID=<authenticated-operator-id> pnpm --filter @repo/gtm suppress:seed

Suppression seeding is a durable V2 Temporal command and emits the same governed audit event as CRM-driven suppression. Inbox registration is tenant control-plane configuration: it changes the sender ramp but cannot mutate an account, touch, outcome, or opportunity.

Inbox ramp and daily caps

Live delivery requires registered inboxes. The default warmup policy grows from approximately 8 messages per inbox in week one toward 30 in week four and later. No registered inbox means no live send.

Register and inspect an inbox through the operator scripts:

pnpm --filter @repo/gtm inbox:register -- sender@example.com
pnpm --filter @repo/gtm go-live-check

GTM_DAILY_SEND_CAP provides an additional organization-wide deployment ceiling. It must be a plain integer from 1 to 500; malformed or out-of-range values stop startup rather than weakening the send limit. Disable live delivery with GTM_ENABLE_V2_LIVE_DELIVERY=0, not a zero cap.

For the first governed launch, the effective ceiling is stricter: one send for one exact tenant, immutable campaign version, and manifest, with a four-hour expiry and natural-person approval. The authorization is revalidated in the workflow and at the final Platform action, and Lakebase reserves the slot transactionally. See Governed campaign launch.

Idempotency

Signals deduplicate on stable source IDs. Prospect-touching actions and vendor webhook events use stable identifiers so retries do not become duplicate messages or outcomes. Every domain mutation receives a tenant-scoped Temporal workflow ID. Idempotent activities may retry automatically; sends and other non-idempotent actions execute once and surface a durable failure for explicit operator recovery.

Audit trail

Every invocation records:

• action and parameters appropriate for audit;
• actor identity and type;
• policy outcomes;
• authorized human or delegated-agent decision where applicable;
• status, result, or error;
• correlated account, draft, workflow, and event identifiers.

The Databricks event projection publishes privacy-safe operational events to governed Delta tables for SQL, Genie, and reporting.

Tenant isolation

Every API procedure takes an organizationId, verifies membership, and scopes the store, workflow prefix, integrations, and runtime. Admin-only operations perform an additional organization-role check.

Forging another organization's workflow ID does not grant signal access: approval handlers validate the tenant prefix before sending a Temporal signal.

Governance checklist

• Organization membership and admin roles are correct.
• Suppression seed has run and opt-outs are ingesting.
• Inboxes are registered and ramp age is accurate.
• Daily caps are understood.
• Approval notifications reach the right people.
• Webhook and agent keys are organization-scoped and rotated when exposed.
• Audit projection and MLflow/OTel telemetry are healthy.

Next: Approvals, Production runbook, and Databricks features.