Access you can see. Limits the system can't cross.
Autonomy is only safe when its boundaries are real. Here's exactly what GMRTS can touch, how your data is protected, and which limits are enforced in code rather than promised in a policy.
Read and write permissions, stated plainly.
You grant only the access each part of the loop needs, and you can revoke any connection at any time.
Protected in transit and at rest.
Data moving between your platforms and GMRTS is encrypted in transit. Stored data, including connection tokens, is encrypted at rest. Access tokens are held only as long as a connection is active and are cleared when you disconnect.
The limits that matter are technical, not just policy.
Spend caps are hard limits
Daily and total ceilings are enforced in code before any budget change is applied. The system cannot spend past a cap, even if a signal suggests it.
Approval modes are enforced
In approval mode, no campaign goes live and no budget moves above your threshold without explicit human sign-off. This is a technical gate, not a policy.
Every action is logged
Each automated change is written to a decision log with the signal that triggered it, so there is always an auditable trail of what happened and why.
Stated honestly: where we are today.
We describe only the controls that are in place right now, and we don't claim certifications we haven't earned. Encryption, scoped access, enforced spend caps, and a full decision log are live today. As our formal compliance program matures, this page will reflect each step as it is actually completed, not before.