Tenant and role boundaries
Customer and platform roles are separate. Every sensitive read and write must be authorized against the active organization.
Security and operational control
Autonomy must fail closed.
TopRankPilot treats tenant boundaries, credentials, provider writes, spending authority, verification, and recovery as product behavior.
Credential protection
Provider credentials are encrypted, versioned, refreshable, revocable, and never treated as customer-visible connection flags.
Hard spending authority
Credits cannot authorize advertising money. Active envelopes and current provider state are checked before execution.
Verification and recovery
Executions require read-after-write evidence. Retry, reconciliation, pause, rollback, or compensation depends on the action and provider capability.
Your authority stays visible
Give the agent boundaries. Let it do the work.
Start setup now, or inspect the operating loop before connecting a platform.