Documentation 2026-08-14 22:00 UTC to 2026-08-15 01:01 UTC

28 href: "/codex/enterprise/admin-setup",28 href: "/codex/enterprise/admin-setup",

29 icon: "users",29 icon: "users",

30 },30 },

31 {

32 title: "ChatGPT Work Overview",

33 description:

34 "Understand hosted execution, network controls, data boundaries, and audit visibility.",

35 href: "/codex/enterprise/chatgpt-work-overview",

36 icon: "shieldCheck",

37 },

31 {38 {

32 title: "ChatGPT Work admin FAQ",39 title: "ChatGPT Work admin FAQ",

33 description:40 description:

48Network access is controlled through destination rules that apply to scripts,48Network access is controlled through destination rules that apply to scripts,

49programs, and subprocesses spawned by commands. When command network access is49programs, and subprocesses spawned by commands. When command network access is

50already enabled, turn on the `network_proxy` feature to constrain that traffic50already enabled, turn on the `network_proxy` feature to constrain that traffic

51to the network policy you configure.51to the network policy you configure. Adding domain rules does not enable the

52proxy by itself.

52 53 

53```toml54```toml

54[features.network_proxy]55[features.network_proxy]

80- Network on + `network_proxy` on: network stays on, and outbound traffic is81- Network on + `network_proxy` on: network stays on, and outbound traffic is

81 constrained by the configured network policy.82 constrained by the configured network policy.

82 83 

84The proxy feature also applies to [permission profiles](https://learn.chatgpt.com/docs/permissions#network-permissions).

85A profile's `network.enabled = true` grants command network access, while

86`features.network_proxy = true` activates enforcement of that profile's domain

87rules:

88 

89```toml

90default_permissions = "project-edit"

91 

92[features]

93network_proxy = true

94 

95[permissions.project-edit]

96extends = ":workspace"

97 

98[permissions.project-edit.network]

99enabled = true

100 

101[permissions.project-edit.network.domains]

102"api.openai.com" = "allow"

103```

104 

105If you omit the proxy feature in this example, commands have direct network

106access and the `api.openai.com` allow rule does not restrict their destinations.

107 

83Admin-managed `experimental_network` requirements are separate from the user108Admin-managed `experimental_network` requirements are separate from the user

84feature toggle. They can configure and start sandboxed networking without109feature toggle. They can configure and start sandboxed networking without

85`features.network_proxy`, but they do not turn on network access when the active110`features.network_proxy`, but they do not turn on network access when the active

150| `dangerously_allow_non_loopback_proxy` | `false` | Keeps listener endpoints on loopback unless you deliberately expose them beyond localhost. |175| `dangerously_allow_non_loopback_proxy` | `false` | Keeps listener endpoints on loopback unless you deliberately expose them beyond localhost. |

151| `dangerously_allow_all_unix_sockets` | `false` | Keeps Unix socket access allowlist-based unless you deliberately bypass that protection. |176| `dangerously_allow_all_unix_sockets` | `false` | Keeps Unix socket access allowlist-based unless you deliberately bypass that protection. |

152 177 

178### Traffic outside the command network proxy

179 

180The network proxy filters scripts, programs, and child processes that run

181inside the local command sandbox. It does not filter web search, app or

182connector tool calls, MCP server connections, browser or Computer Use activity,

183Codex cloud tasks, or the client's model and authentication requests. These

184surfaces use separate service connections, feature settings, workspace

185policies, or environment controls.

186 

187For managed users, combine command network policy with controls such as

188`allowed_web_search_modes`, approved `mcp_servers`, and feature requirements

189for apps, plugins, browsers, or Computer Use. See

190[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration).

191 

153You can also control the [web search tool](https://platform.openai.com/docs/guides/tools-web-search) without granting full network access to spawned commands. Codex defaults to using a web search cache to access results. The cache is an OpenAI-maintained index of web results, so cached mode returns pre-indexed results instead of fetching live pages. This reduces exposure to prompt injection from arbitrary live content, but you should still treat web results as untrusted. If you are using `--yolo` or another [full access sandbox setting](#common-sandbox-and-approval-combinations), web search defaults to live results. Use `--search` or set `web_search = "live"` to allow live browsing, or set it to `"disabled"` to turn the tool off:192You can also control the [web search tool](https://platform.openai.com/docs/guides/tools-web-search) without granting full network access to spawned commands. Codex defaults to using a web search cache to access results. The cache is an OpenAI-maintained index of web results, so cached mode returns pre-indexed results instead of fetching live pages. This reduces exposure to prompt injection from arbitrary live content, but you should still treat web results as untrusted. If you are using `--yolo` or another [full access sandbox setting](#common-sandbox-and-approval-combinations), web search defaults to live results. Use `--search` or set `web_search = "live"` to allow live browsing, or set it to `"disabled"` to turn the tool off:

154 193 

155```toml194```toml

8698Network access is controlled through destination rules that apply to scripts,8698Network access is controlled through destination rules that apply to scripts,

8699programs, and subprocesses spawned by commands. When command network access is8699programs, and subprocesses spawned by commands. When command network access is

8700already enabled, turn on the `network_proxy` feature to constrain that traffic8700already enabled, turn on the `network_proxy` feature to constrain that traffic

8701to the network policy you configure.8701to the network policy you configure. Adding domain rules does not enable the

8702proxy by itself.

8702 8703 

8703```toml8704```toml

8704[features.network_proxy]8705[features.network_proxy]

8730- Network on + `network_proxy` on: network stays on, and outbound traffic is8731- Network on + `network_proxy` on: network stays on, and outbound traffic is

8731 constrained by the configured network policy.8732 constrained by the configured network policy.

8732 8733 

8734The proxy feature also applies to [permission profiles](https://learn.chatgpt.com/docs/permissions#network-permissions).

8735A profile's `network.enabled = true` grants command network access, while

8736`features.network_proxy = true` activates enforcement of that profile's domain

8737rules:

8738 

8739```toml

8740default_permissions = "project-edit"

8741 

8742[features]

8743network_proxy = true

8744 

8745[permissions.project-edit]

8746extends = ":workspace"

8747 

8748[permissions.project-edit.network]

8749enabled = true

8750 

8751[permissions.project-edit.network.domains]

8752"api.openai.com" = "allow"

8753```

8754 

8755If you omit the proxy feature in this example, commands have direct network

8756access and the `api.openai.com` allow rule does not restrict their destinations.

8757 

8733Admin-managed `experimental_network` requirements are separate from the user8758Admin-managed `experimental_network` requirements are separate from the user

8734feature toggle. They can configure and start sandboxed networking without8759feature toggle. They can configure and start sandboxed networking without

8735`features.network_proxy`, but they do not turn on network access when the active8760`features.network_proxy`, but they do not turn on network access when the active

8800| `dangerously_allow_non_loopback_proxy` | `false` | Keeps listener endpoints on loopback unless you deliberately expose them beyond localhost. |8825| `dangerously_allow_non_loopback_proxy` | `false` | Keeps listener endpoints on loopback unless you deliberately expose them beyond localhost. |

8801| `dangerously_allow_all_unix_sockets` | `false` | Keeps Unix socket access allowlist-based unless you deliberately bypass that protection. |8826| `dangerously_allow_all_unix_sockets` | `false` | Keeps Unix socket access allowlist-based unless you deliberately bypass that protection. |

8802 8827 

8828#### Traffic outside the command network proxy

8829 

8830The network proxy filters scripts, programs, and child processes that run

8831inside the local command sandbox. It does not filter web search, app or

8832connector tool calls, MCP server connections, browser or Computer Use activity,

8833Codex cloud tasks, or the client's model and authentication requests. These

8834surfaces use separate service connections, feature settings, workspace

8835policies, or environment controls.

8836 

8837For managed users, combine command network policy with controls such as

8838`allowed_web_search_modes`, approved `mcp_servers`, and feature requirements

8839for apps, plugins, browsers, or Computer Use. See

8840[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration).

8841 

8803You can also control the [web search tool](https://platform.openai.com/docs/guides/tools-web-search) without granting full network access to spawned commands. Codex defaults to using a web search cache to access results. The cache is an OpenAI-maintained index of web results, so cached mode returns pre-indexed results instead of fetching live pages. This reduces exposure to prompt injection from arbitrary live content, but you should still treat web results as untrusted. If you are using `--yolo` or another [full access sandbox setting](#common-sandbox-and-approval-combinations), web search defaults to live results. Use `--search` or set `web_search = "live"` to allow live browsing, or set it to `"disabled"` to turn the tool off:8842You can also control the [web search tool](https://platform.openai.com/docs/guides/tools-web-search) without granting full network access to spawned commands. Codex defaults to using a web search cache to access results. The cache is an OpenAI-maintained index of web results, so cached mode returns pre-indexed results instead of fetching live pages. This reduces exposure to prompt injection from arbitrary live content, but you should still treat web results as untrusted. If you are using `--yolo` or another [full access sandbox setting](#common-sandbox-and-approval-combinations), web search defaults to live results. Use `--search` or set `web_search = "live"` to allow live browsing, or set it to `"disabled"` to turn the tool off:

8804 8843 

8805```toml8844```toml

9528rules, which define what commands can read or write, with network rules, which9567rules, which define what commands can read or write, with network rules, which

9529define which destinations commands can reach.9568define which destinations commands can reach.

9530 9569 

9570A profile's `network.enabled = true` permits command network access, but it

9571does not start the network proxy. To enforce profile domain rules, also set

9572`features.network_proxy = true` in `config.toml`, or use enabled,

9573administrator-managed `[experimental_network]` requirements. Without an active

9574proxy, profile domain rules do not restrict direct network access.

9575 

9531Use profiles to give Codex enough access for the current chat without granting9576Use profiles to give Codex enough access for the current chat without granting

9532broad access to your machine or network. For example, a read-only profile can9577broad access to your machine or network. For example, a read-only profile can

9533let Codex inspect a project without editing it, while a write-capable profile9578let Codex inspect a project without editing it, while a write-capable profile

9593```toml9638```toml

9594default_permissions = "project-edit"9639default_permissions = "project-edit"

9595 9640 

9641[features]

9642network_proxy = true

9643 

9596[permissions.project-edit.workspace_roots]9644[permissions.project-edit.workspace_roots]

9597"~/code/app" = true9645"~/code/app" = true

9598"~/code/shared-lib" = true9646"~/code/shared-lib" = true

9641```toml9689```toml

9642default_permissions = "project-edit"9690default_permissions = "project-edit"

9643 9691 

9692[features]

9693network_proxy = true

9694 

9644[permissions.project-edit]9695[permissions.project-edit]

9645description = "Project editing with OpenAI API access."9696description = "Project editing with OpenAI API access."

9646extends = ":workspace"9697extends = ":workspace"

9675| `permissions..filesystem.glob_scan_max_depth` | Number | None | Limits deny-read glob expansion on Linux, WSL, and native Windows when Codex snapshots matches before sandbox startup. Larger values can increase startup scanning work. Use a value of at least `1` when an unbounded `**` pattern needs bounded pre-expansion. |9726| `permissions..filesystem.glob_scan_max_depth` | Number | None | Limits deny-read glob expansion on Linux, WSL, and native Windows when Codex snapshots matches before sandbox startup. Larger values can increase startup scanning work. Use a value of at least `1` when an unbounded `**` pattern needs bounded pre-expansion. |

9676| `[permissions..filesystem].""` | `read`, `write`, or `deny` | None | Grants direct access for a supported path. `deny` denies access and wins over equally specific `write` or `read` entries. Codex rejects direct write rules that the active runtime cannot enforce. |9727| `[permissions..filesystem].""` | `read`, `write`, or `deny` | None | Grants direct access for a supported path. `deny` denies access and wins over equally specific `write` or `read` entries. Codex rejects direct write rules that the active runtime cannot enforce. |

9677| `[permissions..filesystem.""].""` | `read`, `write`, or `deny` | None | Grants access to a descendant of ``. Use `.`for the base path. Other subpaths must be relative descendants and cannot contain`.`or`..` components. |9728| `[permissions..filesystem.""].""` | `read`, `write`, or `deny` | None | Grants access to a descendant of ``. Use `.`for the base path. Other subpaths must be relative descendants and cannot contain`.`or`..` components. |

9678| `[permissions..network]` | Table | None | Configures the network sandbox proxy and the sandbox network policy for the profile. |9729| `[permissions..network]` | Table | None | Configures command network access and the policy that an active network proxy enforces. Enable `features.network_proxy` unless administrator-managed network requirements start the proxy. |

9679| `permissions..network.enabled` | Boolean | `false` | Enables network access for sandboxed commands in the profile. This changes the sandbox network policy; it does not start the network proxy by itself. |9730| `permissions..network.enabled` | Boolean | `false` | Enables network access for commands in the profile. It does not start the network proxy; without an active proxy, commands can connect directly without domain restrictions. |

9680| `[permissions..network.domains]` | Table | None | Maps host patterns to `allow` or `deny`. If there are no `allow` entries, domain requests are blocked. Deny entries override allow entries. |9731| `[permissions..network.domains]` | Table | None | Maps host patterns to `allow` or `deny`. Rules apply only when the network proxy is active. The active proxy blocks domain requests if there are no `allow` entries, and deny entries override allow entries. |

9681| `permissions..network.domains.""` | `allow` or `deny` | None | Supports exact hosts, `*.example.com` for subdomains, `**.example.com` for apex plus subdomains, and `*` as an allow-only global wildcard. Host patterns are normalized by trimming, lowercasing, stripping a trailing dot, and stripping simple ports or brackets. |9732| `permissions..network.domains.""` | `allow` or `deny` | None | Supports exact hosts, `*.example.com` for subdomains, `**.example.com` for apex plus subdomains, and `*` as an allow-only global wildcard. Host patterns are normalized by trimming, lowercasing, stripping a trailing dot, and stripping simple ports or brackets. |

9682| `[permissions..network.unix_sockets]` | Table | None | Maps Unix socket allowlist overrides. Use only for local integrations such as Docker. |9733| `[permissions..network.unix_sockets]` | Table | None | Maps Unix socket allowlist overrides. Use only for local integrations such as Docker. |

9683| `permissions..network.unix_sockets.""` | `allow` or `deny` | None | Adds an absolute Unix socket path to the effective allowlist with `allow`, or rejects it with `deny`. Denied entries are omitted from the effective allowlist. |9734| `permissions..network.unix_sockets.""` | `allow` or `deny` | None | Adds an absolute Unix socket path to the effective allowlist with `allow`, or rejects it with `deny`. Denied entries are omitted from the effective allowlist. |

9823 9874 

9824#### Network permissions9875#### Network permissions

9825 9876 

9826Set `enabled = true` to allow network access for the selected profile:9877Network access and network filtering are separate settings. Set

9878`permissions..network.enabled = true` to let commands access the network,

9879and enable `features.network_proxy` to enforce the profile's domain rules:

9827 9880 

9828```toml9881```toml

9882[features]

9883network_proxy = true

9884 

9829[permissions.project-edit.network]9885[permissions.project-edit.network]

9830enabled = true9886enabled = true

9831```

9832 

9833When network access is enabled, Codex uses full network behavior by default.

9834Most profiles should also define domain rules:

9835 9887 

9836```toml

9837[permissions.project-edit.network.domains]9888[permissions.project-edit.network.domains]

9838"example.com" = "allow" # exact host9889"example.com" = "allow" # exact host

9839"*.example.com" = "allow" # subdomains only9890"*.example.com" = "allow" # subdomains only

9841"ads.example.com" = "deny" # deny wins over allow9892"ads.example.com" = "deny" # deny wins over allow

9842```9893```

9843 9894 

9844The network sandbox proxy binds to local listeners by default:9895The resulting behavior depends on both settings:

9896 

9897- Network off: Commands cannot access the network, regardless of the proxy

9898 feature.

9899- Network on, proxy off: Commands have direct, unrestricted network

9900 access. Domain rules in the permission profile are not enforced.

9901- Network on, proxy on: Commands use the proxy, which enforces the profile's

9902 domain rules. If the active proxy has no allowed domains, it blocks external

9903 destinations.

9904 

9905Adding `[permissions..network.domains]` or setting

9906`permissions..network.enabled = true` does not enable

9907`features.network_proxy`. As an alternative, administrators can enable the

9908proxy with `[experimental_network]` in `requirements.toml`. See

9909[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-network-access-requirements).

9910 

9911When active, the network sandbox proxy binds to local listeners by default:

9845 9912 

9846```toml9913```toml

9847[permissions.project-edit.network]9914[permissions.project-edit.network]

9858 9925 

9859#### Local and private networks9926#### Local and private networks

9860 9927 

9861Codex applies a local/private-network guard by default as a defense against DNS9928When the network proxy is active, Codex applies a local/private-network guard by

9862rebinding and accidental access to local services. To intentionally allow a9929default as a defense against DNS rebinding and accidental access to local

9863literal local target, allowlist the exact host or IP literal:9930services. To intentionally allow a literal local target, allowlist the exact

9931host or IP literal:

9864 9932 

9865```toml9933```toml

9866[permissions.project-edit.network.domains]9934[permissions.project-edit.network.domains]

9922 9990 

9923Permission profiles define the boundaries for local sandboxed command9991Permission profiles define the boundaries for local sandboxed command

9924execution. Use them together with approval policies and the separate controls9992execution. Use them together with approval policies and the separate controls

9925for connectors, MCP servers, the built-in browser, Computer Use, and Codex cloud.9993for web search, connectors, MCP servers, the built-in browser, Computer Use,

9994and Codex cloud.

9926 9995 

9927#### What profiles control9996#### What profiles control

9928 9997 

9935 files, and shared directories as sensitive because later tools or users can10004 files, and shared directories as sensitive because later tools or users can

9936 execute those files outside the original sandbox context.10005 execute those files outside the original sandbox context.

9937- **Outbound destinations:** Network domain rules constrain where sandboxed10006- **Outbound destinations:** Network domain rules constrain where sandboxed

9938 command traffic can go through the network proxy. They do not determine10007 command traffic can go only while the network proxy is active. They do not

9939 whether an allowed destination is trustworthy, and wildcard allow rules stay10008 determine whether an allowed destination is trustworthy, and wildcard allow

9940 broad.10009 rules stay broad.

9941- **Local services:** Local and private network targets are blocked by default.10010- **Local services:** An active network proxy blocks local and private network

9942 Allowlisting `localhost`, private IPs, Unix sockets, or setting10011 targets by default. Allowlisting `localhost`, private IPs, Unix sockets, or setting

9943 `allow_local_binding = true` explicitly opens access to local services.10012 `allow_local_binding = true` explicitly opens access to local services.

9944 10013 

10014#### What the network proxy does not control

10015 

10016The network proxy only filters traffic from local commands that run inside the

10017sandbox. It does not apply the profile's domain allowlist to:

10018 

10019- **Web search:** The hosted search tool uses its own access settings. Use

10020 `web_search` and, for managed clients, `allowed_web_search_modes` to control

10021 it. `tools.web_search.allowed_domains` filters search results, not command

10022 network access.

10023- **Apps and connectors:** Connector-backed tools use their own service-side

10024 connections, workspace permissions, and app or tool settings.

10025- **MCP servers:** Local and remote MCP servers use their own process or

10026 transport. Control them with `mcp_servers` configuration and managed server

10027 allowlists.

10028- **Browser and Computer Use:** Browser navigation and computer-use actions

10029 use their own feature and approval controls.

10030- **Codex service traffic:** Model, authentication, and other client service

10031 requests use the client's separate HTTP and system-proxy settings.

10032- **Codex cloud:** These tasks use their environment's own

10033 [internet access settings](https://learn.chatgpt.com/docs/cloud/internet-access).

10034 

10035To limit these surfaces, configure each capability directly. A command network

10036allowlist is not a global network policy for every action Codex can perform.

10037 

9945#### How enforcement works10038#### How enforcement works

9946 10039 

9947- On macOS, Codex uses Seatbelt sandbox profiles. If the selected policy cannot10040- On macOS, Codex uses Seatbelt sandbox profiles. If the selected policy cannot

9973```toml10066```toml

9974default_permissions = "readonly-net"10067default_permissions = "readonly-net"

9975 10068 

10069[features]

10070network_proxy = true

10071 

9976[permissions.readonly-net.filesystem]10072[permissions.readonly-net.filesystem]

9977":minimal" = "read"10073":minimal" = "read"

9978 10074 

10034```toml10130```toml

10035default_permissions = "workspace-net"10131default_permissions = "workspace-net"

10036 10132 

10133[features]

10134network_proxy = true

10135 

10037[permissions.workspace-net.filesystem]10136[permissions.workspace-net.filesystem]

10038":minimal" = "read"10137":minimal" = "read"

10039 10138 

10096approvals_reviewer = "auto_review"10195approvals_reviewer = "auto_review"

10097default_permissions = "cyber-lab"10196default_permissions = "cyber-lab"

10098 10197 

10198[features]

10199network_proxy = true

10200 

10099[permissions.cyber-lab]10201[permissions.cyber-lab]

10100description = "Limit security testing to the approved lab and workspace."10202description = "Limit security testing to the approved lab and workspace."

10101extends = ":workspace"10203extends = ":workspace"

10116"lab.example.com" = "allow"10218"lab.example.com" = "allow"

10117```10219```

10118 10220 

10221The `network_proxy` feature enforces the approved domain. Without it,

10222`network.enabled = true` permits direct network access and the lab allowlist

10223does not restrict destinations. Web search, apps, connectors, MCP servers,

10224browser activity, and Codex cloud use separate controls; restrict or turn off

10225each surface that your approved workflow does not require.

10226 

10119Replace `lab.example.com` with an approved target. The bounded filesystem scan is designed to avoid searching the entire workspace on Linux, WSL, and Windows; increase the depth or use exact deny paths if sensitive files appear deeper. Don't combine permission profiles with legacy `sandbox_mode` settings; follow the [permission-profile configuration guidance](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).10227Replace `lab.example.com` with an approved target. The bounded filesystem scan is designed to avoid searching the entire workspace on Linux, WSL, and Windows; increase the depth or use exact deny paths if sensitive files appear deeper. Don't combine permission profiles with legacy `sandbox_mode` settings; follow the [permission-profile configuration guidance](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).

10120 10228 

10121If the approved lab host resolves to a private address, Codex blocks it by default even when the host is on the allowlist. Set `allow_local_binding = true` only for explicitly approved private-network work, keep the destination allowlist narrow, and review the [local and private network guidance](https://learn.chatgpt.com/docs/permissions#local-and-private-networks). You can also allowlist the exact approved private IP address.10229If the approved lab host resolves to a private address, Codex blocks it by default even when the host is on the allowlist. Set `allow_local_binding = true` only for explicitly approved private-network work, keep the destination allowlist narrow, and review the [local and private network guidance](https://learn.chatgpt.com/docs/permissions#local-and-private-networks). You can also allowlist the exact approved private IP address.

10711| `disable_paste_burst` | `boolean` | | Disable burst-paste detection in the TUI. |10819| `disable_paste_burst` | `boolean` | | Disable burst-paste detection in the TUI. |

10712| `experimental_compact_prompt_file` | `string (path)` | | Load the compaction prompt override from a file (experimental). |10820| `experimental_compact_prompt_file` | `string (path)` | | Load the compaction prompt override from a file (experimental). |

10713| `experimental_use_unified_exec_tool` | `boolean` | | Legacy name for enabling unified exec; prefer `[features].unified_exec` or `codex --enable unified_exec`. |10821| `experimental_use_unified_exec_tool` | `boolean` | | Legacy name for enabling unified exec; prefer `[features].unified_exec` or `codex --enable unified_exec`. |

10714| `features.apps` | `boolean` | | Enable app (connector) integrations (stable; on by default). |10822| `features.apps` | `boolean` | | Enable app (connector) integrations (stable; on by default). App and connector traffic is not controlled by the sandboxed-command network proxy or its domain allowlist. |

10715| `features.code_mode.direct_only_tool_namespaces` | `array` | | Tool namespaces code mode can use only through direct tool calls. |10823| `features.code_mode.direct_only_tool_namespaces` | `array` | | Tool namespaces code mode can use only through direct tool calls. |

10716| `features.code_mode.enabled` | `boolean` | | Enable code mode feature configuration. This feature is under development and off by default. |10824| `features.code_mode.enabled` | `boolean` | | Enable code mode feature configuration. This feature is under development and off by default. |

10717| `features.code_mode.excluded_tool_namespaces` | `array` | | Tool namespaces code mode excludes from nested code-mode tool guidance and executor exposure. |10825| `features.code_mode.excluded_tool_namespaces` | `array` | | Tool namespaces code mode excludes from nested code-mode tool guidance and executor exposure. |

10721| `features.hooks` | `boolean` | | Enable lifecycle hooks loaded from `hooks.json` or inline `[hooks]` config. `features.codex_hooks` is a deprecated alias. |10829| `features.hooks` | `boolean` | | Enable lifecycle hooks loaded from `hooks.json` or inline `[hooks]` config. `features.codex_hooks` is a deprecated alias. |

10722| `features.memories` | `boolean` | | Enable [Memories](https://learn.chatgpt.com/docs/customization/memories) (off by default). |10830| `features.memories` | `boolean` | | Enable [Memories](https://learn.chatgpt.com/docs/customization/memories) (off by default). |

10723| `features.multi_agent` | `boolean` | | Enable multi-agent collaboration tools (`spawn_agent`, `send_input`, `resume_agent`, `wait_agent`, and `close_agent`) (stable; on by default). |10831| `features.multi_agent` | `boolean` | | Enable multi-agent collaboration tools (`spawn_agent`, `send_input`, `resume_agent`, `wait_agent`, and `close_agent`) (stable; on by default). |

10724| `features.network_proxy` | `boolean \| table` | | Enable sandboxed networking. Use a table form when setting network policy options such as `domains` (experimental; off by default). |10832| `features.network_proxy` | `boolean \| table` | | Start the network proxy for sandboxed commands (experimental; off by default). Required to enforce permission-profile domain rules unless enabled administrator-managed `experimental_network` requirements start the proxy. Use a table when setting feature-level policy options such as `domains`. Does not filter web search, apps, MCP, or other hosted tools. |

10725| `features.network_proxy.allow_local_binding` | `boolean` | | Allow broader local/private-network access. Defaults to `false`; exact local IP literal or `localhost` allow rules can still permit specific local targets. |10833| `features.network_proxy.allow_local_binding` | `boolean` | | Allow broader local/private-network access. Defaults to `false`; exact local IP literal or `localhost` allow rules can still permit specific local targets. |

10726| `features.network_proxy.allow_upstream_proxy` | `boolean` | | Allow chaining through an upstream proxy from the environment. Defaults to `true`. |10834| `features.network_proxy.allow_upstream_proxy` | `boolean` | | Allow chaining through an upstream proxy from the environment. Defaults to `true`. |

10727| `features.network_proxy.dangerously_allow_all_unix_sockets` | `boolean` | | Permit arbitrary Unix socket destinations instead of allowlist-only access. Defaults to `false`; use only in tightly controlled environments. |10835| `features.network_proxy.dangerously_allow_all_unix_sockets` | `boolean` | | Permit arbitrary Unix socket destinations instead of allowlist-only access. Defaults to `false`; use only in tightly controlled environments. |

10729| `features.network_proxy.domains` | `map` | | Domain policy for sandboxed networking. Unset by default, which means no external destinations are allowed until you add `allow` rules. Supports exact hosts, `*.example.com` for subdomains only, `**.example.com` for apex plus subdomains, and global `*` allow rules; prefer scoped rules because `*` broadly opens public outbound access. Add `deny` rules for blocked destinations; `deny` wins on conflicts. |10837| `features.network_proxy.domains` | `map` | | Domain policy for sandboxed networking. Unset by default, which means no external destinations are allowed until you add `allow` rules. Supports exact hosts, `*.example.com` for subdomains only, `**.example.com` for apex plus subdomains, and global `*` allow rules; prefer scoped rules because `*` broadly opens public outbound access. Add `deny` rules for blocked destinations; `deny` wins on conflicts. |

10730| `features.network_proxy.enable_socks5` | `boolean` | | Expose SOCKS5 support. Defaults to `true`. |10838| `features.network_proxy.enable_socks5` | `boolean` | | Expose SOCKS5 support. Defaults to `true`. |

10731| `features.network_proxy.enable_socks5_udp` | `boolean` | | Allow UDP over SOCKS5. Defaults to `true`. |10839| `features.network_proxy.enable_socks5_udp` | `boolean` | | Allow UDP over SOCKS5. Defaults to `true`. |

10732| `features.network_proxy.enabled` | `boolean` | | Enable sandboxed networking. Defaults to `false`. |10840| `features.network_proxy.enabled` | `boolean` | | Start the sandboxed-command network proxy when command network access is enabled. Defaults to `false`; permission-profile domain rules are not enforced while the proxy is off. |

10733| `features.network_proxy.proxy_url` | `string` | | HTTP listener URL for sandboxed networking. Defaults to `"http://127.0.0.1:3128"`. |10841| `features.network_proxy.proxy_url` | `string` | | HTTP listener URL for sandboxed networking. Defaults to `"http://127.0.0.1:3128"`. |

10734| `features.network_proxy.socks_url` | `string` | | SOCKS5 listener URL. Defaults to `"http://127.0.0.1:8081"`. |10842| `features.network_proxy.socks_url` | `string` | | SOCKS5 listener URL. Defaults to `"http://127.0.0.1:8081"`. |

10735| `features.network_proxy.unix_sockets` | `map` | | Unix socket policy for sandboxed networking. Unset by default; add `allow` entries for permitted sockets. |10843| `features.network_proxy.unix_sockets` | `map` | | Unix socket policy for sandboxed networking. Unset by default; add `allow` entries for permitted sockets. |

10870| `permissions..network.allow_upstream_proxy` | `boolean` | | Allow sandboxed networking to chain through another upstream proxy. |10978| `permissions..network.allow_upstream_proxy` | `boolean` | | Allow sandboxed networking to chain through another upstream proxy. |

10871| `permissions..network.dangerously_allow_all_unix_sockets` | `boolean` | | Allow arbitrary Unix socket destinations instead of the default restricted set. Use only in tightly controlled environments. |10979| `permissions..network.dangerously_allow_all_unix_sockets` | `boolean` | | Allow arbitrary Unix socket destinations instead of the default restricted set. Use only in tightly controlled environments. |

10872| `permissions..network.dangerously_allow_non_loopback_proxy` | `boolean` | | Permit non-loopback bind addresses for sandboxed networking listeners. Enabling it can expose listeners beyond localhost. |10980| `permissions..network.dangerously_allow_non_loopback_proxy` | `boolean` | | Permit non-loopback bind addresses for sandboxed networking listeners. Enabling it can expose listeners beyond localhost. |

10873| `permissions..network.domains` | `table` | | Domain rules for sandboxed networking. Supports exact hosts, `*.example.com` for subdomains only, `**.example.com` for apex plus subdomains, and global `*` allow rules. `deny` wins on conflicts. |10981| `permissions..network.domains` | `table` | | Domain rules for sandboxed commands. Enforced only when `features.network_proxy` or enabled administrator-managed networking requirements activate the proxy. Supports exact hosts, `*.example.com`, `**.example.com`, and global `*` allow rules; `deny` wins. Does not restrict web search, apps, or MCP servers. |

10874| `permissions..network.domains.` | `allow \| deny` | | Allow or deny an exact host or scoped wildcard pattern such as `*.example.com` or `**.example.com`. |10982| `permissions..network.domains.` | `allow \| deny` | | Allow or deny an exact host or scoped wildcard pattern such as `*.example.com` or `**.example.com`. |

10875| `permissions..network.enable_socks5` | `boolean` | | Expose SOCKS5 support when this permissions profile enables sandboxed networking. |10983| `permissions..network.enable_socks5` | `boolean` | | Expose SOCKS5 support when this permissions profile enables sandboxed networking. |

10876| `permissions..network.enable_socks5_udp` | `boolean` | | Allow UDP over the SOCKS5 listener when enabled. |10984| `permissions..network.enable_socks5_udp` | `boolean` | | Allow UDP over the SOCKS5 listener when enabled. |

10877| `permissions..network.enabled` | `boolean` | | Enable network access for this named permissions profile. This changes the sandbox network policy; it does not start the network proxy by itself. |10985| `permissions..network.enabled` | `boolean` | | Enable network access for commands in this permission profile. This does not start the network proxy. Without `features.network_proxy` or enabled administrator-managed networking requirements, command network access is direct and profile domain rules are not enforced. |

10878| `permissions..network.mode` | `limited \| full` | | Network proxy mode used for subprocess traffic. |10986| `permissions..network.mode` | `limited \| full` | | Network proxy mode used for subprocess traffic. |

10879| `permissions..network.proxy_url` | `string` | | HTTP listener URL used when this permissions profile enables sandboxed networking. |10987| `permissions..network.proxy_url` | `string` | | HTTP listener URL used when this permissions profile enables sandboxed networking. |

10880| `permissions..network.socks_url` | `string` | | SOCKS5 proxy endpoint used by this permissions profile. |10988| `permissions..network.socks_url` | `string` | | SOCKS5 proxy endpoint used by this permissions profile. |

10917| `tool_suggest.disabled_tools` | `array` | | Disable suggestions for specific discoverable connectors or plugins. Each entry uses `type = "connector"` or `"plugin"` and an `id`. |11025| `tool_suggest.disabled_tools` | `array` | | Disable suggestions for specific discoverable connectors or plugins. Each entry uses `type = "connector"` or `"plugin"` and an `id`. |

10918| `tool_suggest.discoverables` | `array` | | Allow tool suggestions for additional discoverable connectors or plugins. Each entry uses `type = "connector"` or `"plugin"` and an `id`. |11026| `tool_suggest.discoverables` | `array` | | Allow tool suggestions for additional discoverable connectors or plugins. Each entry uses `type = "connector"` or `"plugin"` and an `id`. |

10919| `tools.view_image` | `boolean` | | Enable the local-image attachment tool `view_image`. |11027| `tools.view_image` | `boolean` | | Enable the local-image attachment tool `view_image`. |

10920| `tools.web_search` | `boolean \| { context_size = "low\|medium\|high", allowed_domains = [string], location = { country, region, city, timezone } }` | | Optional web search tool configuration. The legacy boolean form is still accepted, but the object form lets you set search context size, allowed domains, and approximate user location. |11028| `tools.web_search` | `boolean \| { context_size = "low\|medium\|high", allowed_domains = [string], location = { country, region, city, timezone } }` | | Optional web search tool configuration. The object form can set search context size, allowed search domains, and approximate user location. These search-domain filters are separate from sandboxed-command network domain rules and do not restrict connectors or MCP servers. |

10921| `tui` | `table` | | TUI-specific options such as enabling inline desktop notifications. |11029| `tui` | `table` | | TUI-specific options such as enabling inline desktop notifications. |

10922| `tui.alternate_screen` | `auto \| always \| never` | | Control alternate screen usage for the TUI (default: auto; auto skips it in Zellij to preserve scrollback). |11030| `tui.alternate_screen` | `auto \| always \| never` | | Control alternate screen usage for the TUI (default: auto; auto skips it in Zellij to preserve scrollback). |

10923| `tui.animations` | `boolean` | | Enable terminal animations (welcome screen, shimmer, spinner) (default: true). |11031| `tui.animations` | `boolean` | | Enable terminal animations (welcome screen, shimmer, spinner) (default: true). |

10998| `computer_use.allow_locked_computer_use` | `boolean` | | Set to `false` to prevent Computer Use from operating after a managed macOS device locks. If omitted, locked use remains unconstrained by requirements. |11106| `computer_use.allow_locked_computer_use` | `boolean` | | Set to `false` to prevent Computer Use from operating after a managed macOS device locks. If omitted, locked use remains unconstrained by requirements. |

10999| `default_permissions` | `string` | | Managed default permission profile. The profile must be allowed by `allowed_permission_profiles`. Set this explicitly for predictable behavior; if omitted, Codex defaults to `:workspace` only when both `:workspace` and `:read-only` are explicitly allowed. |11107| `default_permissions` | `string` | | Managed default permission profile. The profile must be allowed by `allowed_permission_profiles`. Set this explicitly for predictable behavior; if omitted, Codex defaults to `:workspace` only when both `:workspace` and `:read-only` are explicitly allowed. |

11000| `enforce_residency` | `string` | | Require Codex service traffic to use a supported data residency. Currently accepts `us`. |11108| `enforce_residency` | `string` | | Require Codex service traffic to use a supported data residency. Currently accepts `us`. |

11001| `experimental_network` | `table` | | Network access requirements enforced from `requirements.toml`. These constraints are separate from `features.network_proxy` and can configure sandboxed networking without the user feature flag. |11109| `experimental_network` | `table` | | Administrator-managed network requirements for sandboxed local commands, enforced from `requirements.toml`. When enabled, these requirements can start the command network proxy without `features.network_proxy`. They do not control web search, apps, MCP servers, browsers, or Codex cloud networking. |

11002| `experimental_network.allow_local_binding` | `boolean` | | Permit broader local/private-network access for sandboxed networking. Exact local IP literal or `localhost` allow rules can still permit specific local targets when this stays `false`. |11110| `experimental_network.allow_local_binding` | `boolean` | | Permit broader local/private-network access for sandboxed networking. Exact local IP literal or `localhost` allow rules can still permit specific local targets when this stays `false`. |

11003| `experimental_network.allow_upstream_proxy` | `boolean` | | Allow sandboxed networking to chain through an upstream proxy from the environment. |11111| `experimental_network.allow_upstream_proxy` | `boolean` | | Allow sandboxed networking to chain through an upstream proxy from the environment. |

11004| `experimental_network.allowed_domains` | `array` | | List-shaped administrator allow rules for sandboxed networking. Do not combine this with `experimental_network.domains`. |11112| `experimental_network.allowed_domains` | `array` | | Administrator allow rules for sandboxed-command networking while the managed network proxy is enabled. These rules do not apply to web search, apps, or MCP servers. Do not combine this with `experimental_network.domains`. |

11005| `experimental_network.dangerously_allow_all_unix_sockets` | `boolean` | | Permit arbitrary Unix socket destinations instead of allowlist-only access. Use only in tightly controlled environments. |11113| `experimental_network.dangerously_allow_all_unix_sockets` | `boolean` | | Permit arbitrary Unix socket destinations instead of allowlist-only access. Use only in tightly controlled environments. |

11006| `experimental_network.dangerously_allow_non_loopback_proxy` | `boolean` | | Permit non-loopback listener addresses for `[experimental_network]` requirements. Enabling it can expose listeners beyond localhost. |11114| `experimental_network.dangerously_allow_non_loopback_proxy` | `boolean` | | Permit non-loopback listener addresses for `[experimental_network]` requirements. Enabling it can expose listeners beyond localhost. |

11007| `experimental_network.denied_domains` | `array` | | List-shaped administrator deny rules for sandboxed networking. Do not combine this with `experimental_network.domains`. |11115| `experimental_network.denied_domains` | `array` | | List-shaped administrator deny rules for sandboxed networking. Do not combine this with `experimental_network.domains`. |

13152 13260 

13153# Enable the feature before configuring sandboxed networking rules.13261# Enable the feature before configuring sandboxed networking rules.

13154 13262 

13263# A profile's network.enabled allows direct network access; its domain rules

13264 

13265# apply only when the network proxy feature is enabled.

13266 

13267# Web search, apps, connectors, and MCP servers use separate controls.

13268 

13155# [features.network_proxy]13269# [features.network_proxy]

13156 13270 

13157# enabled = true13271# enabled = true

13400 13514 

13401# personality = true13515# personality = true

13402 13516 

13403# network_proxy = false13517# network_proxy = true # required to enforce permission-profile domain rules

13404 13518 

13405# fast_mode = true13519# fast_mode = true

13406 13520 

18825an OpenAI-maintained index instead of fetching arbitrary pages live, which18939an OpenAI-maintained index instead of fetching arbitrary pages live, which

18826lowers—but doesn't remove—prompt injection risk.18940lowers—but doesn't remove—prompt injection risk.

18827 18941 

18942Web search is a hosted tool, separate from sandboxed local command networking.

18943It does not use the permission profile's network proxy or domain allowlist, and

18944it can remain available when command network access is disabled. Configure

18945search with `web_search`, `tools.web_search.allowed_domains`, and managed

18946`allowed_web_search_modes` as appropriate. Search-domain filters do not restrict

18947local command traffic, apps, connectors, or MCP servers.

18948 

18828Use live search when your task depends on the latest information. Set18949Use live search when your task depends on the latest information. Set

18829`web_search = "live"` in `config.toml`. Set `web_search = "disabled"` to turn18950`web_search = "live"` in `config.toml`. Set `web_search = "disabled"` to turn

18830the tool off. The `"indexed"` mode permits external web access only when the18951the tool off. The `"indexed"` mode permits external web access only when the

32727information from connected sources, reason across steps, create documents,32848information from connected sources, reason across steps, create documents,

32728presentations, or analyses, and return results for review.32849presentations, or analyses, and return results for review.

32729 32850 

32730ChatGPT Work launched July 9, 2026. For Enterprise and Edu, web and mobile access is32851ChatGPT Work is available on supported web, mobile, and desktop surfaces for

32731off by default during a two-week preview. Admins can enable billable usage, and32852eligible plans and workspaces. Where supported, workspace owners or authorized

32732explicit opt-outs persist when the default changes. Desktop access remains32853admins can manage Work Cloud, Work Local, and Codex Local through distinct

32733governed separately through Codex Local permissions and managed configuration.32854permissions. For eligible Enterprise and Edu workspaces, the default workspace

32855role includes Work unless an authorized administrator turns it off. Browser and

32856network controls further restrict Work Cloud, and availability depends on role,

32857plan, workspace, and region. See

32858[ChatGPT Work and Codex](https://help.openai.com/en/articles/20001275-chatgpt-work-and-codex).

32734 32859 

32735This FAQ explains how admins manage ChatGPT Work: access and data controls,32860This FAQ explains how admins manage ChatGPT Work: access and data controls,

32736compliance and visibility, usage and spend, incident response, and rollout32861compliance and visibility, usage and spend, incident response, and rollout

32737practices.32862practices. For the hosted execution model and security boundaries, see

32863[ChatGPT Work Overview](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-overview).

32738 32864 

32739#### Core administrative controls32865#### Core administrative controls

32740 32866 

32741Administrators govern ChatGPT Work through several control layers:32867Administrators govern ChatGPT Work through these control layers:

32742 32868 

32743- **Access to the enterprise workspace:** Identity and access controls manage32869- **Access to the enterprise workspace:** Identity and access controls manage

32744 authentication and access to the workspace. Depending on the plan and32870 authentication and access to the workspace. Depending on the plan and

32745 configuration, administrator-controlled identity features can include SSO,32871 configuration, administrator-controlled identity features can include SSO,

32746 domain verification, SCIM provisioning, user lifecycle management, and32872 domain verification, SCIM provisioning, user lifecycle management, and

32747 identity-group synchronization. Users can enable account-level OpenAI MFA;32873 identity-group synchronization. SCIM and synchronized identity groups aren't

32748 enforce workspace-wide MFA through your identity provider. Manage SSO and32874 included with ChatGPT Business. Users can enable account-level OpenAI MFA.

32749 related identity settings in the32875 ChatGPT doesn't provide workspace-wide MFA enforcement; organizations that

32876 require it should enforce SSO and MFA through their identity provider. Manage

32877 SSO and related identity settings in the

32750 [Global Admin Console](https://help.openai.com/en/articles/12289294-admin-portal).32878 [Global Admin Console](https://help.openai.com/en/articles/12289294-admin-portal).

32751- **Access to ChatGPT Work within the workspace:** On web and mobile, admins use the32879 See [Multi-factor authentication](https://help.openai.com/en/articles/7967234-enabling-or-disabling-multi-factor-authentication-mfa).

32752 ChatGPT Work access control and role-based access control (RBAC) to decide who can32880- **Access to ChatGPT Work within the workspace:** Where available, Work Cloud

32753 use it. Enterprise and Edu access is off during the two-week preview;32881 governs hosted Work across supported web, mobile, and desktop surfaces. Work

32754 admins can enable it, and explicit opt-outs persist when the default changes.32882 Local governs local desktop Work, while Codex Local controls supported local

32755 Desktop access follows separate Codex Local permissions and32883 Codex access in desktop, CLI, and IDE clients. Cloud browser and network

32756 [managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration). Controls32884 settings further restrict Work Cloud. Custom role-based access control (RBAC)

32757 vary by plan and surface.32885 and available permissions depend on the plan and workspace.

32758- **Group membership:** Groups can be synchronized through SCIM and an identity32886- **Group membership:** On plans that support SCIM, synchronize groups through

32759 provider so access updates automatically as employees join the organization,32887 an identity provider so access updates as employees join the organization,

32760 change roles, or leave. See32888 change roles, or leave. See

32761 [Groups and provisioning](https://learn.chatgpt.com/docs/enterprise/groups-and-provisioning).32889 [Groups and provisioning](https://learn.chatgpt.com/docs/enterprise/groups-and-provisioning).

32762- **Workspace and member roles:** Built-in Owner, Admin, and Member roles32890- **Workspace and member roles:** Built-in Enterprise roles include Owner,

32763 determine who can administer the workspace. Custom roles and member RBAC32891 Admin, Member, and Analytics Viewer. On supported plans, custom roles and

32764 separately control end-user access to ChatGPT Work, plugins, and other capabilities.32892 member RBAC control access to ChatGPT Work, plugins, and other capabilities.

32765 See32893 Where seat types apply, members also need a seat that includes ChatGPT; a

32894 Codex-only seat doesn't grant access to Work. See

32766 [Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).32895 [Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).

32767- **Plugins and connectors:** Plugin policy governs plugin availability and32896- **Plugins and apps:** Plugin policy governs plugin availability and

32768 installation. Connector access, action controls, and approval behavior are32897 installation. App access, action controls, and approval behavior are

32769 configured separately, and Workspace Agents have additional per-agent32898 configured separately. Workspace Agents have their own controls where

32770 controls. See [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors),32899 available. See [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors),

32771 [Plugins](https://learn.chatgpt.com/docs/plugins), and the32900 [Plugins](https://learn.chatgpt.com/docs/plugins), and the

32772 [App security white paper](https://cdn.openai.com/business-guides-and-resources/app-security-whitepaper.pdf).32901 [App security white paper](https://cdn.openai.com/business-guides-and-resources/app-security-whitepaper.pdf).

32773- **Source-system permissions:** A user can access only the content and actions32902- **Source-system permissions:** A user can access only the content and actions

32774 allowed by the account or shared connection in the native application. See32903 allowed by the account or shared connection in the native application. See

32775 [Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business).32904 [Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business).

32776- **Approval and action restrictions:** For connectors that support Action control,32905- **Approval and action restrictions:** For apps that support Action control,

32777 admins can allow all actions, read-only actions, or a custom set and decide32906 admins can allow all actions, read-only actions, or a custom set and decide

32778 how newly added actions are handled. App permissions separately determine32907 how newly added actions are handled. App permissions separately determine

32779 when ChatGPT asks before using a connector.32908 when ChatGPT asks before using an app.

32780- **Credits:** ChatGPT Work and Codex share pricing, credits, and usage limits.32909- **Credits:** ChatGPT Work and Codex share pricing, credits, and usage limits.

32781 Eligible Enterprise and Edu admins can set monthly per-user limits through a32910 Eligible Enterprise and Edu admins can set monthly per-user limits through a

32782 workspace default, group defaults, and individual overrides. Users can32911 workspace default, group defaults, and individual overrides. Users can

32796 32925 

32797ChatGPT Work is governed by the identity, access, and permission controls already32926ChatGPT Work is governed by the identity, access, and permission controls already

32798established in your ChatGPT workspace. Administrators use identity management,32927established in your ChatGPT workspace. Administrators use identity management,

32799[RBAC](https://help.openai.com/en/articles/11750701-rbac), and workspace roles32928workspace roles, and, on eligible plans,

32800to determine who can use ChatGPT Work.32929[RBAC](https://help.openai.com/en/articles/11750701-rbac) to determine who can

32930use ChatGPT Work.

32801 32931 

32802Where supported, access can be synchronized with your identity provider through32932Where supported, access can be synchronized with your identity provider through

32803[SCIM](https://help.openai.com/en/articles/10011769-openai-platform-scim-integration-faq)32933[SCIM](https://help.openai.com/en/articles/10011769-openai-platform-scim-integration-faq)

32804and group synchronization. This lets you manage access and permissions centrally32934and group synchronization. This lets you manage access and permissions centrally

32805as employees join the organization, change roles, or leave.32935as employees join the organization, change roles, or leave.

32806 32936 

32807Underlying source systems continue to enforce access to enterprise data. ChatGPT Work32937Underlying source systems enforce the permissions of the account or approved

32808respects the permissions defined in connected applications, so users and agents32938shared connection used for the operation. An individual connection uses that

32809can access only files, repositories, channels, records, and actions they are32939person's source-system access. An agent-owned or shared connection can give

32810authorized to use. ChatGPT Work doesn't bypass existing access controls or grant new32940authorized agent users access through the connected account, including data or

32811permissions in connected systems.32941actions their own account couldn't access. Restrict the connection's scopes,

32942available actions, and agent audience to the intended business need. See

32943[Workspace Agent connections and permissions](https://help.openai.com/en/articles/20001143-chatgpt-workspace-agents-for-enterprise-and-business).

32812 32944 

32813#### How does ChatGPT Work access data and context?32945#### How does ChatGPT Work access data and context?

32814 32946 

32815ChatGPT Work can use the current chat, uploaded files, workspace resources, and32947ChatGPT Work can use the current chat, uploaded files, workspace resources, and

32816connected systems through plugins. Depending on enabled capabilities and32948connected systems through approved apps and, when applicable, plugins.

32817permissions, this can include documents, repositories, tickets, channels,32949Depending on enabled capabilities and permissions, this can include documents,

32818email, and calendars. Files from earlier chats or memory can be available32950repositories, tickets, channels, email, and calendars. Earlier files can be

32819when included in the current chat or project, or when applicable32951available through the current chat, supported projects, authorized Library

32820workspace and user memory controls are enabled.32952access, or enabled automatic Library references. Saved memories follow their

32953own workspace and user controls.

32821 32954 

32822Each context source keeps its own controls: users supply chat context,32955Each context source keeps its own controls: users supply chat context,

32823admins manage workspace resources, and connected systems enforce authentication32956admins manage workspace resources, and connected systems enforce authentication

32845 documents, tickets, repositories, or project-management tools.32978 documents, tickets, repositories, or project-management tools.

32846- **Share:** Send, publish, or otherwise make information available to more32979- **Share:** Send, publish, or otherwise make information available to more

32847 people, systems, or external destinations.32980 people, systems, or external destinations.

32848- **Scheduled:** Start a task at a future time or on a recurring schedule32981- **Schedule:** Start a task at a future time or on a recurring schedule

32849 without requiring a user to initiate each run.32982 without requiring a user to start each run.

32850- **Execute:** Run code, shell commands, browser automation, or other32983- **Execute:** Run code, shell commands, browser automation, or other

32851 tool-driven tasks that interact directly with external environments.32984 tool-driven tasks that interact directly with external environments.

32852 32985 

32865encryption in transit and at rest, workspace-level access controls, and32998encryption in transit and at rest, workspace-level access controls, and

32866supported audit logging.32999supported audit logging.

32867 33000 

32868Coverage for data residency, inference residency, FedRAMP, HIPAA, or a Business33001Coverage for data residency, inference residency, HIPAA, or a Business Associate

32869Associate Agreement isn't universal. Confirm current33002Agreement isn't universal. Confirm current

32870[data and inference residency guidance](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt)33003[data and inference residency guidance](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt)

32871and the customer's agreement for the features and regions in use.33004and the customer's agreement for the features and regions in use.

32872 33005 

32884 33017 

32885Data retention and deletion for ChatGPT Work are governed by the ChatGPT workspace33018Data retention and deletion for ChatGPT Work are governed by the ChatGPT workspace

32886plan, administrative settings, and the capabilities in use. Retention can vary33019plan, administrative settings, and the capabilities in use. Retention can vary

32887across the information ChatGPT Work accesses. Data stored by ChatGPT follows the33020across the information ChatGPT Work accesses. Conversations and eligible Library

32888configured workspace retention policies, while connected applications continue33021files follow their applicable workspace settings. Project files, transient

32889to manage their own data and lifecycle policies. See33022uploads, saved memories, compliance events, synchronized app data, and

33023third-party records can have separate retention and deletion rules. See

32890[Chat and file retention policies](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt).33024[Chat and file retention policies](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt).

32891 33025 

32892ChatGPT Work can create chat content, uploaded or generated files, artifacts,33026ChatGPT Work can create chat content, uploaded or generated files, artifacts,

32904#### What usage data is available to admins or owners?33038#### What usage data is available to admins or owners?

32905 33039 

32906Admins and owners can use product analytics and compliance logs for different33040Admins and owners can use product analytics and compliance logs for different

32907kinds of visibility. The Global Admin Console shows adoption and credit use by33041kinds of visibility. The Global Admin Console provides supported ChatGPT and

32908user, product, and model, including the ability to drill down across Chat, Work,33042Codex adoption and credit-usage views; available user, product, agent, and model

32909and Codex usage. The Compliance API covers all user messages and responses33043breakdowns depend on the analytics surface and workspace. For eligible

32910across Chat, Work, and Codex. See33044workspaces, the Compliance API provides covered ChatGPT conversation records,

33045including supported cloud Work activity. Coverage depends on the product,

33046surface, permissions, available endpoint, and documented event schema. See

32911[Workspace analytics](https://learn.chatgpt.com/docs/enterprise/workspace-analytics) and the33047[Workspace analytics](https://learn.chatgpt.com/docs/enterprise/workspace-analytics) and the

32912[Compliance API](https://learn.chatgpt.com/docs/enterprise/compliance-api).33048[Compliance API](https://learn.chatgpt.com/docs/enterprise/compliance-api).

32913 33049 

32914#### Are prompts, outputs, files, actions, or tool calls logged?33050#### Are prompts, outputs, files, actions, or tool calls logged?

32915 33051 

32916The Compliance Logs Platform provides user prompts and agent responses. It33052For eligible Enterprise and Edu workspaces, the Compliance Logs Platform

32917doesn't track files, actions, or tool calls.33053provides Work user prompts and agent responses.

33054[Connected app calls are separately logged](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business),

33055and eligible workspaces can access active Library files through supported

33056[Library-specific Compliance API endpoints](https://help.openai.com/en/articles/20001052-library-for-chatgpt).

33057These records don't establish a complete audit trail for every hosted file

33058operation, shell command, browser interaction, tool invocation, or approval.

33059Confirm the current event and product coverage in the authenticated Compliance

33060API documentation.

32918 33061 

32919The Compliance Logs Platform retains data for 30 days. Export records33062The Compliance Logs Platform retains data for 30 days. Export records

32920continuously to an approved electronic discovery, data loss prevention, SIEM,33063continuously to an approved electronic discovery, data loss prevention, SIEM,

32925 33068 

32926Workspace analytics, compliance logs, and connected monitoring tools help33069Workspace analytics, compliance logs, and connected monitoring tools help

32927admins review usage and investigate supported ChatGPT, Work, and Codex33070admins review usage and investigate supported ChatGPT, Work, and Codex

32928activity. Signals can include active users, messages, tool activity, agent33071activity. Depending on the selected reporting surface, signals can include

32929activity, authentication and administrative events, and credit consumption.33072active users, supported messages, app activity, agent usage, authentication or

32930Exported logs can support electronic discovery, data loss prevention, SIEM,33073administrative events, and credit consumption. Exported logs can support

32931auditing, and investigations. Detection quality depends on plan, event33074electronic discovery, data loss prevention, SIEM, auditing, and investigations.

32932coverage, attribution, freshness, and configured rules.33075Detection quality depends on plan, event coverage, attribution, freshness, and

33076configured rules.

32933 33077 

32934Signals that can warrant review include unexpected increases in usage or credit33078Signals that can warrant review include unexpected increases in usage or credit

32935consumption, unusual user or agent activity, recurring operational errors, and33079consumption, unusual user or agent activity, recurring operational errors, and

32943redacted unless `otel.log_user_prompt = true` is enabled as a separate explicit33087redacted unless `otel.log_user_prompt = true` is enabled as a separate explicit

32944opt-in. See33088opt-in. See

32945[Monitoring and telemetry](https://learn.chatgpt.com/docs/agent-approvals-security#monitoring-and-telemetry).33089[Monitoring and telemetry](https://learn.chatgpt.com/docs/agent-approvals-security#monitoring-and-telemetry).

33090This local Codex telemetry doesn't provide an OpenTelemetry export for ChatGPT

33091Work on the web.

32946 33092 

32947#### Governance33093#### Governance

32948 33094 

32953- **ChatGPT Work access controls** determine who can use ChatGPT Work on33099- **ChatGPT Work access controls** determine who can use ChatGPT Work on

32954 each surface.33100 each surface.

32955- **Workspace Agent controls** determine who can build, publish, share,33101- **Workspace Agent controls** determine who can build, publish, share,

32956 schedule, or configure reusable agents and shared connections.33102 schedule, or configure reusable agents and shared connections, where

32957- **Codex managed configuration** governs covered local runtime behavior,33103 Workspace Agents are available.

32958 including permissions, approvals, filesystem and network access, MCP servers,33104- **Codex managed configuration** governs covered local Codex runtime behavior

32959 hooks, and command rules.33105 and doesn't configure hosted ChatGPT Work.

32960 33106 

32961Managed configuration constrains supported runtime behavior. It doesn't grant33107Managed configuration constrains supported runtime behavior. It doesn't grant

32962workspace access, replace RBAC, or revoke a user's workspace access. These33108workspace access, replace RBAC, or revoke a user's workspace access. These

32964provide additional visibility within their documented product and event33110provide additional visibility within their documented product and event

32965scopes.33111scopes.

32966 33112 

32967Enterprise administrators can use33113For supported local Codex clients, enterprise administrators can apply

32968[managed requirements](https://learn.chatgpt.com/docs/enterprise/managed-configuration) to enforce33114[managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration) and

32969supported settings that users can't override while the requirements are33115[permission profiles](https://learn.chatgpt.com/docs/permissions). Those local-client controls don't

32970active. Supported policies cover approval behavior, permission profiles, web33116grant access to, or replace the workspace permissions for, hosted ChatGPT Work.

32971search, hooks, MCP servers, feature flags, command rules, and filesystem

32972access. Network requirements are experimental and should be tested on the

32973client versions and operating systems in your deployment before broad use. For

32974current Codex clients, managed

32975[permission profiles](https://learn.chatgpt.com/docs/permissions) are the preferred way to define

32976filesystem, network, and runtime access.

32977 33117 

32978#### Can access be scoped by group, role, workspace, or capability?33118#### Can access be scoped by group, role, workspace, or capability?

32979 33119 

32980Yes. ChatGPT Work capabilities can be scoped with workspace roles, identity groups,33120Yes. On eligible Enterprise and Edu plans that support custom member RBAC,

32981and administrator-defined permissions. Assign capabilities to groups based on33121ChatGPT Work capabilities can be scoped with workspace roles, identity groups,

32982business need and organizational policy instead of giving every user identical33122and administrator-defined permissions. ChatGPT Business uses applicable

32983access. See the33123workspace-level controls but doesn't include custom member RBAC or SCIM group

33124synchronization. Assign supported capabilities based on business need and

33125organizational policy. See the

32984[RBAC guide](https://help.openai.com/en/articles/11750701-rbac) and this33126[RBAC guide](https://help.openai.com/en/articles/11750701-rbac) and this

32985[RBAC walkthrough](https://vimeo.com/1207482321/d1286e4467?share=copy&fl=sv&fe=ci).33127[RBAC walkthrough](https://vimeo.com/1207482321/d1286e4467?share=copy&fl=sv&fe=ci).

32986 33128 

32987Organizations can use RBAC to determine which users can access ChatGPT Work, manage33129Where custom RBAC is available, organizations can use it to determine which

32988workspace settings, configure approved plugins, or build and publish Workspace33130users can access ChatGPT Work, manage workspace settings, configure approved

32989Agents. For eligible Enterprise and Edu workspaces, monthly usage limits can33131plugins, or use supported Workspace Agent features. For eligible Enterprise and

32990support a phased rollout through a workspace default, group defaults, and user33132Edu workspaces, monthly usage limits can support a phased rollout through a

32991overrides.33133workspace default, group defaults, and user overrides.

32992 33134 

32993Access to connected systems remains independently governed. Scope plugins, shared33135Access to connected systems remains independently governed. Scope plugins, shared

32994credentials, repositories, and write-capable actions to the minimum required33136credentials, repositories, and write-capable actions to the minimum required

32995audience using workspace permissions, plugin settings, and the source system's33137audience using workspace permissions, plugin settings, and the source system's

32996controls. For higher-trust environments, use managed policies to restrict33138controls. For supported local Codex clients, managed configuration can further

32997runtime capabilities further.33139restrict local runtime capabilities. Hosted Work follows its own workspace and

33140product-specific controls.

32998 33141 

32999#### How are runtime and network boundaries governed?33142#### How are runtime and network boundaries governed?

33000 33143 

33002connected workflow, a scheduled task, and a Codex chat can run in different33145connected workflow, a scheduled task, and a Codex chat can run in different

33003environments with different permissions, tools, and network access.33146environments with different permissions, tools, and network access.

33004 33147 

33005Govern each execution environment through its applicable controls. ChatGPT Work33148Govern each execution environment through its applicable controls. Work Cloud

33006permissions on web and mobile govern access to ChatGPT Work and supported browser or33149governs hosted Work across supported web, mobile, and desktop surfaces. Work

33007network capabilities. Search, plugins, Workspace Agents, and33150Local governs local desktop Work, and Codex Local controls supported local

33008source-system permissions remain separate controls. Desktop and Codex chats33151Codex access in desktop, CLI, and IDE clients. Browser and shell network

33009follow Codex permissions, managed configuration, MCP policy, sandboxing, and33152permissions further restrict Work Cloud. Search, apps, plugins, available

33010approval controls. These controls aren't interchangeable.33153Workspace Agents, and source-system permissions remain separate controls.

33154Applicable managed configuration and local runtime policies govern only their

33155supported local experiences. These controls aren't interchangeable.

33011 33156 

33012For Codex activity, local runs in the ChatGPT desktop app, CLI, and IDE execute33157For Codex activity, local runs in the ChatGPT desktop app, CLI, and IDE execute

33013on the user's machine with operating-system sandboxing and approval policies.33158on the user's machine with operating-system sandboxing and approval policies.

33014Codex cloud runs chats in isolated OpenAI-managed environments. Enterprise33159Codex cloud runs chats in isolated OpenAI-managed environments. For supported

33015administrators can use managed requirements to constrain permission profiles,33160local clients, enterprise administrators can use managed requirements to

33016approvals, filesystem and network access, MCP servers, hooks, command rules,33161constrain permission profiles, approvals, filesystem and network access, MCP

33017and other supported runtime behavior.33162servers, hooks, command rules, and other supported runtime behavior.

33018 33163 

33019#### Usage and cost33164#### Usage and cost

33020 33165 

33025tool use, and output size. Standard Chat usage is separate.33170tool use, and output size. Standard Chat usage is separate.

33026 33171 

33027The highest-variance patterns are often workflows that run frequently,33172The highest-variance patterns are often workflows that run frequently,

33028retrieve or process large amounts of information, call multiple tools or connectors,33173retrieve or process large amounts of information, call multiple tools or apps,

33029retry after failures, or produce large artifacts. Cost-sensitive examples33174retry after failures, or produce large artifacts. Cost-sensitive examples

33030include scheduled or recurring work, high-volume triggers, large files, broad33175include scheduled or recurring work, large files, broad

33031retrieval across enterprise sources, repeated connector calls, and Codex chats that33176retrieval across enterprise sources, repeated app calls, and Codex chats that

33032process repositories, run commands, or use cloud environments.33177process repositories, run commands, or use cloud environments. Workspace Agent

33178API triggers can also add usage where available.

33033 33179 

33034Use spend controls, usage analytics, and reporting to monitor these patterns33180Use spend controls, usage analytics, and reporting to monitor these patterns

33035over time. Review usage by the dimensions supported in the current analytics33181over time. Review usage by the dimensions supported in the current analytics

33074 33220 

33075#### How can admins stop access or activity?33221#### How can admins stop access or activity?

33076 33222 

33077Admins can need to stop users, plugins, shared credentials, workflows, schedules,33223During user removal or incident review, admins might need to stop access,

33078or Codex credentials during user removal or incident review.33224disable apps, revoke shared credentials, pause scheduled tasks, or revoke Codex

33225credentials.

33079 33226 

33080Revocation paths include:33227Revocation paths include:

33081 33228 

33082- Remove a user's workspace or group access. For SCIM-managed users, remove33229- Remove a user's workspace or group access. For SCIM-managed users, remove

33083 access at the identity provider; otherwise, a later synchronization can33230 access at the identity provider; otherwise, a later synchronization can

33084 provision the user again.33231 provision the user again.

33085- Disable or restrict the relevant plugin or connector.33232- Disable or restrict the relevant plugin or app.

33086- Revoke a shared connection, bot, or service account through its owning33233- Revoke a shared connection, bot, or service account through its owning

33087 surface. Workspace owners and admins can separately revoke Codex workspace33234 surface. Workspace owners and admins can separately revoke Codex workspace

33088 access tokens.33235 access tokens.

33089- Remove a Workspace Agent from publication or delete it through its agent owner33236- Remove a Workspace Agent from publication or delete it through its agent owner

33090 or workspace administrator.33237 or workspace administrator.

33091- Disable the relevant schedule or trigger.33238- Disable the relevant scheduled task or, where available, Workspace Agent API

33239 trigger.

33092- For Codex access, separately revoke the relevant access token, repository33240- For Codex access, separately revoke the relevant access token, repository

33093 connection, and cloud-environment access. Managed configuration isn't an33241 connection, and cloud-environment access. Managed configuration isn't an

33094 access-revocation mechanism.33242 access-revocation mechanism.

33096#### Additional resources for your teams33244#### Additional resources for your teams

33097 33245 

33098| Topic | Use this when explaining | Learn ChatGPT page |33246| Topic | Use this when explaining | Learn ChatGPT page |

33099| ------------------------ | -------------------------------------------------------------------------- | ---------------------------------------------------------------- |33247| ------------------------ | ----------------------------------------------------------------------------- | ---------------------------------------------------------------- |

33248| Work overview | How cloud execution, browser access, network policy, and data boundaries work | [ChatGPT Work Overview](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-overview) |

33100| Workspace setup and RBAC | Who can use and administer Codex | [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup) |33249| Workspace setup and RBAC | Who can use and administer Codex | [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup) |

33101| Authentication | How ChatGPT sign-in, API key sign-in, and workspace policy differ | [Authentication](https://learn.chatgpt.com/docs/auth) |33250| Authentication | How ChatGPT sign-in, API key sign-in, and workspace policy differ | [Authentication](https://learn.chatgpt.com/docs/auth) |

33102| Approvals and sandboxing | How Codex controls file, command, network, and side-effecting tool actions | [Agent approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) |33251| Approvals and sandboxing | How Codex controls file, command, network, and side-effecting tool actions | [Agent approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) |

33117 and governance expectations.33266 and governance expectations.

33118- **Review plugins and data sources.** ChatGPT Work is most useful with approved33267- **Review plugins and data sources.** ChatGPT Work is most useful with approved

33119 business context such as files, email, calendars, Slack, or CRM. Review33268 business context such as files, email, calendars, Slack, or CRM. Review

33120 enabled plugins, their audiences, and whether connector policies still match how users33269 enabled plugins, their audiences, and whether app policies still match how users

33121 should delegate work.33270 should delegate work.

33122- **Set expectations for appropriate use cases.** Position ChatGPT Work for multi-step,33271- **Set expectations for appropriate use cases.** Position ChatGPT Work for multi-step,

33123 higher-value tasks such as research, synthesis, analysis, file creation,33272 higher-value tasks such as research, synthesis, analysis, file creation,

33140 and delegated work after rollout. Use the findings to adjust access,33289 and delegated work after rollout. Use the findings to adjust access,

33141 guidance, training, and expansion.33290 guidance, training, and expansion.

33142 33291 

33292### ChatGPT Work Overview

33293 

33294Source: [ChatGPT Work Overview](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-overview.md)

33295 

33296ChatGPT Work and Codex share core execution, isolation, and permission

33297mechanisms, and fall within the same security boundaries that are part of your

33298ChatGPT Business or Enterprise agreement. The capabilities and controls

33299available to each experience depend on whether a task runs locally or in the

33300cloud, its available tools, and applicable workspace policies.

33301 

33302ChatGPT Work can complete multi-step tasks using the information, files,

33303applications, and tools available to an authorized workspace member. On the web,

33304those tasks run in the cloud, not on the member's device.

33305 

33306This overview explains the execution boundary, network and application controls,

33307data handling, and how tasks are executed securely using ChatGPT Work on the

33308web. Availability and administrative controls depend on your plan and workspace

33309configuration.

33310 

33311#### Execution isolation, files, and device access

33312 

33313The files and tools available to ChatGPT Work depend on where Work is running,

33314user permissions and admin configuration.

33315 

33316**Local Work** runs tasks through the ChatGPT desktop app on the user's device.

33317It can access local files, applications, and other resources made available to

33318it, subject to the user's permissions, applicable workspace controls, and device

33319security policies. Unlike Work on the Web, local Work can operate on resources

33320that remain on your computer without requiring you to upload files to a cloud

33321conversation.

33322 

33323**Cloud Work**, accessed via the web or mobile, runs the Codex harness in an

33324isolated environment on OpenAI-managed infrastructure. Cloud conversations can

33325be available across supported web, mobile, and desktop surfaces, and supported

33326tasks can continue while the user is away from the conversation.

33327 

33328Work on the web can't directly access files, applications, or open browser tabs

33329on the user's computer. A user can provide files by uploading them, adding them

33330to a supported project, or using an authorized connected app. The desktop

33331experience controls local file and application access through its own

33332permissions.

33333 

33334When

33335[Library](https://help.openai.com/en/articles/20001052-file-storage-and-library-in-chatgpt)

33336is available, eligible uploaded or generated files can be saved there.

33337Administrators can control whether ChatGPT automatically references saved

33338Library files. Disabling automatic references does not prevent users from

33339explicitly accessing or attaching files they are authorized to use.

33340 

33341See [Code and shell sandboxing](https://learn.chatgpt.com/docs/sandboxing?surface=web),

33342[Creating and editing documents, spreadsheets, and presentations](https://help.openai.com/en/articles/20001278-creating-and-editing-documents-spreadsheets-and-presentations-with-chatgpt-work),

33343and

33344[File storage and Library in ChatGPT](https://help.openai.com/en/articles/20001052-library-for-chatgpt).

33345 

33346#### Network access and external destinations

33347 

33348Work uses tools like code/shell execution and the cloud browser to complete

33349tasks. Each of these tools has configurable permissions.

33350 

33351- **Code and shell commands**: Public internet access depends on the applicable

33352 workspace policy and individual Work network setting. When public internet

33353 access isn't allowed, commands can still reach required destinations on a

33354 managed allowlist.

33355- **Web search**: Search has controls separate from the Work code and shell

33356 network setting.

33357 

33358When available, the individual code and shell setting appears under

33359**Settings** > **Data controls** > **Work network access**. Turning on **Allow

33360public internet access** doesn't override an applicable administrator

33361restriction. Turning it off limits code and shell commands to required

33362destinations on the managed allowlist; it doesn't disable connected apps, web

33363search, or the cloud browser.

33364 

33365Changes to the code and shell network setting take effect after the current run

33366finishes and Work refreshes its execution environment. See

33367[Code and shell sandboxing](https://learn.chatgpt.com/docs/sandboxing?surface=web) and

33368[Work access controls](https://help.openai.com/en/articles/20001275-chatgpt-work-and-codex).

33369 

33370Outgoing interaction controls are separate from

33371[workspace IP access restrictions](https://help.openai.com/en/articles/12111596-ip-allowlisting-for-chatgpt),

33372which limit incoming access to the ChatGPT workspace or Compliance API.

33373 

33374#### Cloud browser and website access

33375 

33376The

33377[Cloud Browser](https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt)

33378is one of the tools ChatGPT Work can use and is distinct from the

33379[In-app Browser](https://help.openai.com/en/articles/20001277-using-the-built-in-browser-in-the-chatgpt-desktop-app).

33380It operates remotely and uses a browser session separate from the user's local

33381browser. It can't access local tabs, extensions, browsing history, saved

33382passwords, or authenticated local sessions.

33383 

33384The cloud browser supports public, signed-out websites. It can navigate pages,

33385enter information into supported public forms, and combine relevant information

33386from an approved app with a website task. It can't accept credentials, use a

33387password manager or saved form entries, sign in to a website, or complete

33388payments. If a task requires one of those unsupported steps, it stops. Browser

33389availability depends on your plan, region, rollout, and workspace permissions.

33390For Enterprise workspaces, an administrator must enable cloud browser access in

33391addition to Work access.

33392 

33393Website access and actions have separate controls:

33394 

33395- By default, ChatGPT asks before visiting a new website. Where available, users

33396 can select **Always ask**, **Auto approve**, or **Always allow**, and allow or

33397 block individual websites. **Auto approve** applies automated risk checks.

33398 **Always allow** removes the interactive website-access review. Administrators

33399 have the same ability to limit approval settings for users (for example,

33400 disable **Always allow** workspace-wide).

33401- Allowing a website doesn't approve every action on that site. ChatGPT can

33402 request a separate confirmation before actions that could create a financial,

33403 legal, account, or other consequential commitment.

33404 

33405Users can inspect available page screenshots and browser replay in a Work

33406conversation. These user-visible records don't establish Compliance API export

33407or a complete administrator-visible execution history.

33408 

33409See

33410[Using cloud browser in ChatGPT](https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt)

33411and [Browser](https://learn.chatgpt.com/docs/browser?surface=web).

33412 

33413#### Connected applications, credentials, and permissions

33414 

33415A connected app or Plugin gives Work access only through the integration your

33416workspace allows and the permissions granted for that connection. Admins can

33417control Plugin and app availability, workspace role access, external

33418authorization, action settings, and source-system permissions within the admin

33419dashboard.

33420 

33421For Enterprise and Edu workspaces, plugins and their underlying apps are off by

33422default. For Business workspaces, plugins and apps are on by default. Making a

33423plugin available doesn't automatically enable its required app or grant access

33424to a user's account. The user must enable the plugin and authenticate before

33425ChatGPT Work can access it.

33426 

33427Where supported, administrators can restrict an app to read-only actions or an

33428approved set of actions. App permission settings can also determine whether

33429ChatGPT asks before using an app, making changes, or performing important

33430actions. Not every app supports the same action controls, and not every action

33431requires an individual human confirmation.

33432 

33433For synced apps, changes to source content or permissions can take time to

33434appear. Disconnecting an app doesn't automatically remove information already

33435saved in a conversation, generated file, or record with its own retention

33436policy.

33437 

33438See

33439[Admin controls, security, and compliance for plugins and apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business),

33440[Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors),

33441[Google Workspace administrator-managed setup](https://help.openai.com/en/articles/10929079-google-workspace-admin-managed-setup),

33442[ChatGPT apps with sync](https://help.openai.com/en/articles/10847137-chatgpt-apps-with-sync).

33443 

33444#### Privacy and data handling

33445 

33446ChatGPT Work follows the privacy, security, and data-handling policies

33447applicable to your ChatGPT workspace. Conversations, uploaded files, generated

33448files, connected applications, and browser data can have different retention and

33449deletion rules.

33450 

33451For details, see [Enterprise privacy](https://openai.com/enterprise-privacy/),

33452[Chat and file retention policies](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt),

33453[Data residency and inference residency](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt),

33454and the [ChatGPT Work Admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq).

33455 

33456#### Retention depends on the data type

33457 

33458- **Work conversations**—Follow the applicable ChatGPT workspace conversation

33459 retention and deletion settings.

33460- **Files saved to Library**—Follow the applicable file and workspace

33461 retention rules. Deleting a conversation doesn't delete files stored in

33462 Library.

33463- **Project files**—Remain with the project until its deletion, subject to the

33464 applicable deletion rules and exceptions.

33465- **Transient uploads outside Library**—For Enterprise, transient uploads can

33466 expire after 48 hours unless a different retention setting applies.

33467- **Saved memories, when enabled**—Follow separate memory controls.

33468- **Cloud browser cookies**—Remain separate from local browser data. Users can

33469 clear them from the Cloud browser settings.

33470- **Compliance Logs Platform records**—Remain available in the platform for 30

33471 days. Exported copies follow the receiving system's retention policy.

33472- **Connected application data**—Source records follow the connected

33473 application's policies. Copies saved in a chat, file, or synced index also

33474 follow the applicable OpenAI storage and retention rules.

33475 

33476Deleting a conversation, ending a Work task, clearing browser cookies, and

33477retaining compliance records are different operations. Deleting a chat removes

33478it from view and schedules permanent deletion within 30 days, subject to the

33479published security, legal, and de-identification exceptions.

33480 

33481See

33482[Chat and file retention policies](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt),

33483[Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt-faq),

33484and the

33485[OpenAI Compliance Platform](https://help.openai.com/en/articles/9261474-compliance-api-for-chatgpt-enterprise-edu-and-chatgpt-for-teachers).

33486 

33143### Compliance API and audit events33487### Compliance API and audit events

33144 33488 

33145Source: [Compliance API and audit events](https://learn.chatgpt.com/docs/enterprise/compliance-api.md)33489Source: [Compliance API and audit events](https://learn.chatgpt.com/docs/enterprise/compliance-api.md)

33936define network access requirements centrally. These requirements are separate34280define network access requirements centrally. These requirements are separate

33937from the user `features.network_proxy` toggle: they can configure sandbox34281from the user `features.network_proxy` toggle: they can configure sandbox

33938networking without that feature flag, but they don't grant command network34282networking without that feature flag, but they don't grant command network

33939access when the active sandbox keeps networking off.34283access when the active sandbox keeps networking off. Set

34284`experimental_network.enabled = true` to activate the managed proxy; an

34285allowlist alone does not make the proxy active.

33940 34286 

33941```toml34287```toml

33942experimental_network.enabled = true34288experimental_network.enabled = true

33959and DNS rebinding limitations are the same as the sandbox networking behavior34305and DNS rebinding limitations are the same as the sandbox networking behavior

33960described in [Agent approvals & security](https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation).34306described in [Agent approvals & security](https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation).

33961 34307 

34308These requirements apply only to local commands that run inside the sandbox.

34309They do not route or filter web search, apps and connectors, MCP servers,

34310browser or Computer Use activity, Codex service requests, or Codex cloud

34311traffic. Use the controls for each surface:

34312 

34313- Use `allowed_web_search_modes` to restrict web search.

34314- Use `features.apps = false` to disable app and connector integrations, and

34315 `features.plugins = false` to disable plugins where supported.

34316- Use the managed `mcp_servers` approved list to restrict MCP servers.

34317- Use feature requirements such as `browser_use`, `in_app_browser`, and

34318 `computer_use` to restrict browser and computer-use capabilities.

34319- Configure Codex cloud network access in its cloud environment settings.

34320 

34321A command domain allowlist does not replace these capability-specific

34322controls.

34323 

33962#### Pin feature flags34324#### Pin feature flags

33963 34325 

33964You can also pin [feature flags](https://learn.chatgpt.com/docs/config-file/config-basic#feature-flags) for users34326You can also pin [feature flags](https://learn.chatgpt.com/docs/config-file/config-basic#feature-flags) for users

34306 34668 

34307Source: [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors.md)34669Source: [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors.md)

34308 34670 

34309A plugin extends ChatGPT and Codex by packaging skills and optional connectors34671Plugins package reusable workflows and can include skills and apps that connect

34310so teams can distribute workflows and knowledge. The products share one34672to other tools. ChatGPT and Codex use the same public plugin directory on

34311universal plugin directory, while admins control availability and installation34673supported surfaces, while admins decide which plugins are available in their workspace.

34312for their workspace. Learn more about [plugins](https://learn.chatgpt.com/docs/plugins),34674Learn more about [plugins](https://learn.chatgpt.com/docs/plugins),

34313[skills](https://learn.chatgpt.com/docs/skills-and-plugins), and34675[skills](https://learn.chatgpt.com/docs/skills-and-plugins), and

34314[apps and connectors](https://help.openai.com/en/articles/11487775).34676[apps and connectors](https://help.openai.com/en/articles/11487775).

34315 34677 

34316When a plugin includes a connector, workspace admins must make the plugin34678A member can use a connector-backed capability only when the plugin and app are

34317available through plugin controls and configure connector access before members34679available to their role and they have access to the connected service.

34318can use the connector-backed capability.

34319 34680 

34320Plugins work in Chat and Work across ChatGPT on the web, desktop, and mobile,34681Plugins work in Chat and Work across ChatGPT on the web, desktop, and mobile,

34321in Codex in the ChatGPT desktop app, and through the Codex CLI plugin browser.34682in Codex in the ChatGPT desktop app, and through the Codex CLI plugin browser.

34322They aren't available in the IDE extension.34683They aren't available in the IDE extension.

34323 34684 

34324For the complete administration model, see34685To see how these controls fit with workspace roles and permissions, see

34325[Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).34686[Roles and workspace permissions](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions).

34326 34687 

34327#### Understand the capability chain34688#### Understand the capability chain

34328 34689 

34329Each layer has a separate scope and control surface:34690A plugin can span these control layers:

34330 34691 

34331| Layer | What it determines | Where to manage it |34692| Layer | What it determines | Where to manage it |

34332| ------------------------------------ | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |34693| ----------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |

34333| Plugin availability and installation | Whether the plugin bundle is available to the user | [Workspace settings](https://chatgpt.com/admin/settings) for supported web and desktop surfaces; the CLI plugin browser for CLI |34694| Availability | Whether the plugin bundle is available to the user | [Workspace settings](https://chatgpt.com/admin/settings) for supported web and desktop surfaces; the CLI plugin browser for CLI |

34334| Bundled skills | Which reusable instructions the installed plugin contributes | The plugin package and [Skill controls](https://learn.chatgpt.com/docs/enterprise/skills) |34695| Included skills | Which reusable instructions the installed plugin contributes | The plugin package and [Skill controls](https://learn.chatgpt.com/docs/enterprise/skills) |

34335| Connector access | Whether users can use a connector-backed capability | [Workspace apps](https://chatgpt.com/admin/ca) and [Permissions & roles](https://chatgpt.com/admin/settings) |34696| App access | Whether users can use a connector-backed capability | [Workspace apps](https://chatgpt.com/admin/ca) and [Permissions & roles](https://chatgpt.com/admin/settings) |

34336| Connector actions and permissions | Which actions users can run and when ChatGPT asks before using the connector | The connector's Action control and App permissions in [Workspace apps](https://chatgpt.com/admin/ca) |34697| Actions and permissions | Which actions users can run and when ChatGPT asks before using the connector | The connector's Action control and App permissions in [Workspace apps](https://chatgpt.com/admin/ca) |

34337| Source-system authorization | Which external data and actions the authenticated identity can access | The connected service and its identity provider |34698| Service authorization | Which external data and actions the authenticated identity can access | The connected service and its identity provider |

34338| Runtime permissions | What an agent can do after it receives data or a tool | The runtime, sandbox, and approval controls for the active surface |34699| Runtime permissions | What an agent can do after it receives data or a tool | The runtime, sandbox, and approval controls for the active surface |

34339 34700 

34340Depending on the workflow, admins can govern plugin availability, connector34701Use these layers as a two-step rollout: first make the right plugins available,

34341access, connector actions and permissions, provider authorization, and runtime34702then configure the capabilities and permissions each workflow needs.

34342policy independently.

34343 34703 

34344#### Plugin availability controls34704#### Step 1: Enable plugin availability

34345 34705 

34346Workspace plugin controls determine whether a plugin is available or installed34706For supported web and desktop surfaces, workspace plugin controls determine

34347for supported workspace roles. The Codex CLI plugin browser controls CLI34707which roles can use or install a plugin. The Codex CLI uses its own plugin

34348installation through its own path. See [Build plugins](https://developers.openai.com/plugins/build/plugins) for34708browser for installation. See

34709[Build plugins](https://developers.openai.com/plugins/build/plugins) for

34349packaging and distribution.34710packaging and distribution.

34350 34711 

34351#### Connector-backed capability controls34712#### Step 2: Manage capabilities

34713 

34714Making an app or plugin available in ChatGPT doesn't grant access to files,

34715records, or actions in the connected service. Before troubleshooting or

34716expanding access, check the member's workspace role and approved action

34717settings. Then confirm the authenticated account or shared connection has the

34718expected permissions in the connected service.

34352 34719 

34353Plugins in ChatGPT and Codex can include connectors that search, retrieve, sync,34720Plugins in ChatGPT and Codex can include connectors that search, retrieve, sync,

34354or act on external systems. Workspace admins configure plugin availability34721or act on external systems. Plugin availability and the access and actions

34355separately from the access and actions granted to each connector.34722granted to each connector are separate controls.

34356 34723 

34357Manage connector-backed capabilities from34724Manage connector-backed capabilities from

34358[Workspace apps](https://chatgpt.com/admin/ca) and34725[Workspace apps](https://chatgpt.com/admin/ca) and

34359[Permissions & roles](https://chatgpt.com/admin/settings). Available controls34726[Permissions & roles](https://chatgpt.com/admin/settings). Available controls

34360let admins:34727let admins:

34361 34728 

34362- Enable reviewed connectors and assign access by workspace role.34729- Enable apps or connectors and assign access by workspace role.

34363- For connectors that support Action control, allow read-only actions or an34730- For connectors that support Action control, allow read-only actions or an

34364 approved custom set, including how the workspace handles newly added actions.34731 approved custom set, including how the workspace handles newly added actions.

34365- Set App permissions that determine when ChatGPT asks before using a connector.34732- Set App permissions that determine when ChatGPT asks before using an app.

34366- Keep access within the scopes and permissions granted by each connected34733- Keep access within the scopes and permissions granted by each connected

34367 service and authenticated user.34734 service and authenticated user.

34368 34735 

34369For current availability and procedures, see34736For current availability and procedures, see

34370[Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118).34737[Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118).

34371 34738 

34372#### Choose a starting set of plugins34739#### Choose a focused initial set

34740 

34741Start with plugins that support a clear business need. Decide whether to make

34742each plugin available to everyone, limit it to a role or pilot group, or require

34743further review.

34744 

34745For each connected service, record the business owner, permitted data, approved

34746read or write actions, authentication method, and a support or removal contact.

34373 34747 

34374For a broad initial rollout, consider plugin categories teams use every day:34748Before enabling write actions or publishing a new connected capability, verify

34375email, calendar, and file or document systems such as Google Drive or Notion.34749its role scope and test with an account that has only the intended permissions

34376Use the [Plugins Directory](https://chatgpt.com/apps) to confirm current34750in the connected service.

34377availability and capabilities across supported ChatGPT and Codex surfaces.

34378 34751 

34379Start with read actions. Enable write actions only after reviewing the plugin's34752For a broad rollout, begin with categories teams use every day, such as email,

34380owner, each connector's requested scopes, data access, external effects, and34753calendar, and file or document systems. Use the

34381recovery path.34754[Plugins Directory](https://chatgpt.com/apps) to confirm current availability

34755and capabilities across supported ChatGPT and Codex surfaces.

34756 

34757Whatever the initial set, start with read actions. Before enabling write

34758actions, identify the plugin owner, review connector scopes and service

34759permissions, confirm data access, and document external effects and a recovery

34760path.

34382 34761 

34383#### Understand data flow and security34762#### Understand data flow and security

34384 34763 

34385When ChatGPT uses a connector-backed plugin, the connector sends a request to34764When ChatGPT uses an app or connector included with a plugin, it sends a request

34386the connected service and returns data or action results allowed by the34765to the connected service and returns data or action results allowed by the

34387authenticated user's provider permissions. Custom MCP servers expose these34766authenticated user's permissions in that service.

34388operations as tools through Model Context Protocol (MCP).34767 

34768ChatGPT handles connected app data in two ways:

34769 

34770- **Non-synced:** ChatGPT processes data from Chat and deep research transiently

34771 and doesn't index it.

34772- **Synced:** ChatGPT indexes selected connected content in advance. You can see

34773 whether an app supports sync on its plugin page.

34389 34774 

34390For non-synced connector use, ChatGPT processes data from Chat and deep34775The mode changes how ChatGPT indexes connected content; it doesn't replace

34391research transiently and doesn't index it. Connectors with sync index selected34776normal chat-retention controls. ChatGPT conversations that use apps remain

34392connected content in advance. This indexing distinction doesn't replace normal34777available through the Compliance API.

34393chat-retention controls; chats that use plugins remain available through the

34394Compliance API.

34395 34778 

34396OpenAI's current connector guidance also documents encryption in transit and at34779OpenAI's app guidance documents encryption in transit and at rest, per-user

34397rest, per-user authorization, role and action controls, restricted network34780authorization, role and action controls, restricted network access for

34398access for chats that use plugins, and no model training on information accessed34781conversations that use apps, and no model training on information accessed

34399through plugins for Business, Enterprise, and Edu customers. Review the34782through apps for Business, Enterprise, and Edu customers. When a request reaches

34400connected service's scopes, retention, and data-residency policies because those34783a connected service, that service's scopes, retention, data residency, and other

34401policies apply when a request reaches that service.34784policies also apply.

34402 34785 

34403See [app security and compliance](https://help.openai.com/en/articles/11509118)34786See [app security and compliance](https://help.openai.com/en/articles/11509118)

34404and [apps with sync](https://help.openai.com/en/articles/10847137) for the34787and [apps with sync](https://help.openai.com/en/articles/10847137) for current

34405current data-handling details. For locally configured MCP servers in the34788data-handling details. For locally configured MCP servers in the ChatGPT desktop

34406ChatGPT desktop app, Codex CLI, or IDE extension, see34789app, Codex CLI, or IDE extension, see

34407[Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp).34790[Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp).

34408 34791 

34409#### Use current procedures34792#### Use current procedures and references

34410 34793 

34411- [Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118)34794- [Admin controls, security, and compliance in apps](https://help.openai.com/en/articles/11509118)

34412- [Apps in ChatGPT](https://help.openai.com/en/articles/11487775)34795- [Apps in ChatGPT](https://help.openai.com/en/articles/11487775)

34972 35355 

34973- [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup): Plan access, assign owners, configure controls, and verify the rollout.35356- [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup): Plan access, assign owners, configure controls, and verify the rollout.

34974 35357 

35358- [ChatGPT Work Overview](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-overview): Understand hosted execution, network controls, data boundaries, and audit visibility.

35359 

34975- [ChatGPT Work admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq): Review access, data, governance, usage, and incident controls for ChatGPT Work.35360- [ChatGPT Work admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq): Review access, data, governance, usage, and incident controls for ChatGPT Work.

34976 35361 

34977#### Identity and authentication35362#### Identity and authentication

361 key: "features.apps",361 key: "features.apps",

362 type: "boolean",362 type: "boolean",

363 description:363 description:

364 "Enable app (connector) integrations (stable; on by default).",364 "Enable app (connector) integrations (stable; on by default). App and connector traffic is not controlled by the sandboxed-command network proxy or its domain allowlist.",

365 },365 },

366 {366 {

367 key: "features.hooks",367 key: "features.hooks",

738 key: "features.network_proxy",738 key: "features.network_proxy",

739 type: "boolean | table",739 type: "boolean | table",

740 description:740 description:

741 "Enable sandboxed networking. Use a table form when setting network policy options such as `domains` (experimental; off by default).",741 "Start the network proxy for sandboxed commands (experimental; off by default). Required to enforce permission-profile domain rules unless enabled administrator-managed `experimental_network` requirements start the proxy. Use a table when setting feature-level policy options such as `domains`. Does not filter web search, apps, MCP, or other hosted tools.",

742 },742 },

743 {743 {

744 key: "features.network_proxy.enabled",744 key: "features.network_proxy.enabled",

745 type: "boolean",745 type: "boolean",

746 description: "Enable sandboxed networking. Defaults to `false`.",746 description:

747 "Start the sandboxed-command network proxy when command network access is enabled. Defaults to `false`; permission-profile domain rules are not enforced while the proxy is off.",

747 },748 },

748 {749 {

749 key: "features.network_proxy.domains",750 key: "features.network_proxy.domains",

1424 key: "tools.web_search",1425 key: "tools.web_search",

1425 type: 'boolean | { context_size = "low|medium|high", allowed_domains = [string], location = { country, region, city, timezone } }',1426 type: 'boolean | { context_size = "low|medium|high", allowed_domains = [string], location = { country, region, city, timezone } }',

1426 description:1427 description:

1427 "Optional web search tool configuration. The legacy boolean form is still accepted, but the object form lets you set search context size, allowed domains, and approximate user location.",1428 "Optional web search tool configuration. The object form can set search context size, allowed search domains, and approximate user location. These search-domain filters are separate from sandboxed-command network domain rules and do not restrict connectors or MCP servers.",

1428 },1429 },

1429 {1430 {

1430 key: "tools.view_image",1431 key: "tools.view_image",

1495 key: "permissions.<name>.network.enabled",1496 key: "permissions.<name>.network.enabled",

1496 type: "boolean",1497 type: "boolean",

1497 description:1498 description:

1498 "Enable network access for this named permissions profile. This changes the sandbox network policy; it does not start the network proxy by itself.",1499 "Enable network access for commands in this permission profile. This does not start the network proxy. Without `features.network_proxy` or enabled administrator-managed networking requirements, command network access is direct and profile domain rules are not enforced.",