[KetoManx64]

GrapheneOS strongly recommends that you do not do it, but it will not stop you if you want to. You can root and leave your bootloader unlocked or create a custom user signed image with root support included. Plenty of user written guides out there how to do so.

[easyKL]

Locking the bootloader is important as it enables full verified boot https://grapheneos.org/install/cli#locking-the-bootloader

[bri3d]

> You can root and leave your bootloader unlocked

That's Google, not GrapheneOS.

[KetoManx64]

No, you can do that on GrapheneOS as well. You just follow their install guide and skip the final step and then just flash magisk. The updates become slightly tedious, but you can if you want to.