A normal GrapheneOS installation uses Android Verified Boot with a locked bootloader, and does not give the user root access. Google's Play Integrity cannot be used to verify the integrity of the OS (as GrapheneOS is not approved by Google), but equivalent verification can be done using standard Android APIs and GrapheneOS's public keys.