Documentation — Spybara

administration.md +7 −0

Details

28 href: "/codex/enterprise/admin-setup",28 href: "/codex/enterprise/admin-setup",

29 icon: "users",29 icon: "users",

30 },30 },

31 {

32 title: "ChatGPT Work Overview",

33 description:

34 "Understand hosted execution, network controls, data boundaries, and audit visibility.",

35 href: "/codex/enterprise/chatgpt-work-overview",

36 icon: "shieldCheck",

37 },

31 {38 {

32 title: "ChatGPT Work admin FAQ",39 title: "ChatGPT Work admin FAQ",

33 description:40 description:

agent-approvals-security.md +40 −1

Details

48Network access is controlled through destination rules that apply to scripts,48Network access is controlled through destination rules that apply to scripts,

49programs, and subprocesses spawned by commands. When command network access is49programs, and subprocesses spawned by commands. When command network access is

50already enabled, turn on the `network_proxy` feature to constrain that traffic50already enabled, turn on the `network_proxy` feature to constrain that traffic

~~51to the network policy you configure.~~51to the network policy you configure. Adding domain rules does not enable the

52proxy by itself.

52 53

53```toml54```toml

54[features.network_proxy]55[features.network_proxy]

80- Network on + `network_proxy` on: network stays on, and outbound traffic is81- Network on + `network_proxy` on: network stays on, and outbound traffic is

81 constrained by the configured network policy.82 constrained by the configured network policy.

82 83

84The proxy feature also applies to [permission profiles](https://learn.chatgpt.com/docs/permissions#network-permissions).

85A profile's `network.enabled = true` grants command network access, while

86`features.network_proxy = true` activates enforcement of that profile's domain

87rules:

89```toml

90default_permissions = "project-edit"

92[features]

93network_proxy = true

95[permissions.project-edit]

96extends = ":workspace"

98[permissions.project-edit.network]

99enabled = true

100

101[permissions.project-edit.network.domains]

102"api.openai.com" = "allow"

103```

104

105If you omit the proxy feature in this example, commands have direct network

106access and the `api.openai.com` allow rule does not restrict their destinations.

107

83Admin-managed `experimental_network` requirements are separate from the user108Admin-managed `experimental_network` requirements are separate from the user

84feature toggle. They can configure and start sandboxed networking without109feature toggle. They can configure and start sandboxed networking without

85`features.network_proxy`, but they do not turn on network access when the active110`features.network_proxy`, but they do not turn on network access when the active

152 177

178### Traffic outside the command network proxy

179

180The network proxy filters scripts, programs, and child processes that run

181inside the local command sandbox. It does not filter web search, app or

182connector tool calls, MCP server connections, browser or Computer Use activity,

183Codex cloud tasks, or the client's model and authentication requests. These

184surfaces use separate service connections, feature settings, workspace

185policies, or environment controls.

186

187For managed users, combine command network policy with controls such as

188`allowed_web_search_modes`, approved `mcp_servers`, and feature requirements

189for apps, plugins, browsers, or Computer Use. See

190[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration).

191

153You can also control the [web search tool](https://platform.openai.com/docs/guides/tools-web-search) without granting full network access to spawned commands. Codex defaults to using a web search cache to access results. The cache is an OpenAI-maintained index of web results, so cached mode returns pre-indexed results instead of fetching live pages. This reduces exposure to prompt injection from arbitrary live content, but you should still treat web results as untrusted. If you are using `--yolo` or another [full access sandbox setting](#common-sandbox-and-approval-combinations), web search defaults to live results. Use `--search` or set `web_search = "live"` to allow live browsing, or set it to `"disabled"` to turn the tool off:192You can also control the [web search tool](https://platform.openai.com/docs/guides/tools-web-search) without granting full network access to spawned commands. Codex defaults to using a web search cache to access results. The cache is an OpenAI-maintained index of web results, so cached mode returns pre-indexed results instead of fetching live pages. This reduces exposure to prompt injection from arbitrary live content, but you should still treat web results as untrusted. If you are using `--yolo` or another [full access sandbox setting](#common-sandbox-and-approval-combinations), web search defaults to live results. Use `--search` or set `web_search = "live"` to allow live browsing, or set it to `"disabled"` to turn the tool off:

154 193

155```toml194```toml

config-file/config-reference.md +9 −8

Details

361 key: "features.apps",361 key: "features.apps",

362 type: "boolean",362 type: "boolean",

363 description:363 description:

364 "Enable app (connector) integrations (stable; on by default).",364 "Enable app (connector) integrations (stable; on by default). App and connector traffic is not controlled by the sandboxed-command network proxy or its domain allowlist.",

365 },365 },

366 {366 {

367 key: "features.hooks",367 key: "features.hooks",

738 key: "features.network_proxy",738 key: "features.network_proxy",

739 type: "boolean | table",739 type: "boolean | table",

740 description:740 description:

741 "Enable sandboxed networking. Use a table form when setting network policy options such as `domains` (experimental; off by default).",741 "Start the network proxy for sandboxed commands (experimental; off by default). Required to enforce permission-profile domain rules unless enabled administrator-managed `experimental_network` requirements start the proxy. Use a table when setting feature-level policy options such as `domains`. Does not filter web search, apps, MCP, or other hosted tools.",

742 },742 },

743 {743 {

744 key: "features.network_proxy.enabled",744 key: "features.network_proxy.enabled",

745 type: "boolean",745 type: "boolean",

746 description: "Enable sandboxed networking. Defaults to `false`.",746 description:

747 "Start the sandboxed-command network proxy when command network access is enabled. Defaults to `false`; permission-profile domain rules are not enforced while the proxy is off.",

747 },748 },

748 {749 {

749 key: "features.network_proxy.domains",750 key: "features.network_proxy.domains",

1424 key: "tools.web_search",1425 key: "tools.web_search",

1425 type: 'boolean | { context_size = "low|medium|high", allowed_domains = [string], location = { country, region, city, timezone } }',1426 type: 'boolean | { context_size = "low|medium|high", allowed_domains = [string], location = { country, region, city, timezone } }',

1426 description:1427 description:

1427 "Optional web search tool configuration. The legacy boolean form is still accepted, but the object form lets you set search context size, allowed domains, and approximate user location.",1428 "Optional web search tool configuration. The object form can set search context size, allowed search domains, and approximate user location. These search-domain filters are separate from sandboxed-command network domain rules and do not restrict connectors or MCP servers.",

1428 },1429 },

1429 {1430 {

1430 key: "tools.view_image",1431 key: "tools.view_image",

1495 key: "permissions.<name>.network.enabled",1496 key: "permissions.<name>.network.enabled",

1496 type: "boolean",1497 type: "boolean",

1497 description:1498 description:

1498 "Enable network access for this named permissions profile. This changes the sandbox network policy; it does not start the network proxy by itself.",1499 "Enable network access for commands in this permission profile. This does not start the network proxy. Without `features.network_proxy` or enabled administrator-managed networking requirements, command network access is direct and profile domain rules are not enforced.",

1499 },1500 },

1500 {1501 {

1501 key: "permissions.<name>.network.proxy_url",1502 key: "permissions.<name>.network.proxy_url",

1546 key: "permissions.<name>.network.domains",1547 key: "permissions.<name>.network.domains",

1547 type: "table",1548 type: "table",

1548 description:1549 description:

1549 "Domain rules for sandboxed networking. Supports exact hosts, `*.example.com` for subdomains only, `**.example.com` for apex plus subdomains, and global `*` allow rules. `deny` wins on conflicts.",1550 "Domain rules for sandboxed commands. Enforced only when `features.network_proxy` or enabled administrator-managed networking requirements activate the proxy. Supports exact hosts, `*.example.com`, `**.example.com`, and global `*` allow rules; `deny` wins. Does not restrict web search, apps, or MCP servers.",

1550 },1551 },

1551 {1552 {

1552 key: "permissions.<name>.network.domains.<pattern>",1553 key: "permissions.<name>.network.domains.<pattern>",

1965 key: "experimental_network",1966 key: "experimental_network",

1966 type: "table",1967 type: "table",

1967 description:1968 description:

1968 "Network access requirements enforced from `requirements.toml`. These constraints are separate from `features.network_proxy` and can configure sandboxed networking without the user feature flag.",1969 "Administrator-managed network requirements for sandboxed local commands, enforced from `requirements.toml`. When enabled, these requirements can start the command network proxy without `features.network_proxy`. They do not control web search, apps, MCP servers, browsers, or Codex cloud networking.",

1969 },1970 },

1970 {1971 {

1971 key: "experimental_network.enabled",1972 key: "experimental_network.enabled",

2013 key: "experimental_network.allowed_domains",2014 key: "experimental_network.allowed_domains",

2014 type: "array<string>",2015 type: "array<string>",

2015 description:2016 description:

2016 "List-shaped administrator allow rules for sandboxed networking. Do not combine this with `experimental_network.domains`.",2017 "Administrator allow rules for sandboxed-command networking while the managed network proxy is enabled. These rules do not apply to web search, apps, or MCP servers. Do not combine this with `experimental_network.domains`.",

2017 },2018 },

2018 {2019 {

2019 key: "experimental_network.denied_domains",2020 key: "experimental_network.denied_domains",

config-reference.md +9 −8

Details

361 key: "features.apps",361 key: "features.apps",

362 type: "boolean",362 type: "boolean",

363 description:363 description:

365 },365 },

366 {366 {

367 key: "features.hooks",367 key: "features.hooks",

738 key: "features.network_proxy",738 key: "features.network_proxy",

739 type: "boolean | table",739 type: "boolean | table",

740 description:740 description:

742 },742 },

743 {743 {

744 key: "features.network_proxy.enabled",744 key: "features.network_proxy.enabled",

745 type: "boolean",745 type: "boolean",

746 description: "Enable sandboxed networking. Defaults to `false`.",746 description:

747 "Start the sandboxed-command network proxy when command network access is enabled. Defaults to `false`; permission-profile domain rules are not enforced while the proxy is off.",

747 },748 },

748 {749 {

749 key: "features.network_proxy.domains",750 key: "features.network_proxy.domains",

1424 key: "tools.web_search",1425 key: "tools.web_search",

1426 description:1427 description:

1428 },1429 },

1429 {1430 {

1430 key: "tools.view_image",1431 key: "tools.view_image",

1495 key: "permissions.<name>.network.enabled",1496 key: "permissions.<name>.network.enabled",

1496 type: "boolean",1497 type: "boolean",

1497 description:1498 description:

1499 },1500 },

1500 {1501 {

1501 key: "permissions.<name>.network.proxy_url",1502 key: "permissions.<name>.network.proxy_url",

1546 key: "permissions.<name>.network.domains",1547 key: "permissions.<name>.network.domains",

1547 type: "table",1548 type: "table",

1548 description:1549 description:

1550 },1551 },

1551 {1552 {

1552 key: "permissions.<name>.network.domains.<pattern>",1553 key: "permissions.<name>.network.domains.<pattern>",

1965 key: "experimental_network",1966 key: "experimental_network",

1966 type: "table",1967 type: "table",

1967 description:1968 description:

1969 },1970 },

1970 {1971 {

1971 key: "experimental_network.enabled",1972 key: "experimental_network.enabled",

2013 key: "experimental_network.allowed_domains",2014 key: "experimental_network.allowed_domains",

2014 type: "array<string>",2015 type: "array<string>",

2015 description:2016 description:

2017 },2018 },

2018 {2019 {

2019 key: "experimental_network.denied_domains",2020 key: "experimental_network.denied_domains",

config-sample.md +7 −1

Details

441 441

442# Enable the feature before configuring sandboxed networking rules.442# Enable the feature before configuring sandboxed networking rules.

443 443

444# A profile's network.enabled allows direct network access; its domain rules

445

446# apply only when the network proxy feature is enabled.

447

448# Web search, apps, connectors, and MCP servers use separate controls.

449

444# [features.network_proxy]450# [features.network_proxy]

445 451

446# enabled = true452# enabled = true

689 695

690# personality = true696# personality = true

691 697

692# network_proxy = false698# network_proxy = true # required to enforce permission-profile domain rules

693 699

694# fast_mode = true700# fast_mode = true

695 701

cyber-safety/recommended-configuration.md +9 −0

Details

44approvals_reviewer = "auto_review"44approvals_reviewer = "auto_review"

45default_permissions = "cyber-lab"45default_permissions = "cyber-lab"

46 46

47[features]

48network_proxy = true

47[permissions.cyber-lab]50[permissions.cyber-lab]

48description = "Limit security testing to the approved lab and workspace."51description = "Limit security testing to the approved lab and workspace."

49extends = ":workspace"52extends = ":workspace"

64"lab.example.com" = "allow"67"lab.example.com" = "allow"

65```68```

66 69

70The `network_proxy` feature enforces the approved domain. Without it,

71`network.enabled = true` permits direct network access and the lab allowlist

72does not restrict destinations. Web search, apps, connectors, MCP servers,

73browser activity, and Codex cloud use separate controls; restrict or turn off

74each surface that your approved workflow does not require.

67Replace `lab.example.com` with an approved target. The bounded filesystem scan is designed to avoid searching the entire workspace on Linux, WSL, and Windows; increase the depth or use exact deny paths if sensitive files appear deeper. Don't combine permission profiles with legacy `sandbox_mode` settings; follow the [permission-profile configuration guidance](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).76Replace `lab.example.com` with an approved target. The bounded filesystem scan is designed to avoid searching the entire workspace on Linux, WSL, and Windows; increase the depth or use exact deny paths if sensitive files appear deeper. Don't combine permission profiles with legacy `sandbox_mode` settings; follow the [permission-profile configuration guidance](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).

68 77

69If the approved lab host resolves to a private address, Codex blocks it by default even when the host is on the allowlist. Set `allow_local_binding = true` only for explicitly approved private-network work, keep the destination allowlist narrow, and review the [local and private network guidance](https://learn.chatgpt.com/docs/permissions#local-and-private-networks). You can also allowlist the exact approved private IP address.78If the approved lab host resolves to a private address, Codex blocks it by default even when the host is on the allowlist. Set `allow_local_binding = true` only for explicitly approved private-network work, keep the destination allowlist narrow, and review the [local and private network guidance](https://learn.chatgpt.com/docs/permissions#local-and-private-networks). You can also allowlist the exact approved private IP address.

enterprise/apps-and-connectors.md +77 −54

Details

2 2

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4

~~5A plugin extends ChatGPT and Codex by packaging skills and optional connectors~~5Plugins package reusable workflows and can include skills and apps that connect

~~6so teams can distribute workflows and knowledge. The products share one~~6to other tools. ChatGPT and Codex use the same public plugin directory on

~~7universal plugin directory, while admins control availability and installation~~7supported surfaces, while admins decide which plugins are available in their workspace.

~~8for their workspace. Learn more about [plugins](https://learn.chatgpt.com/docs/plugins),~~8Learn more about [plugins](https://learn.chatgpt.com/docs/plugins),

9[skills](https://learn.chatgpt.com/docs/skills-and-plugins), and9[skills](https://learn.chatgpt.com/docs/skills-and-plugins), and

10[apps and connectors](https://help.openai.com/en/articles/11487775).10[apps and connectors](https://help.openai.com/en/articles/11487775).

11 11

~~12When a plugin includes a connector, workspace admins must make the plugin~~12A member can use a connector-backed capability only when the plugin and app are

~~13available through plugin controls and configure connector access before members~~13available to their role and they have access to the connected service.

~~14can use the connector-backed capability.~~

15 14

16Plugins work in Chat and Work across ChatGPT on the web, desktop, and mobile,15Plugins work in Chat and Work across ChatGPT on the web, desktop, and mobile,

17in Codex in the ChatGPT desktop app, and through the Codex CLI plugin browser.16in Codex in the ChatGPT desktop app, and through the Codex CLI plugin browser.

18They aren't available in the IDE extension.17They aren't available in the IDE extension.

19 18

~~20For the complete administration model, see~~19To see how these controls fit with workspace roles and permissions, see

21[Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).20[Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).

22 21

23## Understand the capability chain22## Understand the capability chain

24 23

~~25Each layer has a separate scope and control surface:~~24A plugin can span these control layers:

26 25

28| ------------------------------------ | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |27| ----------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |

29| Plugin availability and installation | Whether the plugin bundle is available to the user | [Workspace settings](https://chatgpt.com/admin/settings) for supported web and desktop surfaces; the CLI plugin browser for CLI |28| Availability | Whether the plugin bundle is available to the user | [Workspace settings](https://chatgpt.com/admin/settings) for supported web and desktop surfaces; the CLI plugin browser for CLI |

32| Connector actions and permissions | Which actions users can run and when ChatGPT asks before using the connector | The connector's Action control and App permissions in [Workspace apps](https://chatgpt.com/admin/ca) |31| Actions and permissions | Which actions users can run and when ChatGPT asks before using the connector | The connector's Action control and App permissions in [Workspace apps](https://chatgpt.com/admin/ca) |

35 34

~~36Depending on the workflow, admins can govern plugin availability, connector~~35Use these layers as a two-step rollout: first make the right plugins available,

~~37access, connector actions and permissions, provider authorization, and runtime~~36then configure the capabilities and permissions each workflow needs.

~~38policy independently.~~

39 37

~~40## Plugin availability controls~~38## Step 1: Enable plugin availability

41 39

~~42Workspace plugin controls determine whether a plugin is available or installed~~40For supported web and desktop surfaces, workspace plugin controls determine

~~43for supported workspace roles. The Codex CLI plugin browser controls CLI~~41which roles can use or install a plugin. The Codex CLI uses its own plugin

~~44installation through its own path. See [Build plugins](https://developers.openai.com/plugins/build/plugins) for~~42browser for installation. See

43[Build plugins](https://developers.openai.com/plugins/build/plugins) for

45packaging and distribution.44packaging and distribution.

46 45

~~47## Connector-backed capability controls~~46## Step 2: Manage capabilities

48<WarningTip>

49 Making an app or plugin available in ChatGPT doesn't grant access to files,

50 records, or actions in the connected service. Before troubleshooting or

51 expanding access, check the member's workspace role and approved action

52 settings. Then confirm the authenticated account or shared connection has the

53 expected permissions in the connected service.

54</WarningTip>

48 55

49Plugins in ChatGPT and Codex can include connectors that search, retrieve, sync,56Plugins in ChatGPT and Codex can include connectors that search, retrieve, sync,

~~50or act on external systems. Workspace admins configure plugin availability~~57or act on external systems. Plugin availability and the access and actions

~~51separately from the access and actions granted to each connector.~~58granted to each connector are separate controls.

52 59

53Manage connector-backed capabilities from60Manage connector-backed capabilities from

54[Workspace apps](https://chatgpt.com/admin/ca) and61[Workspace apps](https://chatgpt.com/admin/ca) and

55[Permissions & roles](https://chatgpt.com/admin/settings). Available controls62[Permissions & roles](https://chatgpt.com/admin/settings). Available controls

56let admins:63let admins:

57 64

~~58- Enable reviewed connectors and assign access by workspace role.~~65- Enable apps or connectors and assign access by workspace role.

59- For connectors that support Action control, allow read-only actions or an66- For connectors that support Action control, allow read-only actions or an

60 approved custom set, including how the workspace handles newly added actions.67 approved custom set, including how the workspace handles newly added actions.

~~61- Set App permissions that determine when ChatGPT asks before using a connector.~~68- Set App permissions that determine when ChatGPT asks before using an app.

62- Keep access within the scopes and permissions granted by each connected69- Keep access within the scopes and permissions granted by each connected

63 service and authenticated user.70 service and authenticated user.

64 71

67 74

68<a id="choose-a-starting-set-of-apps"></a>75<a id="choose-a-starting-set-of-apps"></a>

69 76

~~70## Choose a starting set of plugins~~77## Choose a focused initial set

79Start with plugins that support a clear business need. Decide whether to make

80each plugin available to everyone, limit it to a role or pilot group, or require

81further review.

83For each connected service, record the business owner, permitted data, approved

84read or write actions, authentication method, and a support or removal contact.

71 85

~~72For a broad initial rollout, consider plugin categories teams use every day:~~86Before enabling write actions or publishing a new connected capability, verify

~~73email, calendar, and file or document systems such as Google Drive or Notion.~~87its role scope and test with an account that has only the intended permissions

~~74Use the [Plugins Directory](https://chatgpt.com/apps) to confirm current~~88in the connected service.

~~75availability and capabilities across supported ChatGPT and Codex surfaces.~~

76 89

~~77Start with read actions. Enable write actions only after reviewing the plugin's~~90For a broad rollout, begin with categories teams use every day, such as email,

~~78owner, each connector's requested scopes, data access, external effects, and~~91calendar, and file or document systems. Use the

~~79recovery path.~~92[Plugins Directory](https://chatgpt.com/apps) to confirm current availability

93and capabilities across supported ChatGPT and Codex surfaces.

95Whatever the initial set, start with read actions. Before enabling write

96actions, identify the plugin owner, review connector scopes and service

97permissions, confirm data access, and document external effects and a recovery

98path.

80 99

81## Understand data flow and security100## Understand data flow and security

82 101

~~83When ChatGPT uses a connector-backed plugin, the connector sends a request to~~102When ChatGPT uses an app or connector included with a plugin, it sends a request

~~84the connected service and returns data or action results allowed by the~~103to the connected service and returns data or action results allowed by the

~~85authenticated user's provider permissions. Custom MCP servers expose these~~104authenticated user's permissions in that service.

~~86operations as tools through Model Context Protocol (MCP).~~105

106ChatGPT handles connected app data in two ways:

107

108- **Non-synced:** ChatGPT processes data from Chat and deep research transiently

109 and doesn't index it.

110- **Synced:** ChatGPT indexes selected connected content in advance. You can see

111 whether an app supports sync on its plugin page.

87 112

~~88For non-synced connector use, ChatGPT processes data from Chat and deep~~113The mode changes how ChatGPT indexes connected content; it doesn't replace

~~89research transiently and doesn't index it. Connectors with sync index selected~~114normal chat-retention controls. ChatGPT conversations that use apps remain

~~90connected content in advance. This indexing distinction doesn't replace normal~~115available through the Compliance API.

~~91chat-retention controls; chats that use plugins remain available through the~~

~~92Compliance API.~~

93 116

~~94OpenAI's current connector guidance also documents encryption in transit and at~~117OpenAI's app guidance documents encryption in transit and at rest, per-user

~~95rest, per-user authorization, role and action controls, restricted network~~118authorization, role and action controls, restricted network access for

~~96access for chats that use plugins, and no model training on information accessed~~119conversations that use apps, and no model training on information accessed

~~97through plugins for Business, Enterprise, and Edu customers. Review the~~120through apps for Business, Enterprise, and Edu customers. When a request reaches

~~98connected service's scopes, retention, and data-residency policies because those~~121a connected service, that service's scopes, retention, data residency, and other

~~99policies apply when a request reaches that service.~~122policies also apply.

100 123

101See [app security and compliance](https://help.openai.com/en/articles/11509118)124See [app security and compliance](https://help.openai.com/en/articles/11509118)

102and [apps with sync](https://help.openai.com/en/articles/10847137) for the125and [apps with sync](https://help.openai.com/en/articles/10847137) for current

103current data-handling details. For locally configured MCP servers in the126data-handling details. For locally configured MCP servers in the ChatGPT desktop

104ChatGPT desktop app, Codex CLI, or IDE extension, see127app, Codex CLI, or IDE extension, see

105[Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp).128[Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp).

106 129

107## Use current procedures130## Use current procedures and references

108 131

109- [Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118)132- [Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118)

110- [Apps in ChatGPT](https://help.openai.com/en/articles/11487775)133- [Apps in ChatGPT](https://help.openai.com/en/articles/11487775)

enterprise/chatgpt-work-overview.md +194 −0 created

Details

1# ChatGPT Work Overview

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

5ChatGPT Work and Codex share core execution, isolation, and permission

6mechanisms, and fall within the same security boundaries that are part of your

7ChatGPT Business or Enterprise agreement. The capabilities and controls

8available to each experience depend on whether a task runs locally or in the

9cloud, its available tools, and applicable workspace policies.

11ChatGPT Work can complete multi-step tasks using the information, files,

12applications, and tools available to an authorized workspace member. On the web,

13those tasks run in the cloud, not on the member's device.

15This overview explains the execution boundary, network and application controls,

16data handling, and how tasks are executed securely using ChatGPT Work on the

17web. Availability and administrative controls depend on your plan and workspace

18configuration.

20## Execution isolation, files, and device access

22The files and tools available to ChatGPT Work depend on where Work is running,

23user permissions and admin configuration.

25**Local Work** runs tasks through the ChatGPT desktop app on the user's device.

26It can access local files, applications, and other resources made available to

27it, subject to the user's permissions, applicable workspace controls, and device

28security policies. Unlike Work on the Web, local Work can operate on resources

29that remain on your computer without requiring you to upload files to a cloud

30conversation.

32**Cloud Work**, accessed via the web or mobile, runs the Codex harness in an

33isolated environment on OpenAI-managed infrastructure. Cloud conversations can

34be available across supported web, mobile, and desktop surfaces, and supported

35tasks can continue while the user is away from the conversation.

37Work on the web can't directly access files, applications, or open browser tabs

38on the user's computer. A user can provide files by uploading them, adding them

39to a supported project, or using an authorized connected app. The desktop

40experience controls local file and application access through its own

41permissions.

43When

44[Library](https://help.openai.com/en/articles/20001052-file-storage-and-library-in-chatgpt)

45is available, eligible uploaded or generated files can be saved there.

46Administrators can control whether ChatGPT automatically references saved

47Library files. Disabling automatic references does not prevent users from

48explicitly accessing or attaching files they are authorized to use.

50See [Code and shell sandboxing](https://learn.chatgpt.com/docs/sandboxing?surface=web),

51[Creating and editing documents, spreadsheets, and presentations](https://help.openai.com/en/articles/20001278-creating-and-editing-documents-spreadsheets-and-presentations-with-chatgpt-work),

52and

53[File storage and Library in ChatGPT](https://help.openai.com/en/articles/20001052-library-for-chatgpt).

55## Network access and external destinations

57Work uses tools like code/shell execution and the cloud browser to complete

58tasks. Each of these tools has configurable permissions.

60- **Code and shell commands**: Public internet access depends on the applicable

61 workspace policy and individual Work network setting. When public internet

62 access isn't allowed, commands can still reach required destinations on a

63 managed allowlist.

64- **Web search**: Search has controls separate from the Work code and shell

65 network setting.

67When available, the individual code and shell setting appears under

68**Settings** > **Data controls** > **Work network access**. Turning on **Allow

69public internet access** doesn't override an applicable administrator

70restriction. Turning it off limits code and shell commands to required

71destinations on the managed allowlist; it doesn't disable connected apps, web

72search, or the cloud browser.

74Changes to the code and shell network setting take effect after the current run

75finishes and Work refreshes its execution environment. See

76[Code and shell sandboxing](https://learn.chatgpt.com/docs/sandboxing?surface=web) and

77[Work access controls](https://help.openai.com/en/articles/20001275-chatgpt-work-and-codex).

79Outgoing interaction controls are separate from

80[workspace IP access restrictions](https://help.openai.com/en/articles/12111596-ip-allowlisting-for-chatgpt),

81which limit incoming access to the ChatGPT workspace or Compliance API.

83## Cloud browser and website access

85The

86[Cloud Browser](https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt)

87is one of the tools ChatGPT Work can use and is distinct from the

88[In-app Browser](https://help.openai.com/en/articles/20001277-using-the-built-in-browser-in-the-chatgpt-desktop-app).

89It operates remotely and uses a browser session separate from the user's local

90browser. It can't access local tabs, extensions, browsing history, saved

91passwords, or authenticated local sessions.

93The cloud browser supports public, signed-out websites. It can navigate pages,

94enter information into supported public forms, and combine relevant information

95from an approved app with a website task. It can't accept credentials, use a

96password manager or saved form entries, sign in to a website, or complete

97payments. If a task requires one of those unsupported steps, it stops. Browser

98availability depends on your plan, region, rollout, and workspace permissions.

99For Enterprise workspaces, an administrator must enable cloud browser access in

100addition to Work access.

101

102Website access and actions have separate controls:

103

104- By default, ChatGPT asks before visiting a new website. Where available, users

105 can select **Always ask**, **Auto approve**, or **Always allow**, and allow or

106 block individual websites. **Auto approve** applies automated risk checks.

107 **Always allow** removes the interactive website-access review. Administrators

108 have the same ability to limit approval settings for users (for example,

109 disable **Always allow** workspace-wide).

110- Allowing a website doesn't approve every action on that site. ChatGPT can

111 request a separate confirmation before actions that could create a financial,

112 legal, account, or other consequential commitment.

113

114Users can inspect available page screenshots and browser replay in a Work

115conversation. These user-visible records don't establish Compliance API export

116or a complete administrator-visible execution history.

117

118See

119[Using cloud browser in ChatGPT](https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt)

120and [Browser](https://learn.chatgpt.com/docs/browser?surface=web).

121

122## Connected applications, credentials, and permissions

123

124A connected app or Plugin gives Work access only through the integration your

125workspace allows and the permissions granted for that connection. Admins can

126control Plugin and app availability, workspace role access, external

127authorization, action settings, and source-system permissions within the admin

128dashboard.

129

130For Enterprise and Edu workspaces, plugins and their underlying apps are off by

131default. For Business workspaces, plugins and apps are on by default. Making a

132plugin available doesn't automatically enable its required app or grant access

133to a user's account. The user must enable the plugin and authenticate before

134ChatGPT Work can access it.

135

136Where supported, administrators can restrict an app to read-only actions or an

137approved set of actions. App permission settings can also determine whether

138ChatGPT asks before using an app, making changes, or performing important

139actions. Not every app supports the same action controls, and not every action

140requires an individual human confirmation.

141

142For synced apps, changes to source content or permissions can take time to

143appear. Disconnecting an app doesn't automatically remove information already

144saved in a conversation, generated file, or record with its own retention

145policy.

146

147See

148[Admin controls, security, and compliance for plugins and apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business),

149[Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors),

150[Google Workspace administrator-managed setup](https://help.openai.com/en/articles/10929079-google-workspace-admin-managed-setup),

151[ChatGPT apps with sync](https://help.openai.com/en/articles/10847137-chatgpt-apps-with-sync).

152

153## Privacy and data handling

154

155ChatGPT Work follows the privacy, security, and data-handling policies

156applicable to your ChatGPT workspace. Conversations, uploaded files, generated

157files, connected applications, and browser data can have different retention and

158deletion rules.

159

160For details, see [Enterprise privacy](https://openai.com/enterprise-privacy/),

161[Chat and file retention policies](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt),

162[Data residency and inference residency](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt),

163and the [ChatGPT Work Admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq).

164

165### Retention depends on the data type

166

167- **Work conversations**—Follow the applicable ChatGPT workspace conversation

168 retention and deletion settings.

169- **Files saved to Library**—Follow the applicable file and workspace

170 retention rules. Deleting a conversation doesn't delete files stored in

171 Library.

172- **Project files**—Remain with the project until its deletion, subject to the

173 applicable deletion rules and exceptions.

174- **Transient uploads outside Library**—For Enterprise, transient uploads can

175 expire after 48 hours unless a different retention setting applies.

176- **Saved memories, when enabled**—Follow separate memory controls.

177- **Cloud browser cookies**—Remain separate from local browser data. Users can

178 clear them from the Cloud browser settings.

179- **Compliance Logs Platform records**—Remain available in the platform for 30

180 days. Exported copies follow the receiving system's retention policy.

181- **Connected application data**—Source records follow the connected

182 application's policies. Copies saved in a chat, file, or synced index also

183 follow the applicable OpenAI storage and retention rules.

184

185Deleting a conversation, ending a Work task, clearing browser cookies, and

186retaining compliance records are different operations. Deleting a chat removes

187it from view and schedules permanent deletion within 30 days, subject to the

188published security, legal, and de-identification exceptions.

189

190See

191[Chat and file retention policies](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt),

192[Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt-faq),

193and the

194[OpenAI Compliance Platform](https://help.openai.com/en/articles/9261474-compliance-api-for-chatgpt-enterprise-edu-and-chatgpt-for-teachers).

enterprise/managed-configuration.md +19 −1

Details

302define network access requirements centrally. These requirements are separate302define network access requirements centrally. These requirements are separate

303from the user `features.network_proxy` toggle: they can configure sandbox303from the user `features.network_proxy` toggle: they can configure sandbox

304networking without that feature flag, but they don't grant command network304networking without that feature flag, but they don't grant command network

305access when the active sandbox keeps networking off.305access when the active sandbox keeps networking off. Set

306`experimental_network.enabled = true` to activate the managed proxy; an

307allowlist alone does not make the proxy active.

306 308

307```toml309```toml

308experimental_network.enabled = true310experimental_network.enabled = true

325and DNS rebinding limitations are the same as the sandbox networking behavior327and DNS rebinding limitations are the same as the sandbox networking behavior

326described in [Agent approvals & security](https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation).328described in [Agent approvals & security](https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation).

327 329

330These requirements apply only to local commands that run inside the sandbox.

331They do not route or filter web search, apps and connectors, MCP servers,

332browser or Computer Use activity, Codex service requests, or Codex cloud

333traffic. Use the controls for each surface:

334

335- Use `allowed_web_search_modes` to restrict web search.

336- Use `features.apps = false` to disable app and connector integrations, and

337 `features.plugins = false` to disable plugins where supported.

338- Use the managed `mcp_servers` approved list to restrict MCP servers.

339- Use feature requirements such as `browser_use`, `in_app_browser`, and

340 `computer_use` to restrict browser and computer-use capabilities.

341- Configure Codex cloud network access in its cloud environment settings.

342

343A command domain allowlist does not replace these capability-specific

344controls.

345

328### Pin feature flags346### Pin feature flags

329 347

330You can also pin [feature flags](https://learn.chatgpt.com/docs/config-file/config-basic#feature-flags) for users348You can also pin [feature flags](https://learn.chatgpt.com/docs/config-file/config-basic#feature-flags) for users

enterprise/work-admin-faq.md +131 −103

Details

14information from connected sources, reason across steps, create documents,14information from connected sources, reason across steps, create documents,

15presentations, or analyses, and return results for review.15presentations, or analyses, and return results for review.

16 16

~~17ChatGPT Work launched July 9, 2026. For Enterprise and Edu, web and mobile access is~~17ChatGPT Work is available on supported web, mobile, and desktop surfaces for

~~18off by default during a two-week preview. Admins can enable billable usage, and~~18eligible plans and workspaces. Where supported, workspace owners or authorized

~~19explicit opt-outs persist when the default changes. Desktop access remains~~19admins can manage Work Cloud, Work Local, and Codex Local through distinct

~~20governed separately through Codex Local permissions and managed configuration.~~20permissions. For eligible Enterprise and Edu workspaces, the default workspace

21role includes Work unless an authorized administrator turns it off. Browser and

22network controls further restrict Work Cloud, and availability depends on role,

23plan, workspace, and region. See

24[ChatGPT Work and Codex](https://help.openai.com/en/articles/20001275-chatgpt-work-and-codex).

21 25

22This FAQ explains how admins manage ChatGPT Work: access and data controls,26This FAQ explains how admins manage ChatGPT Work: access and data controls,

23compliance and visibility, usage and spend, incident response, and rollout27compliance and visibility, usage and spend, incident response, and rollout

~~24practices.~~28practices. For the hosted execution model and security boundaries, see

29[ChatGPT Work Overview](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-overview).

25 30

26## Core administrative controls31## Core administrative controls

27 32

~~28Administrators govern ChatGPT Work through several control layers:~~33Administrators govern ChatGPT Work through these control layers:

29 34

30- **Access to the enterprise workspace:** Identity and access controls manage35- **Access to the enterprise workspace:** Identity and access controls manage

31 authentication and access to the workspace. Depending on the plan and36 authentication and access to the workspace. Depending on the plan and

32 configuration, administrator-controlled identity features can include SSO,37 configuration, administrator-controlled identity features can include SSO,

33 domain verification, SCIM provisioning, user lifecycle management, and38 domain verification, SCIM provisioning, user lifecycle management, and

~~34 identity-group synchronization. Users can enable account-level OpenAI MFA;~~39 identity-group synchronization. SCIM and synchronized identity groups aren't

~~35 enforce workspace-wide MFA through your identity provider. Manage SSO and~~40 included with ChatGPT Business. Users can enable account-level OpenAI MFA.

~~36 related identity settings in the~~41 ChatGPT doesn't provide workspace-wide MFA enforcement; organizations that

42 require it should enforce SSO and MFA through their identity provider. Manage

43 SSO and related identity settings in the

37 [Global Admin Console](https://help.openai.com/en/articles/12289294-admin-portal).44 [Global Admin Console](https://help.openai.com/en/articles/12289294-admin-portal).

~~38- **Access to ChatGPT Work within the workspace:** On web and mobile, admins use the~~45 See [Multi-factor authentication](https://help.openai.com/en/articles/7967234-enabling-or-disabling-multi-factor-authentication-mfa).

~~39 ChatGPT Work access control and role-based access control (RBAC) to decide who can~~46- **Access to ChatGPT Work within the workspace:** Where available, Work Cloud

~~40 use it. Enterprise and Edu access is off during the two-week preview;~~47 governs hosted Work across supported web, mobile, and desktop surfaces. Work

~~41 admins can enable it, and explicit opt-outs persist when the default changes.~~48 Local governs local desktop Work, while Codex Local controls supported local

~~42 Desktop access follows separate Codex Local permissions and~~49 Codex access in desktop, CLI, and IDE clients. Cloud browser and network

~~43 [managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration). Controls~~50 settings further restrict Work Cloud. Custom role-based access control (RBAC)

~~44 vary by plan and surface.~~51 and available permissions depend on the plan and workspace.

~~45- **Group membership:** Groups can be synchronized through SCIM and an identity~~52- **Group membership:** On plans that support SCIM, synchronize groups through

~~46 provider so access updates automatically as employees join the organization,~~53 an identity provider so access updates as employees join the organization,

47 change roles, or leave. See54 change roles, or leave. See

48 [Groups and provisioning](https://learn.chatgpt.com/docs/enterprise/groups-and-provisioning).55 [Groups and provisioning](https://learn.chatgpt.com/docs/enterprise/groups-and-provisioning).

~~49- **Workspace and member roles:** Built-in Owner, Admin, and Member roles~~56- **Workspace and member roles:** Built-in Enterprise roles include Owner,

~~50 determine who can administer the workspace. Custom roles and member RBAC~~57 Admin, Member, and Analytics Viewer. On supported plans, custom roles and

~~51 separately control end-user access to ChatGPT Work, plugins, and other capabilities.~~58 member RBAC control access to ChatGPT Work, plugins, and other capabilities.

~~52 See~~59 Where seat types apply, members also need a seat that includes ChatGPT; a

60 Codex-only seat doesn't grant access to Work. See

53 [Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).61 [Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).

~~54- **Plugins and connectors:** Plugin policy governs plugin availability and~~62- **Plugins and apps:** Plugin policy governs plugin availability and

~~55 installation. Connector access, action controls, and approval behavior are~~63 installation. App access, action controls, and approval behavior are

~~56 configured separately, and Workspace Agents have additional per-agent~~64 configured separately. Workspace Agents have their own controls where

~~57 controls. See [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors),~~65 available. See [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors),

58 [Plugins](https://learn.chatgpt.com/docs/plugins), and the66 [Plugins](https://learn.chatgpt.com/docs/plugins), and the

59 [App security white paper](https://cdn.openai.com/business-guides-and-resources/app-security-whitepaper.pdf).67 [App security white paper](https://cdn.openai.com/business-guides-and-resources/app-security-whitepaper.pdf).

60- **Source-system permissions:** A user can access only the content and actions68- **Source-system permissions:** A user can access only the content and actions

61 allowed by the account or shared connection in the native application. See69 allowed by the account or shared connection in the native application. See

62 [Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business).70 [Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business).

~~63- **Approval and action restrictions:** For connectors that support Action control,~~71- **Approval and action restrictions:** For apps that support Action control,

64 admins can allow all actions, read-only actions, or a custom set and decide72 admins can allow all actions, read-only actions, or a custom set and decide

65 how newly added actions are handled. App permissions separately determine73 how newly added actions are handled. App permissions separately determine

~~66 when ChatGPT asks before using a connector.~~74 when ChatGPT asks before using an app.

67- **Credits:** ChatGPT Work and Codex share pricing, credits, and usage limits.75- **Credits:** ChatGPT Work and Codex share pricing, credits, and usage limits.

68 Eligible Enterprise and Edu admins can set monthly per-user limits through a76 Eligible Enterprise and Edu admins can set monthly per-user limits through a

69 workspace default, group defaults, and individual overrides. Users can77 workspace default, group defaults, and individual overrides. Users can

83 91

84ChatGPT Work is governed by the identity, access, and permission controls already92ChatGPT Work is governed by the identity, access, and permission controls already

85established in your ChatGPT workspace. Administrators use identity management,93established in your ChatGPT workspace. Administrators use identity management,

~~86[RBAC](https://help.openai.com/en/articles/11750701-rbac), and workspace roles~~94workspace roles, and, on eligible plans,

~~87to determine who can use ChatGPT Work.~~95[RBAC](https://help.openai.com/en/articles/11750701-rbac) to determine who can

96use ChatGPT Work.

88 97

89Where supported, access can be synchronized with your identity provider through98Where supported, access can be synchronized with your identity provider through

90[SCIM](https://help.openai.com/en/articles/10011769-openai-platform-scim-integration-faq)99[SCIM](https://help.openai.com/en/articles/10011769-openai-platform-scim-integration-faq)

91and group synchronization. This lets you manage access and permissions centrally100and group synchronization. This lets you manage access and permissions centrally

92as employees join the organization, change roles, or leave.101as employees join the organization, change roles, or leave.

93 102

~~94Underlying source systems continue to enforce access to enterprise data. ChatGPT Work~~103Underlying source systems enforce the permissions of the account or approved

~~95respects the permissions defined in connected applications, so users and agents~~104shared connection used for the operation. An individual connection uses that

~~96can access only files, repositories, channels, records, and actions they are~~105person's source-system access. An agent-owned or shared connection can give

~~97authorized to use. ChatGPT Work doesn't bypass existing access controls or grant new~~106authorized agent users access through the connected account, including data or

~~98permissions in connected systems.~~107actions their own account couldn't access. Restrict the connection's scopes,

108available actions, and agent audience to the intended business need. See

109[Workspace Agent connections and permissions](https://help.openai.com/en/articles/20001143-chatgpt-workspace-agents-for-enterprise-and-business).

99 110

100<a id="how-does-work-access-data-and-context"></a>111<a id="how-does-work-access-data-and-context"></a>

101<a id="how-does-work-mode-access-data-and-context"></a>112<a id="how-does-work-mode-access-data-and-context"></a>

103### How does ChatGPT Work access data and context?114### How does ChatGPT Work access data and context?

104 115

105ChatGPT Work can use the current chat, uploaded files, workspace resources, and116ChatGPT Work can use the current chat, uploaded files, workspace resources, and

106connected systems through plugins. Depending on enabled capabilities and117connected systems through approved apps and, when applicable, plugins.

107permissions, this can include documents, repositories, tickets, channels,118Depending on enabled capabilities and permissions, this can include documents,

108email, and calendars. Files from earlier chats or memory can be available119repositories, tickets, channels, email, and calendars. Earlier files can be

109when included in the current chat or project, or when applicable120available through the current chat, supported projects, authorized Library

110workspace and user memory controls are enabled.121access, or enabled automatic Library references. Saved memories follow their

122own workspace and user controls.

111 123

112Each context source keeps its own controls: users supply chat context,124Each context source keeps its own controls: users supply chat context,

113admins manage workspace resources, and connected systems enforce authentication125admins manage workspace resources, and connected systems enforce authentication

135 documents, tickets, repositories, or project-management tools.147 documents, tickets, repositories, or project-management tools.

136- **Share:** Send, publish, or otherwise make information available to more148- **Share:** Send, publish, or otherwise make information available to more

137 people, systems, or external destinations.149 people, systems, or external destinations.

138- **Scheduled:** Start a task at a future time or on a recurring schedule150- **Schedule:** Start a task at a future time or on a recurring schedule

139 without requiring a user to initiate each run.151 without requiring a user to start each run.

140- **Execute:** Run code, shell commands, browser automation, or other152- **Execute:** Run code, shell commands, browser automation, or other

141 tool-driven tasks that interact directly with external environments.153 tool-driven tasks that interact directly with external environments.

142 154

158encryption in transit and at rest, workspace-level access controls, and170encryption in transit and at rest, workspace-level access controls, and

159supported audit logging.171supported audit logging.

160 172

161Coverage for data residency, inference residency, FedRAMP, HIPAA, or a Business173Coverage for data residency, inference residency, HIPAA, or a Business Associate

162Associate Agreement isn't universal. Confirm current174Agreement isn't universal. Confirm current

163[data and inference residency guidance](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt)175[data and inference residency guidance](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt)

164and the customer's agreement for the features and regions in use.176and the customer's agreement for the features and regions in use.

165 177

177 189

178Data retention and deletion for ChatGPT Work are governed by the ChatGPT workspace190Data retention and deletion for ChatGPT Work are governed by the ChatGPT workspace

179plan, administrative settings, and the capabilities in use. Retention can vary191plan, administrative settings, and the capabilities in use. Retention can vary

180across the information ChatGPT Work accesses. Data stored by ChatGPT follows the192across the information ChatGPT Work accesses. Conversations and eligible Library

181configured workspace retention policies, while connected applications continue193files follow their applicable workspace settings. Project files, transient

182to manage their own data and lifecycle policies. See194uploads, saved memories, compliance events, synchronized app data, and

195third-party records can have separate retention and deletion rules. See

183[Chat and file retention policies](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt).196[Chat and file retention policies](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt).

184 197

185ChatGPT Work can create chat content, uploaded or generated files, artifacts,198ChatGPT Work can create chat content, uploaded or generated files, artifacts,

197### What usage data is available to admins or owners?210### What usage data is available to admins or owners?

198 211

199Admins and owners can use product analytics and compliance logs for different212Admins and owners can use product analytics and compliance logs for different

200kinds of visibility. The Global Admin Console shows adoption and credit use by213kinds of visibility. The Global Admin Console provides supported ChatGPT and

201user, product, and model, including the ability to drill down across Chat, Work,214Codex adoption and credit-usage views; available user, product, agent, and model

202and Codex usage. The Compliance API covers all user messages and responses215breakdowns depend on the analytics surface and workspace. For eligible

203across Chat, Work, and Codex. See216workspaces, the Compliance API provides covered ChatGPT conversation records,

217including supported cloud Work activity. Coverage depends on the product,

218surface, permissions, available endpoint, and documented event schema. See

204[Workspace analytics](https://learn.chatgpt.com/docs/enterprise/workspace-analytics) and the219[Workspace analytics](https://learn.chatgpt.com/docs/enterprise/workspace-analytics) and the

205[Compliance API](https://learn.chatgpt.com/docs/enterprise/compliance-api).220[Compliance API](https://learn.chatgpt.com/docs/enterprise/compliance-api).

206 221

207### Are prompts, outputs, files, actions, or tool calls logged?222### Are prompts, outputs, files, actions, or tool calls logged?

208 223

209The Compliance Logs Platform provides user prompts and agent responses. It224For eligible Enterprise and Edu workspaces, the Compliance Logs Platform

210doesn't track files, actions, or tool calls.225provides Work user prompts and agent responses.

226[Connected app calls are separately logged](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business),

227and eligible workspaces can access active Library files through supported

228[Library-specific Compliance API endpoints](https://help.openai.com/en/articles/20001052-library-for-chatgpt).

229These records don't establish a complete audit trail for every hosted file

230operation, shell command, browser interaction, tool invocation, or approval.

231Confirm the current event and product coverage in the authenticated Compliance

232API documentation.

211 233

212The Compliance Logs Platform retains data for 30 days. Export records234The Compliance Logs Platform retains data for 30 days. Export records

213continuously to an approved electronic discovery, data loss prevention, SIEM,235continuously to an approved electronic discovery, data loss prevention, SIEM,

218 240

219Workspace analytics, compliance logs, and connected monitoring tools help241Workspace analytics, compliance logs, and connected monitoring tools help

220admins review usage and investigate supported ChatGPT, Work, and Codex242admins review usage and investigate supported ChatGPT, Work, and Codex

221activity. Signals can include active users, messages, tool activity, agent243activity. Depending on the selected reporting surface, signals can include

222activity, authentication and administrative events, and credit consumption.244active users, supported messages, app activity, agent usage, authentication or

223Exported logs can support electronic discovery, data loss prevention, SIEM,245administrative events, and credit consumption. Exported logs can support

224auditing, and investigations. Detection quality depends on plan, event246electronic discovery, data loss prevention, SIEM, auditing, and investigations.

225coverage, attribution, freshness, and configured rules.247Detection quality depends on plan, event coverage, attribution, freshness, and

248configured rules.

226 249

227Signals that can warrant review include unexpected increases in usage or credit250Signals that can warrant review include unexpected increases in usage or credit

228consumption, unusual user or agent activity, recurring operational errors, and251consumption, unusual user or agent activity, recurring operational errors, and

236redacted unless `otel.log_user_prompt = true` is enabled as a separate explicit259redacted unless `otel.log_user_prompt = true` is enabled as a separate explicit

237opt-in. See260opt-in. See

238[Monitoring and telemetry](https://learn.chatgpt.com/docs/agent-approvals-security#monitoring-and-telemetry).261[Monitoring and telemetry](https://learn.chatgpt.com/docs/agent-approvals-security#monitoring-and-telemetry).

262This local Codex telemetry doesn't provide an OpenTelemetry export for ChatGPT

263Work on the web.

239 264

240## Governance265## Governance

241 266

246- **ChatGPT Work access controls** determine who can use ChatGPT Work on271- **ChatGPT Work access controls** determine who can use ChatGPT Work on

247 each surface.272 each surface.

248- **Workspace Agent controls** determine who can build, publish, share,273- **Workspace Agent controls** determine who can build, publish, share,

249 schedule, or configure reusable agents and shared connections.274 schedule, or configure reusable agents and shared connections, where

250- **Codex managed configuration** governs covered local runtime behavior,275 Workspace Agents are available.

251 including permissions, approvals, filesystem and network access, MCP servers,276- **Codex managed configuration** governs covered local Codex runtime behavior

252 hooks, and command rules.277 and doesn't configure hosted ChatGPT Work.

253 278

254Managed configuration constrains supported runtime behavior. It doesn't grant279Managed configuration constrains supported runtime behavior. It doesn't grant

255workspace access, replace RBAC, or revoke a user's workspace access. These280workspace access, replace RBAC, or revoke a user's workspace access. These

257provide additional visibility within their documented product and event282provide additional visibility within their documented product and event

258scopes.283scopes.

259 284

260Enterprise administrators can use285For supported local Codex clients, enterprise administrators can apply

261[managed requirements](https://learn.chatgpt.com/docs/enterprise/managed-configuration) to enforce286[managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration) and

262supported settings that users can't override while the requirements are287[permission profiles](https://learn.chatgpt.com/docs/permissions). Those local-client controls don't

263active. Supported policies cover approval behavior, permission profiles, web288grant access to, or replace the workspace permissions for, hosted ChatGPT Work.

264search, hooks, MCP servers, feature flags, command rules, and filesystem

265access. Network requirements are experimental and should be tested on the

266client versions and operating systems in your deployment before broad use. For

267current Codex clients, managed

268[permission profiles](https://learn.chatgpt.com/docs/permissions) are the preferred way to define

269filesystem, network, and runtime access.

270 289

271### Can access be scoped by group, role, workspace, or capability?290### Can access be scoped by group, role, workspace, or capability?

272 291

273Yes. ChatGPT Work capabilities can be scoped with workspace roles, identity groups,292Yes. On eligible Enterprise and Edu plans that support custom member RBAC,

274and administrator-defined permissions. Assign capabilities to groups based on293ChatGPT Work capabilities can be scoped with workspace roles, identity groups,

275business need and organizational policy instead of giving every user identical294and administrator-defined permissions. ChatGPT Business uses applicable

276access. See the295workspace-level controls but doesn't include custom member RBAC or SCIM group

296synchronization. Assign supported capabilities based on business need and

297organizational policy. See the

277[RBAC guide](https://help.openai.com/en/articles/11750701-rbac) and this298[RBAC guide](https://help.openai.com/en/articles/11750701-rbac) and this

278[RBAC walkthrough](https://vimeo.com/1207482321/d1286e4467?share=copy&fl=sv&fe=ci).299[RBAC walkthrough](https://vimeo.com/1207482321/d1286e4467?share=copy&fl=sv&fe=ci).

279 300

280Organizations can use RBAC to determine which users can access ChatGPT Work, manage301Where custom RBAC is available, organizations can use it to determine which

281workspace settings, configure approved plugins, or build and publish Workspace302users can access ChatGPT Work, manage workspace settings, configure approved

282Agents. For eligible Enterprise and Edu workspaces, monthly usage limits can303plugins, or use supported Workspace Agent features. For eligible Enterprise and

283support a phased rollout through a workspace default, group defaults, and user304Edu workspaces, monthly usage limits can support a phased rollout through a

284overrides.305workspace default, group defaults, and user overrides.

285 306

286Access to connected systems remains independently governed. Scope plugins, shared307Access to connected systems remains independently governed. Scope plugins, shared

287credentials, repositories, and write-capable actions to the minimum required308credentials, repositories, and write-capable actions to the minimum required

288audience using workspace permissions, plugin settings, and the source system's309audience using workspace permissions, plugin settings, and the source system's

289controls. For higher-trust environments, use managed policies to restrict310controls. For supported local Codex clients, managed configuration can further

290runtime capabilities further.311restrict local runtime capabilities. Hosted Work follows its own workspace and

312product-specific controls.

291 313

292### How are runtime and network boundaries governed?314### How are runtime and network boundaries governed?

293 315

295connected workflow, a scheduled task, and a Codex chat can run in different317connected workflow, a scheduled task, and a Codex chat can run in different

296environments with different permissions, tools, and network access.318environments with different permissions, tools, and network access.

297 319

298Govern each execution environment through its applicable controls. ChatGPT Work320Govern each execution environment through its applicable controls. Work Cloud

299permissions on web and mobile govern access to ChatGPT Work and supported browser or321governs hosted Work across supported web, mobile, and desktop surfaces. Work

300network capabilities. Search, plugins, Workspace Agents, and322Local governs local desktop Work, and Codex Local controls supported local

301source-system permissions remain separate controls. Desktop and Codex chats323Codex access in desktop, CLI, and IDE clients. Browser and shell network

302follow Codex permissions, managed configuration, MCP policy, sandboxing, and324permissions further restrict Work Cloud. Search, apps, plugins, available

303approval controls. These controls aren't interchangeable.325Workspace Agents, and source-system permissions remain separate controls.

326Applicable managed configuration and local runtime policies govern only their

327supported local experiences. These controls aren't interchangeable.

304 328

305For Codex activity, local runs in the ChatGPT desktop app, CLI, and IDE execute329For Codex activity, local runs in the ChatGPT desktop app, CLI, and IDE execute

306on the user's machine with operating-system sandboxing and approval policies.330on the user's machine with operating-system sandboxing and approval policies.

307Codex cloud runs chats in isolated OpenAI-managed environments. Enterprise331Codex cloud runs chats in isolated OpenAI-managed environments. For supported

308administrators can use managed requirements to constrain permission profiles,332local clients, enterprise administrators can use managed requirements to

309approvals, filesystem and network access, MCP servers, hooks, command rules,333constrain permission profiles, approvals, filesystem and network access, MCP

310and other supported runtime behavior.334servers, hooks, command rules, and other supported runtime behavior.

311 335

312## Usage and cost336## Usage and cost

313 337

321tool use, and output size. Standard Chat usage is separate.345tool use, and output size. Standard Chat usage is separate.

322 346

323The highest-variance patterns are often workflows that run frequently,347The highest-variance patterns are often workflows that run frequently,

324retrieve or process large amounts of information, call multiple tools or connectors,348retrieve or process large amounts of information, call multiple tools or apps,

325retry after failures, or produce large artifacts. Cost-sensitive examples349retry after failures, or produce large artifacts. Cost-sensitive examples

326include scheduled or recurring work, high-volume triggers, large files, broad350include scheduled or recurring work, large files, broad

327retrieval across enterprise sources, repeated connector calls, and Codex chats that351retrieval across enterprise sources, repeated app calls, and Codex chats that

328process repositories, run commands, or use cloud environments.352process repositories, run commands, or use cloud environments. Workspace Agent

353API triggers can also add usage where available.

329 354

330Use spend controls, usage analytics, and reporting to monitor these patterns355Use spend controls, usage analytics, and reporting to monitor these patterns

331over time. Review usage by the dimensions supported in the current analytics356over time. Review usage by the dimensions supported in the current analytics

370 395

371### How can admins stop access or activity?396### How can admins stop access or activity?

372 397

373Admins can need to stop users, plugins, shared credentials, workflows, schedules,398During user removal or incident review, admins might need to stop access,

374or Codex credentials during user removal or incident review.399disable apps, revoke shared credentials, pause scheduled tasks, or revoke Codex

400credentials.

375 401

376Revocation paths include:402Revocation paths include:

377 403

378- Remove a user's workspace or group access. For SCIM-managed users, remove404- Remove a user's workspace or group access. For SCIM-managed users, remove

379 access at the identity provider; otherwise, a later synchronization can405 access at the identity provider; otherwise, a later synchronization can

380 provision the user again.406 provision the user again.

381- Disable or restrict the relevant plugin or connector.407- Disable or restrict the relevant plugin or app.

382- Revoke a shared connection, bot, or service account through its owning408- Revoke a shared connection, bot, or service account through its owning

383 surface. Workspace owners and admins can separately revoke Codex workspace409 surface. Workspace owners and admins can separately revoke Codex workspace

384 access tokens.410 access tokens.

385- Remove a Workspace Agent from publication or delete it through its agent owner411- Remove a Workspace Agent from publication or delete it through its agent owner

386 or workspace administrator.412 or workspace administrator.

387- Disable the relevant schedule or trigger.413- Disable the relevant scheduled task or, where available, Workspace Agent API

414 trigger.

388- For Codex access, separately revoke the relevant access token, repository415- For Codex access, separately revoke the relevant access token, repository

389 connection, and cloud-environment access. Managed configuration isn't an416 connection, and cloud-environment access. Managed configuration isn't an

390 access-revocation mechanism.417 access-revocation mechanism.

392## Additional resources for your teams419## Additional resources for your teams

393 420

395| ------------------------ | -------------------------------------------------------------------------- | ---------------------------------------------------------------- |422| ------------------------ | ----------------------------------------------------------------------------- | ---------------------------------------------------------------- |

423| Work overview | How cloud execution, browser access, network policy, and data boundaries work | [ChatGPT Work Overview](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-overview) |

398| Approvals and sandboxing | How Codex controls file, command, network, and side-effecting tool actions | [Agent approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) |426| Approvals and sandboxing | How Codex controls file, command, network, and side-effecting tool actions | [Agent approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) |

413 and governance expectations.441 and governance expectations.

414- **Review plugins and data sources.** ChatGPT Work is most useful with approved442- **Review plugins and data sources.** ChatGPT Work is most useful with approved

415 business context such as files, email, calendars, Slack, or CRM. Review443 business context such as files, email, calendars, Slack, or CRM. Review

416 enabled plugins, their audiences, and whether connector policies still match how users444 enabled plugins, their audiences, and whether app policies still match how users

417 should delegate work.445 should delegate work.

418- **Set expectations for appropriate use cases.** Position ChatGPT Work for multi-step,446- **Set expectations for appropriate use cases.** Position ChatGPT Work for multi-step,

419 higher-value tasks such as research, synthesis, analysis, file creation,447 higher-value tasks such as research, synthesis, analysis, file creation,

permissions.md +79 −19

Details

23rules, which define what commands can read or write, with network rules, which23rules, which define what commands can read or write, with network rules, which

24define which destinations commands can reach.24define which destinations commands can reach.

25 25

26A profile's `network.enabled = true` permits command network access, but it

27 does not start the network proxy. To enforce profile domain rules, also set

28 `features.network_proxy = true` in `config.toml`, or use enabled,

29 administrator-managed `[experimental_network]` requirements. Without an active

30 proxy, profile domain rules do not restrict direct network access.

26Use profiles to give Codex enough access for the current chat without granting32Use profiles to give Codex enough access for the current chat without granting

27broad access to your machine or network. For example, a read-only profile can33broad access to your machine or network. For example, a read-only profile can

28let Codex inspect a project without editing it, while a write-capable profile34let Codex inspect a project without editing it, while a write-capable profile

88```toml94```toml

89default_permissions = "project-edit"95default_permissions = "project-edit"

90 96

97[features]

98network_proxy = true

91[permissions.project-edit.workspace_roots]100[permissions.project-edit.workspace_roots]

92"~/code/app" = true101"~/code/app" = true

93"~/code/shared-lib" = true102"~/code/shared-lib" = true

136```toml145```toml

137default_permissions = "project-edit"146default_permissions = "project-edit"

138 147

148[features]

149network_proxy = true

150

139[permissions.project-edit]151[permissions.project-edit]

140description = "Project editing with OpenAI API access."152description = "Project editing with OpenAI API access."

141extends = ":workspace"153extends = ":workspace"

170| `permissions.<name>.filesystem.glob_scan_max_depth` | Number | None | Limits deny-read glob expansion on Linux, WSL, and native Windows when Codex snapshots matches before sandbox startup. Larger values can increase startup scanning work. Use a value of at least `1` when an unbounded `**` pattern needs bounded pre-expansion. |182| `permissions.<name>.filesystem.glob_scan_max_depth` | Number | None | Limits deny-read glob expansion on Linux, WSL, and native Windows when Codex snapshots matches before sandbox startup. Larger values can increase startup scanning work. Use a value of at least `1` when an unbounded `**` pattern needs bounded pre-expansion. |

171| `[permissions.<name>.filesystem]."<path>"` | `read`, `write`, or `deny` | None | Grants direct access for a supported path. `deny` denies access and wins over equally specific `write` or `read` entries. Codex rejects direct write rules that the active runtime cannot enforce. |183| `[permissions.<name>.filesystem]."<path>"` | `read`, `write`, or `deny` | None | Grants direct access for a supported path. `deny` denies access and wins over equally specific `write` or `read` entries. Codex rejects direct write rules that the active runtime cannot enforce. |

172| `[permissions.<name>.filesystem."<path>"]."<subpath>"` | `read`, `write`, or `deny` | None | Grants access to a descendant of `<path>`. Use `.` for the base path. Other subpaths must be relative descendants and cannot contain `.` or `..` components. |184| `[permissions.<name>.filesystem."<path>"]."<subpath>"` | `read`, `write`, or `deny` | None | Grants access to a descendant of `<path>`. Use `.` for the base path. Other subpaths must be relative descendants and cannot contain `.` or `..` components. |

174| `permissions.<name>.network.enabled` | Boolean | `false` | Enables network access for sandboxed commands in the profile. This changes the sandbox network policy; it does not start the network proxy by itself. |186| `permissions.<name>.network.enabled` | Boolean | `false` | Enables network access for commands in the profile. It does not start the network proxy; without an active proxy, commands can connect directly without domain restrictions. |

175| `[permissions.<name>.network.domains]` | Table | None | Maps host patterns to `allow` or `deny`. If there are no `allow` entries, domain requests are blocked. Deny entries override allow entries. |187| `[permissions.<name>.network.domains]` | Table | None | Maps host patterns to `allow` or `deny`. Rules apply only when the network proxy is active. The active proxy blocks domain requests if there are no `allow` entries, and deny entries override allow entries. |

176| `permissions.<name>.network.domains."<pattern>"` | `allow` or `deny` | None | Supports exact hosts, `*.example.com` for subdomains, `**.example.com` for apex plus subdomains, and `*` as an allow-only global wildcard. Host patterns are normalized by trimming, lowercasing, stripping a trailing dot, and stripping simple ports or brackets. |188| `permissions.<name>.network.domains."<pattern>"` | `allow` or `deny` | None | Supports exact hosts, `*.example.com` for subdomains, `**.example.com` for apex plus subdomains, and `*` as an allow-only global wildcard. Host patterns are normalized by trimming, lowercasing, stripping a trailing dot, and stripping simple ports or brackets. |

178| `permissions.<name>.network.unix_sockets."<path>"` | `allow` or `deny` | None | Adds an absolute Unix socket path to the effective allowlist with `allow`, or rejects it with `deny`. Denied entries are omitted from the effective allowlist. |190| `permissions.<name>.network.unix_sockets."<path>"` | `allow` or `deny` | None | Adds an absolute Unix socket path to the effective allowlist with `allow`, or rejects it with `deny`. Denied entries are omitted from the effective allowlist. |

318 330

319## Network permissions331## Network permissions

320 332

321Set `enabled = true` to allow network access for the selected profile:333Network access and network filtering are separate settings. Set

334`permissions.<name>.network.enabled = true` to let commands access the network,

335and enable `features.network_proxy` to enforce the profile's domain rules:

322 336

323```toml337```toml

338[features]

339network_proxy = true

340

324[permissions.project-edit.network]341[permissions.project-edit.network]

325enabled = true342enabled = true

326```

~~327~~

328When network access is enabled, Codex uses full network behavior by default.

329Most profiles should also define domain rules:

330 343

331```toml

332[permissions.project-edit.network.domains]344[permissions.project-edit.network.domains]

333"example.com" = "allow" # exact host345"example.com" = "allow" # exact host

334"*.example.com" = "allow" # subdomains only346"*.example.com" = "allow" # subdomains only

336"ads.example.com" = "deny" # deny wins over allow348"ads.example.com" = "deny" # deny wins over allow

337```349```

338 350

339The network sandbox proxy binds to local listeners by default:351The resulting behavior depends on both settings:

352

353- Network off: Commands cannot access the network, regardless of the proxy

354 feature.

355- Network on, proxy off: Commands have direct, unrestricted network

356 access. Domain rules in the permission profile are not enforced.

357- Network on, proxy on: Commands use the proxy, which enforces the profile's

358 domain rules. If the active proxy has no allowed domains, it blocks external

359 destinations.

360

361Adding `[permissions.<name>.network.domains]` or setting

362`permissions.<name>.network.enabled = true` does not enable

363`features.network_proxy`. As an alternative, administrators can enable the

364proxy with `[experimental_network]` in `requirements.toml`. See

365[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-network-access-requirements).

366

367When active, the network sandbox proxy binds to local listeners by default:

340 368

341```toml369```toml

342[permissions.project-edit.network]370[permissions.project-edit.network]

353 381

354### Local and private networks382### Local and private networks

355 383

356Codex applies a local/private-network guard by default as a defense against DNS384When the network proxy is active, Codex applies a local/private-network guard by

357rebinding and accidental access to local services. To intentionally allow a385default as a defense against DNS rebinding and accidental access to local

358literal local target, allowlist the exact host or IP literal:386services. To intentionally allow a literal local target, allowlist the exact

387host or IP literal:

359 388

360```toml389```toml

361[permissions.project-edit.network.domains]390[permissions.project-edit.network.domains]

417 446

418Permission profiles define the boundaries for local sandboxed command447Permission profiles define the boundaries for local sandboxed command

419execution. Use them together with approval policies and the separate controls448execution. Use them together with approval policies and the separate controls

420for connectors, MCP servers, the built-in browser, Computer Use, and Codex cloud.449for web search, connectors, MCP servers, the built-in browser, Computer Use,

450and Codex cloud.

421 451

422### What profiles control452### What profiles control

423 453

430 files, and shared directories as sensitive because later tools or users can460 files, and shared directories as sensitive because later tools or users can

431 execute those files outside the original sandbox context.461 execute those files outside the original sandbox context.

432- **Outbound destinations:** Network domain rules constrain where sandboxed462- **Outbound destinations:** Network domain rules constrain where sandboxed

433 command traffic can go through the network proxy. They do not determine463 command traffic can go only while the network proxy is active. They do not

434 whether an allowed destination is trustworthy, and wildcard allow rules stay464 determine whether an allowed destination is trustworthy, and wildcard allow

435 broad.465 rules stay broad.

436- **Local services:** Local and private network targets are blocked by default.466- **Local services:** An active network proxy blocks local and private network

437 Allowlisting `localhost`, private IPs, Unix sockets, or setting467 targets by default. Allowlisting `localhost`, private IPs, Unix sockets, or setting

438 `allow_local_binding = true` explicitly opens access to local services.468 `allow_local_binding = true` explicitly opens access to local services.

439 469

470### What the network proxy does not control

471

472The network proxy only filters traffic from local commands that run inside the

473sandbox. It does not apply the profile's domain allowlist to:

474

475- **Web search:** The hosted search tool uses its own access settings. Use

476 `web_search` and, for managed clients, `allowed_web_search_modes` to control

477 it. `tools.web_search.allowed_domains` filters search results, not command

478 network access.

479- **Apps and connectors:** Connector-backed tools use their own service-side

480 connections, workspace permissions, and app or tool settings.

481- **MCP servers:** Local and remote MCP servers use their own process or

482 transport. Control them with `mcp_servers` configuration and managed server

483 allowlists.

484- **Browser and Computer Use:** Browser navigation and computer-use actions

485 use their own feature and approval controls.

486- **Codex service traffic:** Model, authentication, and other client service

487 requests use the client's separate HTTP and system-proxy settings.

488- **Codex cloud:** These tasks use their environment's own

489 [internet access settings](https://learn.chatgpt.com/docs/cloud/internet-access).

490

491To limit these surfaces, configure each capability directly. A command network

492allowlist is not a global network policy for every action Codex can perform.

493

440### How enforcement works494### How enforcement works

441 495

442- On macOS, Codex uses Seatbelt sandbox profiles. If the selected policy cannot496- On macOS, Codex uses Seatbelt sandbox profiles. If the selected policy cannot

468```toml522```toml

469default_permissions = "readonly-net"523default_permissions = "readonly-net"

470 524

525[features]

526network_proxy = true

527

471[permissions.readonly-net.filesystem]528[permissions.readonly-net.filesystem]

472":minimal" = "read"529":minimal" = "read"

473 530

529```toml586```toml

530default_permissions = "workspace-net"587default_permissions = "workspace-net"

531 588

589[features]

590network_proxy = true

591

532[permissions.workspace-net.filesystem]592[permissions.workspace-net.filesystem]

533":minimal" = "read"593":minimal" = "read"

534 594

web-search.md +7 −0

Details

49an OpenAI-maintained index instead of fetching arbitrary pages live, which49an OpenAI-maintained index instead of fetching arbitrary pages live, which

50lowers—but doesn't remove—prompt injection risk.50lowers—but doesn't remove—prompt injection risk.

51 51

52Web search is a hosted tool, separate from sandboxed local command networking.

53It does not use the permission profile's network proxy or domain allowlist, and

54it can remain available when command network access is disabled. Configure

55search with `web_search`, `tools.web_search.allowed_domains`, and managed

56`allowed_web_search_modes` as appropriate. Search-domain filters do not restrict

57local command traffic, apps, connectors, or MCP servers.

52Use live search when your task depends on the latest information. Set59Use live search when your task depends on the latest information. Set

53`web_search = "live"` in `config.toml`. Set `web_search = "disabled"` to turn60`web_search = "live"` in `config.toml`. Set `web_search = "disabled"` to turn

54the tool off. The `"indexed"` mode permits external web access only when the61the tool off. The `"indexed"` mode permits external web access only when the

Documentation 2026-08-14 22:00 UTC to 2026-08-15 01:01 UTC