The team exists, but the avatars still can't reach your stores. All of that happens on one Connections page, and a connection only saves once it actually works. If it fails, it says so on the spot, instead of leaving one sitting there that looks connected and isn't.
Connecting a store is not handing it over
Once connected, an avatar can read your orders, sales, stock, ads and market data. Reading is open; writing is tiered. Changes that spend money — a price, an ad bid — it makes directly inside the range you drew. The moment one would go outside that range, it stops and asks — before acting, not after.
Connect one marketplace first, not all three
In practice, go one at a time: connect one marketplace, run it for two weeks, check whether its judgement matches yours, then add the second. The reason is practical. Connect all three at once and when a rule turns out to be badly set, you can't easily tell whether the rule is wrong or one platform reports a metric differently. One at a time, a discrepancy points straight at its cause.
Where do my store credentials live?
Authorisation credentials stay on your own Karma Box. If you're running in local-only mode, model calls stay on your device as well and never leave that machine.
Can I give it read access only, with no ability to act at all?
Yes. Set the adjustable range to zero and it reads without writing — everything that would need an action becomes a card waiting on your decision. Plenty of people run it that way for the first month.