SpyBara
Go Premium

Documentation 2026-08-28 23:02 UTC to 2026-08-29 07:02 UTC

12 files changed +853 −35. View all changes and history on the product overview
2026
Mon 31 19:59 Sat 29 07:02 Fri 28 23:02 Thu 27 21:01 Wed 26 23:58 Tue 25 19:59 Mon 24 22:00 Fri 21 19:59 Thu 20 23:59 Wed 19 22:57 Tue 18 13:01 Mon 17 23:58 Sat 15 01:01 Fri 14 22:00 Thu 13 22:59 Wed 12 19:59 Tue 11 22:59 Mon 10 22:00 Sat 8 03:02 Fri 7 18:59 Thu 6 23:58 Wed 5 19:00 Tue 4 22:00 Mon 3 23:00 Sun 2 21:00
Details

42 href: "/codex/enterprise/chatgpt-work-cloud-security",42 href: "/codex/enterprise/chatgpt-work-cloud-security",

43 icon: "shieldCheck",43 icon: "shieldCheck",

44 },44 },

45 {

46 title: "ChatGPT Work local security",

47 description:

48 "Review local execution, device and browser access, managed policies, data handling, and audit limitations.",

49 href: "/codex/enterprise/chatgpt-work-local-security",

50 icon: "shieldCheck",

51 },

45 {52 {

46 title: "ChatGPT Work admin FAQ",53 title: "ChatGPT Work admin FAQ",

47 description:54 description:


49 href: "/codex/enterprise/work-admin-faq",56 href: "/codex/enterprise/work-admin-faq",

50 icon: "userLock",57 icon: "userLock",

51 },58 },

59 {

60 title: "ChatGPT Work: usage and cost",

61 description:

62 "Understand shared credits, billing impact, spending controls, and adoption planning.",

63 href: "/codex/enterprise/chatgpt-work-usage-and-cost",

64 icon: "dataControls",

65 },

52 ],66 ],

53 },67 },

54 {68 {


153 href: "/codex/enterprise/apps-and-connectors",167 href: "/codex/enterprise/apps-and-connectors",

154 icon: "connect",168 icon: "connect",

155 },169 },

170 {

171 title: "Plugin management",

172 description: "Import and sync workspace plugins from GitHub.",

173 href: "/codex/enterprise/plugin-management",

174 icon: "connect",

175 },

156 {176 {

157 title: "Skill controls",177 title: "Skill controls",

158 description:178 description:


174 href: "/codex/enterprise/governance",194 href: "/codex/enterprise/governance",

175 icon: "shieldCheck",195 icon: "shieldCheck",

176 },196 },

197 {

198 title: "Admin plugin",

199 description:

200 "Use the Admin plugin for permissions, approvals, and supported administrative workflows.",

201 href: "/codex/enterprise/admin-plugin",

202 icon: "tools",

203 },

177 {204 {

178 title: "Workspace analytics",205 title: "Workspace analytics",

179 description:206 description:

enterprise/admin-plugin.md +219 −0 created

Details

1# Using the Admin plugin in ChatGPT Work

2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 

5Use this guide to understand how the Admin plugin supports common administration work, prepare for a task, and try prompts for key use cases with the right approvals and context.

6 

7 

8 

9[Watch: Admin plugin in ChatGPT Work](https://www.youtube.com/watch?v=29SyCndnMZs)

10 

11## 1. Understand what the Admin plugin is for

12 

13The Admin plugin is designed to help manage settings, permissions, and controls directly inside ChatGPT Work. You describe the goal in everyday language, and the plugin gathers the right inputs, reads the current state, explains what it finds, and guides the next supported step.

14 

15### What the Admin plugin is designed to solve

16 

17- Turn an admin request into a clear workflow without requiring you to write an API request.

18- Review the current workspace state before making a decision or approving a change.

19- Show which authorized sources and fields support the answer, along with anything it could not verify.

20- Pause for review before a supported change, then read the record again to confirm the result.

21 

22The plugin uses selected admin APIs and approved connected data sources behind the scenes. It does not combine every admin system, expand your permissions, or make every API action available in ChatGPT. The system that owns the data still controls what the plugin can read or change.

23 

24### What admin APIs are designed to solve

25 

26An admin API gives software a structured way to request data or a supported action. Organizations can use the admin APIs to build internal processes or external tools. Common examples include scheduled reports, repeated work across many records, and connections to approved systems. These workflows usually require engineering, security, and governance review.

27 

28You do not need to build an API workflow to use this guide. The rest of the guide is centered on the Admin plugin. ChatGPT workspace administration and OpenAI API Platform administration also remain separate, with their own permissions and authentication requirements.

29 

30### Keep credentials private

31 

32Use only your organization’s approved connections and secret-storage systems. Never paste a real admin API key into ChatGPT, Codex, a document, or a source file.

33 

34## 2. Prepare to use the Admin plugin

35 

36Use the Admin plugin for a supported, one-time task when you want to work through the request in everyday language. Describe the goal and provide the stable IDs or approved reporting context. The plugin shows what it found or what it plans to change before you decide whether to continue.

37 

38The plugin uses only the sources, credentials, and actions authorized for that task. It does not combine every admin system or give you broader permissions. The original system remains the source of truth.

39 

40### Before you begin

41 

421. Find the admin area where the records live.

432. Gather the required inputs and approval.

443. Start with a read-only request.

454. Ask the plugin which sources and fields it used, and what it could not verify.

465. For a supported change, review the plan before you approve it. Then ask the plugin to read the record again and confirm the result.

47 

48Confirm that the plugin is available in your workspace and that you have the required permissions. The role and access use cases below reflect the plugin’s current documented scope. The plugin can review roles, feature permissions, and user or group assignments. After you confirm, it can also assign an existing role to an existing group.

49 

50The plugin cannot create roles, change a role’s permissions, or confirm access to a specific connector.

51 

52The analytics use cases need access to connected, approved data sources. ROI analysis also needs approved business or engineering results; usage records alone are not enough.

53 

54## 3. Explore key Admin plugin use cases

55 

56Pick a use case, replace each placeholder with a value from your approved request, and follow the steps in order. Start with a read-only request unless the task is a supported change that already has approval.

57 

58### List workspace roles

59 

60**Prompt to try**

61 

62```text

63List the roles in workspace {workspace_id}. Separate built-in and custom roles. For each role, explain which features it can use and show the users or groups assigned to it. Don’t make changes.

64```

65 

66**Steps**

67 

681. **Gather:** Confirm the workspace ID and that you are allowed to view this information.

692. **Run:** Ask for the read-only role list.

703. **Review:** Check the role types, feature access, and assignments.

714. **Verify:** Look into anything unexpected without making changes.

72 

73### Review one role

74 

75**Prompt to try**

76 

77```text

78Review role {role_id}. Explain its permissions in plain language, show who has it, and flag anything that looks broader than expected. Don’t edit the role.

79```

80 

81**Steps**

82 

831. **Gather:** Confirm the role ID and workspace.

842. **Run:** Request the read-only role review.

853. **Review:** Check that the permissions and assignments match what the role is supposed to do.

864. **Verify:** Write down any questions for the role owner. Remember, the plugin cannot create the role or edit its permissions.

87 

88### Understand a user’s or group’s access

89 

90**Prompt to try**

91 

92```text

93Help me understand the access for user {user_id} or group {group_id}. Show their assigned roles, explain what access those roles provide, and point out overlaps or gaps. Clearly say what you can’t verify.

94```

95 

96**Steps**

97 

981. **Gather:** Use the stable ID for the user or group.

992. **Run:** Ask the plugin to explain the access.

1003. **Review:** Check which roles are assigned and what access they provide. Note any overlaps or gaps.

1014. **Verify:** If the plugin cannot see something, mark it as unknown instead of guessing.

102 

103### Assign an existing role to a group

104 

105**Prompt to try**

106 

107```text

108Before making a change, show the current roles for group {group_id} and explain what role {role_id} would add. Confirm the recorded approver and wait for my explicit approval. After the assignment, verify the group’s updated roles.

109```

110 

111**Steps**

112 

1131. **Gather:** Confirm the group and role IDs. Check the approved request and recorded approver.

1142. **Run:** Ask the plugin to show the current roles and what would change.

1153. **Review:** Approve only if the plan matches the approved request.

1164. **Verify:** After the assignment, check the group again to confirm that the existing role was added as approved.

117 

118### Check general connector permission

119 

120**Prompt to try**

121 

122```text

123Check whether user {user_id} has general connector access through their assigned roles. Ask the plugin to show which permissions support its answer. If it can’t verify access to a specific connector, have it say so clearly.

124```

125 

126**Steps**

127 

1281. **Gather:** Confirm the user ID and your permission to review the user’s access.

1292. **Run:** Request the general permission check.

1303. **Review:** Check the assigned role and the permission used for the answer.

1314. **Verify:** Use this only as a general check. It does not prove access to a specific connector or connected item.

132 

133### Troubleshoot an approved change

134 

135**Prompt to try**

136 

137```text

138Review approved change {change_record_id}. Compare the requested result with the current workspace. If it failed, check the workspace and role first. Then confirm who owns the record, explain the issue, and suggest the safest next step.

139```

140 

141**Steps**

142 

1431. **Gather:** Confirm the approved change record and intended result.

1442. **Run:** Ask the plugin to compare the request with the current workspace.

1453. **Review:** Check the workspace and role. Next, verify the record owner.

1464. **Verify:** Use the current workspace state as the source of truth before choosing the next step.

147 

148### Optimize cost and model mix

149 

150**Prompt to try**

151 

152```text

153For {date_range} in workspace {workspace_id}, group verified token use and cost by use case. Compare models and reasoning modes using the speed and quality information available. Flag costly workflows when the data shows little evidence of value. Recommend where spending could be reduced or redirected toward work with stronger productivity or cost results. Include any approved revenue or quality signals. Estimate possible savings, explain tradeoffs, and separate verified observations from assumptions or missing inputs. Keep this read-only.

154```

155 

156**Steps**

157 

1581. **Gather:** Confirm the workspace, date range, and that cost data covers the full period. Check which approved performance or outcome fields are available.

1592. **Run:** Ask for the cost and model comparison.

1603. **Review:** Separate what the data shows from assumptions, missing inputs, and tradeoffs.

1614. **Verify:** Check possible savings with Finance and the workflow owners before acting.

162 

163### Discover usage and adoption

164 

165**Prompt to try**

166 

167```text

168Analyze workspace {workspace_id} during {date_range}. Show tasks and token use by team and business function. Group cost by use case. Summarize what teams use ChatGPT and Codex to accomplish. Include examples from Legal, Marketing, and Sales. Compare available use of skills and plugins. Only report tool calls, connected apps, and multi-tool workflows if those fields are available. Show where teams use more advanced workflows and where there may be room to expand. Rank the top {5_or_10} use cases and show whether a small group of highly active users accounts for most usage. Don’t guess about activity that is not in the data.

169```

170 

171**Steps**

172 

1731. **Gather:** Check the workspace, date range, and team mappings. Make sure user-level reporting is approved.

1742. **Run:** Ask for the usage and adoption analysis.

1753. **Review:** Check which requested fields are available. Leave missing activity out rather than guessing.

1764. **Verify:** High usage does not prove advanced use, business value, or individual performance.

177 

178### Measure business value and ROI

179 

180**Prompt to try**

181 

182```text

183For workspace {workspace_id} in {date_range}, combine verified usage and cost with approved outcomes. Estimate value by team and use case. Include approved Sales measures for productivity, revenue, and quality. Compare teams and models, as well as workflows and user segments. Rank returns against cost. Show the sources and formula. Clearly state assumptions, limits, and missing inputs. Don’t claim ChatGPT caused the outcomes. Keep this read-only.

184```

185 

186**Steps**

187 

1881. **Gather:** Check the workspace and date range, then confirm the approved outcomes. Review the formula and privacy rules.

1892. **Run:** Ask for the ROI analysis.

1903. **Review:** Check every source and assumption. Note each limit or missing input.

1914. **Verify:** Usage alone cannot prove ROI or causation. Review the result with Finance and business owners.

192 

193### Assess Codex ROI

194 

195**Prompt to try**

196 

197```text

198For workspace {workspace_id}, combine verified Codex usage and cost from {date_range} with approved engineering outcomes. Estimate ROI by team, repository, and workflow. Compare productivity and delivery speed with code quality and engineering cost. Identify workflows that show high value or use many resources. Recommend changes to the model, reasoning mode, or workflow. Explain the tradeoffs and uncertainty. Present the findings as patterns in the available data, not proof that Codex caused the outcome. Return findings only; do not make changes.

199```

200 

201**Steps**

202 

2031. **Gather:** Confirm the workspace and reporting period. Review the team and repository mappings and the approved baseline data.

2042. **Run:** Ask for the Codex ROI analysis.

2053. **Review:** Distinguish observed patterns from assumptions. Protect user and repository data.

2064. **Verify:** Review recommendations and outcome baselines with Engineering.

207 

208## 4. When an API workflow may make sense

209 

210Some organizations build their own admin processes or external tools with the APIs. This approach can support scheduled or continuous work. It can also help when a process spans many records or needs to connect to an approved internal system. This is separate from the guided Admin plugin experience.

211 

212Start with a defined admin task: identify the required inputs and permissions, review points, expected result, and how the outcome will be recorded. If your organization automates it, involve the appropriate engineering, security, and governance teams; keep credentials in approved secret storage; and test the workflow before deployment.

213 

214### Related resources

215 

216- [ChatGPT workspace Admin API reference](https://chatgpt.com/public/admin/api-reference)

217- [Administration boundaries](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions#understand-the-control-boundaries)

218- [ChatGPT workspace Analytics API](https://learn.chatgpt.com/docs/enterprise/analytics-api)

219- [ChatGPT workspace Compliance API](https://learn.chatgpt.com/docs/enterprise/compliance-api)

Details

43[Build plugins](https://developers.openai.com/plugins/build/plugins) for43[Build plugins](https://developers.openai.com/plugins/build/plugins) for

44packaging and distribution.44packaging and distribution.

45 45 

46To import workspace plugins from GitHub and keep them up to date, see

47[Plugin management](https://learn.chatgpt.com/docs/enterprise/plugin-management).

48 

46### Export the public catalog for review49### Export the public catalog for review

47 50 

48Eligible ChatGPT Enterprise workspace owners and admins can download a CSV of51Eligible ChatGPT Enterprise workspace owners and admins can download a CSV of

Details

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5ChatGPT Work runs cloud tasks in an isolated environment on OpenAI-managed5ChatGPT Work is part of your existing ChatGPT workspace and follows its

6infrastructure. This guide explains what those tasks can access, which controls6applicable privacy, security, and data-handling policies. For Business,

7administrators can apply, and how retention and auditing apply to different7Enterprise, and Edu workspaces, existing protections include encryption in

8categories of information.8transit and at rest, and OpenAI doesn't use business data to train its models by

9default.

10 

11Work Cloud also introduces hosted task execution and optional tools that can

12access connected systems or take authorized actions. Review the permissions,

13retention settings, and available audit records for the capabilities your

14organization enables.

9 15 

10Capabilities and controls depend on the workspace plan, rollout, configuration,16Capabilities and controls depend on the workspace plan, rollout, configuration,

11and connected integration. For the broader execution model, see the17and connected integration. For the broader execution model, see the


81doesn't automatically enable the underlying app, authorize an account, or87doesn't automatically enable the underlying app, authorize an account, or

82approve every action the integration can perform.88approve every action the integration can perform.

83 89 

84A task that uses an app or connector can proceed only when:90A task that uses a connected app, directly or through a plugin, can proceed

91only when:

85 92 

86- The workspace enables the app and any plugin that requires it.93- The workspace enables the app and any plugin that requires it.

87- The person has the necessary workspace or role access.94- The person has the necessary workspace or role access.

88- The connection is authorized for an individual, shared, or agent-owned95- The connection uses an authorized individual, shared, or agent-owned

89 account.96 account.

90- The connected account, approved scopes, and available app action settings97- The connected account, approved scopes, and available app action settings

91 permit the requested information or operation.98 permit the requested information or operation.


97actions**, and **Never ask**. With **Any changes**, supported reads can proceed104actions**, and **Never ask**. With **Any changes**, supported reads can proceed

98without a prompt while changes require confirmation.105without a prompt while changes require confirmation.

99 106 

100When the approval policy allows it, an authorized action, including a write,107An authorized write can run without a prompt when the configured policy allows

101can run without a prompt. This doesn't expand the app's allowed actions,108it. This doesn't expand the app's allowed actions, workspace access, or the

102workspace access, or the connected account's permissions. ChatGPT can still109connected account's permissions. ChatGPT can still block some high-risk

103block some high-risk actions.110actions.

104 111 

105Confirm the plugin and each underlying app are available in the workspace.112Confirm the plugin and each underlying app are available in the workspace.

106Review role access, connected-account authorization, and action permissions as113Review role access, connected-account authorization, and action permissions as


125## Cloud browser and network access132## Cloud browser and network access

126 133 

127The cloud browser, web search, connected apps, and code or shell networking are134The cloud browser, web search, connected apps, and code or shell networking are

128separate capabilities, and can each be configured. Restricting one doesn't135separate capabilities. Restricting one doesn't automatically disable the

129automatically disable the others.136others.

130 137 

131### Cloud browser138### Cloud browser

132 139 


136 143 

137The hosted browser doesn't inherit the user's local browser profile, open tabs,144The hosted browser doesn't inherit the user's local browser profile, open tabs,

138existing sign-ins, saved passwords, password manager, or browsing history.145existing sign-ins, saved passwords, password manager, or browsing history.

146Where supported, users can sign in separately through a secure hosted sign-in

147flow. This doesn't grant access to their local browser session.

139 148 

140Supported website interactions can include public forms and can combine149Supported website interactions can include public forms and can combine

141information from an authorized app with a website task. Where available,150information from an authorized app with a website task. Where available,


165 174 

166## Data handling and retention175## Data handling and retention

167 176 

168Business, Enterprise, and Edu workspace data is encrypted in transit and at177Work Cloud follows the applicable ChatGPT workspace privacy and security

169rest. OpenAI doesn't use an organization's business inputs or outputs to train178protections described above. See

170or improve its models by default. See

171[Enterprise privacy](https://openai.com/enterprise-privacy/).179[Enterprise privacy](https://openai.com/enterprise-privacy/).

172 180 

173Information associated with a cloud task doesn't follow one universal181Information associated with a cloud task doesn't follow one universal


229- **Browser and networking:** Assess cloud browser access and code or shell237- **Browser and networking:** Assess cloud browser access and code or shell

230 public-network access independently.238 public-network access independently.

231 239 

232Where separate **Work Cloud** and **Work Local** controls are available, enable240Enable **Work Cloud** only for approved users or groups. Where separate

233**Work Cloud** and disable **Work Local** for the intended role to permit cloud241**Work Cloud** and **Work Local** controls are available, enable **Work Cloud**

234Work without local execution. Where local Work and Codex share a control,242and disable **Work Local** for the intended role to permit cloud Work without

235review the effect on both before disabling local execution. These controls243local execution. Where local Work and Codex share a control, review the effect

236don't prevent an authorized person from intentionally uploading a file to a244on both before disabling local execution. These controls don't prevent an

237cloud task.245authorized person from intentionally uploading a file to a cloud task.

238 246 

239For supported role permissions with **Default**, **On**, and **Off** states,247For supported role permissions with **Default**, **On**, and **Off** states,

240**Default** inherits the workspace setting, **On** grants access, and an248**Default** inherits the workspace setting, **On** grants access, and **Off**

241explicit **Off** in any applicable ordinary role denies access. Some Work and249removes access through that role. If a user has multiple custom roles, another

242plugin settings use different, two-state controls. Verify each person's250role can still grant access. Some Work and plugin settings use different,

243effective access, especially when more than one role applies. See251two-state controls. Verify effective access across all assigned roles. See

244[Role-based access control](https://help.openai.com/en/articles/11750701-rbac).252[Role-based access control](https://help.openai.com/en/articles/11750701-rbac).

245 253 

246Where available, the **Work Cloud** permission applies across supported web,254Where available, the **Work Cloud** permission applies across supported web,


268exported records. See the276exported records. See the

269[OpenAI Compliance Platform](https://help.openai.com/en/articles/9261474-compliance-api-for-chatgpt-enterprise-edu-and-chatgpt-for-teachers).277[OpenAI Compliance Platform](https://help.openai.com/en/articles/9261474-compliance-api-for-chatgpt-enterprise-edu-and-chatgpt-for-teachers).

270 278 

271## Start with a restricted, useful workflow279## Start with a small pilot

272 280 

273A security team can upload a current vendor advisory, compare it with an281Choose one practical task for a small group. For example, a security team could

274authorized asset inventory, and review a draft exposure assessment before282compare an approved vendor advisory with an authorized inventory and review a

275taking action. If cloud browsing or an app connection isn't enabled, the team283draft exposure assessment before deciding what to do. If cloud browsing or

276can provide the advisory and an approved inventory extract directly.284connected apps are unavailable, provide the advisory and an approved inventory

285extract directly.

277 286 

278Start with a small group and enable only the access needed for the task. Verify287Enable only the access the task requires. Confirm connected-account

279connected-account permissions, data retention, human review points, and288permissions, retention settings, available audit records, and where a person

280available logs before expanding the rollout. For rollout planning, see the289should review the result before expanding access. For rollout planning, see the

281[Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup).290[Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup).

Details

1# ChatGPT Work local security

2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 

5ChatGPT Work can use approved files, applications, and browser sessions on a user's computer to complete local tasks. Access depends on workspace permissions, the user's existing account access, operating-system permissions, application approvals, and supported device policies.

6 

7Local capabilities depend on the supported desktop app, operating system, workspace entitlement, role permissions, device policy, and product rollout.

8 

9## Security at a glance

10 

11- Local tasks run through the ChatGPT desktop app. Opening a hosted cloud task in the same app does not make that task local.

12 

13- Available local and hosted Work controls depend on workspace configuration and rollout.

14 

15- File access, Computer Use, browsers, and connected apps use different permissions and approvals.

16 

17- A browser or application already signed in to a company system can expose the permissions of that existing account.

18 

19- Supported managed-device policies can restrict local features without replacing workspace access controls.

20 

21- Business, Enterprise, and Edu workspace data processed by covered OpenAI services is encrypted in transit and at rest and is not used to train OpenAI models by default.

22 

23- Local files, task context, browser data, connected-system records, and audit events can follow different storage and retention rules.

24 

25## Where local tasks run

26 

27Work Local accesses approved resources through the desktop app on the user's computer. Work Cloud runs on OpenAI-managed infrastructure, even when opened from the same desktop app.

28 

29Local files can remain on the device, but relevant file excerpts, prompts, screenshots, browser content, or tool results may be sent to OpenAI services to complete a task. Local execution does not mean offline or device-only model inference.

30 

31## Files and device access

32 

33A local task can work with information the user provides or makes available, including supported files, application content, browser sessions, and authorized connected systems. Access depends on the user's existing privileges and the controls governing that specific capability.

34 

35Granting local Work access does not automatically approve every application, grant administrator rights, or bypass the permissions of the account used to reach another system. An approved shared connection can have different privileges from the user's personal account.

36 

37## Computer Use and application approvals

38 

39[Computer Use](https://learn.chatgpt.com/docs/computer-use) can interact with supported desktop applications only when the capability is available, the required operating-system permissions are granted, and the user authorizes the application. Depending on the available options, approval can apply to the current session or future tasks.

40 

41On macOS, Screen Recording allows Computer Use to see application content, and Accessibility allows it to click, type, and navigate. Supported macOS tasks can run in the background. On Windows, Computer Use operates on the active, visible desktop and cannot run in the background while the user continues using that same session.

42 

43Users can stop a task at any time. Computer Use cannot approve operating-system security prompts, authenticate as an administrator, or automate terminal applications or ChatGPT itself.

44 

45### Locked devices

46 

47Supported macOS configurations can optionally allow an approved Computer Use task to continue while the Mac is locked. Availability depends on the app version, feature rollout, applicable requirements, and remote-control eligibility.

48 

49Administrators can disable locked-device operation through supported managed configuration. Windows Computer Use requires an active, unlocked desktop; macOS locked-use behavior does not establish equivalent Windows support.

50 

51## Browser sessions and existing sign-ins

52 

53Work Local does not automatically gain access to every browser or company account. Access depends on the browser used, the signed-in account, and the approvals required for that browser experience.

54 

55| Browser path | Session and security boundary |

56| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

57| [Desktop in-app browser](https://learn.chatgpt.com/docs/browser) | Uses a browser profile separate from the user's regular browser. The user can sign in within that profile, and supported website access may require approval. The built-in browser cannot automate file uploads. |

58| [Chrome extension](https://learn.chatgpt.com/docs/chrome-extension) | Can interact with existing browser tabs and accounts when the extension and website access are approved. Users can approve a site once or allow future access; browser-history and local-file access require separate review. |

59| Computer Use operating a browser | Uses a browser approved as a desktop application, including accounts already signed in to that browser. Operating-system permissions, application approval, and the existing account's permissions still apply. |

60 

61Website approval options and sensitive-action confirmations vary by browser experience. Allowing all sites reduces future approval prompts, so users should review that choice before enabling it.

62 

63A hosted cloud browser is separate from the user's local browsers and does not automatically inherit their existing sign-ins. Supported cloud workflows can request a separate, user-authorized sign-in.

64 

65## Apps, plugins, and connected accounts

66 

67A connected app can provide access to information or actions in another system. A plugin can use an app as an underlying tool. Making a plugin available does not automatically enable the required app, authorize an account, or permit every action.

68 

69Plugin and app availability depend on the workspace plan and configuration. The [ChatGPT Work overview](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-overview) describes plugins and their underlying apps as off by default for Enterprise and Edu workspaces and on by default for Business workspaces. Verify the actual settings for the relevant workspace and product experience.

70 

71Before a task uses a connected system, confirm that the workspace allows the app and any required plugin, the connection is authorized, and the connected account can access the requested information or action. Read-only settings, allowed actions, and confirmation requirements vary by integration.

72 

73Desktop-only plugins, local tools, and other locally provided capabilities can follow different installation or approval paths. Do not assume that every local tool uses the same administrative approval process.

74 

75### Personal and shared connections

76 

77A personal connection uses the connected user's permissions in the source system. A shared or agent-owned connection uses the connected account's permissions, which can be broader than the user's own access.

78 

79Limit shared accounts to the necessary data and actions, restrict who can use them, and apply supported action or confirmation controls. Records in the connected system remain subject to that system's permissions and retention policies.

80 

81## Administrator access and managed-device policies

82 

83Review the Work controls available in **Workspace settings** > **Permissions & roles**. Whether local and hosted Work appear as distinct permissions depends on the workspace configuration and rollout. For additional guidance, see the [Work administrator FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq).

84 

85Enable only the execution environments approved for each user or group, and verify effective access after making changes.

86 

87Workspace permissions determine who can use Work. Administrators can also restrict supported desktop capabilities through enforced requirements defined in `requirements.toml`. Depending on the deployment, these requirements can be delivered through workspace-managed configuration, a system-level configuration file, or supported macOS mobile device management tools.

88 

89Enforced requirements cannot be overridden by individual users. Managed defaults, by contrast, establish initial settings that users may be able to change. Neither replaces workspace roles or operating-system permissions.

90 

91| Managed setting | Security purpose |

92| ----------------------------------------------------- | ---------------------------------------------------------------------------- |

93| `features.computer_use = false` | Disable supported Computer Use capabilities. |

94| `allow_appshots = false` | Prevent supported Appshot capture. |

95| `features.in_app_browser = false` | Disable the desktop app's built-in browser. |

96| `features.browser_use = false` | Disable supported browser automation; review other browser paths separately. |

97| `features.apps = false` or `features.plugins = false` | Restrict supported connected applications or plugins. |

98| `computer_use.allow_locked_computer_use = false` | Prevent supported Computer Use while a Mac is locked. |

99 

100Available settings and delivery methods depend on the client, operating system, workspace, and deployment configuration. Validate restrictions on a representative managed device. For supported policy settings, configuration examples, and MDM setup instructions, see [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration).

101 

102## Local networking and private resources

103 

104A task can reach company information through paths such as a device browser, an approved desktop application, or a connected app. Existing device, proxy, VPN, source-system, and endpoint controls may apply differently to each path.

105 

106Access to a corporate VPN does not automatically authorize every tool to use every internal resource. Likewise, a cloud Work browser or cloud-network control is not a universal restriction on local device networking. Review the actual connection, identity, destination, and action required by the workflow.

107 

108## Data handling and retention

109 

110Apply your organization's endpoint, file-access, proxy, and data-loss-prevention controls to the specific device and workflow. Confirm whether those controls can prevent sensitive information from entering the task before processing. Audit logs and compliance exports help with monitoring and investigation but do not block processing on their own.

111 

112Storage and retention depend on the information category and where it is saved.

113 

114| Information category | What to review |

115| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

116| Local conversation records | How the desktop experience stores, deletes, backs up, or shares local records. Do not assume hosted-conversation retention settings apply to every local artifact. |

117| Local files and generated outputs | Device storage, endpoint policy, user-authorized uploads, external sharing, and any separately saved copies. |

118| Prompts, file excerpts, and application context | Content supplied to a model or service, applicable workspace terms, and the workflow's actual data flow. |

119| Voice and Appshots | Microphone input, frontmost-window screenshots, accessible application text, local session storage, and any content sent as task context. |

120| Browser data | The browser profile involved, existing sign-ins, browsing history, downloads, website approvals, and any separately stored task content. |

121| Connected-system records | Source-system permissions and retention, connected-account identity, and any information separately saved to the conversation or another destination. |

122| Compliance and activity records | Which Work Local events are available for the workspace, the supported integration, and the receiving system's retention policy. |

123 

124For supported Business, Enterprise, and Edu workspaces, business data processed by covered OpenAI services is encrypted in transit and at rest and is not used to train or improve OpenAI models by default. These protections do not mean OpenAI governs every device file, third-party application, browser profile, or source-system record.

125 

126Do not apply a hosted-conversation, temporary-upload, or compliance-log retention period to local records without confirming that it applies to the specific data category.

127 

128## Audit and compliance visibility

129 

130Available reporting depends on the workspace plan, product experience, event, connected application, and deployed configuration. Verify Work Local coverage before relying on a workspace export for incident response or regulatory review.

131 

132Determine whether the relevant systems record the task identity, supported prompts and responses, connected-app calls, browser approvals, application actions, local file activity, or endpoint events. Source-system and device records can provide different visibility from ChatGPT workspace records.

133 

134OpenAI does not store a separate complete record of Chrome actions performed through the extension. Do not assume that every local file operation, screenshot, browser action, approval, or external update appears in the Compliance API.

135 

136## Start with one approved task

137 

138Start with a small group on managed devices and choose one approved task, such as comparing selected finance workbooks. Confirm each user's Work access and provide only the files, applications, browser sessions, or connected accounts the task requires.

139 

140Check that approved actions work, restricted actions are blocked, and available records meet your monitoring needs. Have a user review the results and any external changes before expanding access.

Details

21browser and network settings, retention, and audit visibility, see21browser and network settings, retention, and audit visibility, see

22[ChatGPT Work cloud security](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-security).22[ChatGPT Work cloud security](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-security).

23 23 

24For device access, local browser sessions, managed policies, and local data

25handling, see

26[ChatGPT Work local security](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-local-security).

27 

24## Execution isolation, files, and device access28## Execution isolation, files, and device access

25 29 

26The files and tools available to ChatGPT Work depend on where Work is running,30The files and tools available to ChatGPT Work depend on where Work is running,

Details

1# ChatGPT Work: usage and cost

2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 

5ChatGPT Work helps employees complete multi-step tasks, such as researching a

6topic, analyzing information, or creating a finished document or presentation.

7Completing these tasks can require additional reasoning, tools, and processing,

8which may consume credits. Whether that usage affects your invoice depends on

9your remaining credits, contracted rates, and workspace overage settings.

10 

11Use this guide to understand how Work affects usage, plan employee adoption,

12and apply the spending controls available to your organization.

13 

14## Usage and cost at a glance

15 

16- For eligible credit-based agreements, Work activity draws from a shared pool

17 of workspace credits.

18- Consuming committed credits differs from incurring new invoiced

19 charges.

20- Employees can use both Chat and Work; evaluate their combined eligible usage

21 when estimating adoption.

22- Role-based estimates support planning but aren't fixed per-user prices or

23 guaranteed billing amounts.

24- User usage limits and workspace overage limits are separate controls. Alerts

25 provide notice but don't stop spending.

26- Assess a rollout using your organization's observed usage and measurable

27 workflow outcomes.

28 

29## Why Work uses credits

30 

31For organizations with credit-based agreements, eligible Work activity consumes

32credits from the shared workspace allocation. Other eligible ChatGPT features

33can draw from the same allocation, so Work doesn't necessarily have a separate

34balance.

35 

36Consumption varies with:

37 

38- The model, execution environment, and applicable reasoning or speed settings.

39- The task's complexity and any eligible tools or features used—for example,

40 preparing a quarterly business review using CRM records, documents, or messages

41 from approved apps and systems the employee is authorized to access.

42- How frequently employees run tasks.

43 

44Employees don't need to stop using Chat when they start using Work. To

45understand the change in total consumption, compare the same employees'

46earlier Chat usage with their combined Chat and Work usage over a comparable

47period.

48 

49Your agreement and applicable rate card determine the credits each eligible

50activity consumes. Existing subscription or seat fees are separate from an

51estimate of credits consumed.

52 

53## When usage affects your bill

54 

55Whether eligible Work usage results in an additional charge depends on your

56agreement, remaining credits, and applicable billing settings. Using committed

57credits reduces your available balance but doesn't, by itself, create a new

58invoice charge:

59 

60- **Committed credits remain:** Eligible activity draws down the available

61 credit allocation. Using those credits doesn't, by itself, create a new charge

62 beyond your existing agreement.

63- **No credits remain and your account permits overage:** Eligible usage can

64 continue within the configured workspace overage limit and may incur charges

65 at your contracted overage rate.

66- **No credits remain and your account doesn't permit overage:** Eligible

67 features can pause until credits become available or the applicable limit

68 changes.

69 

70Overage behavior depends on both account eligibility and the configured

71workspace limit. If your agreement doesn't permit overages, eligible usage

72stops when no available credits remain. If your account permits overages, an

73unset limit can allow eligible usage beyond the credit balance. Where supported,

74an overage limit of zero prevents the workspace from continuing into overage,

75while **No limit** isn't a zero-spend cap.

76 

77Usage reports and dollar estimates are planning or monitoring tools, not issued

78invoices. Some displayed estimates use the contracted overage rate, which can

79differ from the rate for committed credits. Confirm actual charges against the

80invoice, billing period, and terms in your organization's agreement.

81 

82## Estimate usage for a role or team

83 

84A role-based estimate can help plan adoption for employees with similar

85responsibilities, such as Finance, Marketing, or Sales. Start with the

86employees and workflows your organization expects to support.

87 

88To develop an estimate:

89 

901. Identify the proposed user group and a comparable period of existing Chat

91 activity.

922. Estimate combined Chat and Work consumption using observed pilot usage or an

93 approved, relevant role-based benchmark.

943. Review the remaining committed credit balance. Apply the appropriate

95 contracted rates for committed credits and, separately, any overage.

964. Determine whether projected usage stays within available credits or could

97 reach your contracted overage terms.

985. Update the estimate using actual adoption, task mix, and observed

99 consumption.

100 

101An approved benchmark may reflect observed enterprise-customer usage and the

102actual mix of models used. Its usefulness depends on the comparison period,

103role classification, workflow, and account assumptions. A broad role-based

104estimate doesn't establish an industry-specific or task-specific benchmark.

105 

106An **annualized consumed-credit estimate** projects observed usage value across

107a year. It isn't a separate Work license price, a standard per-user charge,

108OpenAI's infrastructure cost, or a prediction that your invoice will increase

109by the same amount. Actual incremental charges depend on remaining committed

110credits, contracted pricing, permitted overages, and the billing period.

111 

112### Illustrative Marketing planning example

113 

114An observed analysis of first-time enterprise Work adopters in Marketing showed

115the following changes in annualized consumed-credit value:

116 

117- **Median:** Approximately **$53 per employee per year**.

118- **90th percentile:** Approximately **$1,154 per employee per year**.

119- **Average:** Approximately **$309 per employee per year**.

120 

121The median represents the midpoint of observed individual usage. The average is

122higher because a smaller number of employees consume more credits. The 90th

123percentile describes an observed higher-usage threshold, not a spending cap or

124maximum.

125 

126For **100 employees** with a similar mix of usage, applying the **$309

127per-employee average** represents approximately **$30,900 annually**, or

128**$2,575 per month as a planning equivalent**.

129 

130These directional estimates reflect observed enterprise-customer usage and its

131actual model mix, annualized from one week of adoption-period usage. They

132aren't guaranteed savings, fixed per-user prices, automatic bills, or

133guaranteed increases to your invoice. Actual charges depend on remaining

134committed credits, contracted rates, and permitted overages.

135 

136Your account team can help interpret approved estimates against your

137organization's agreement.

138 

139## Administrator controls and reporting

140 

141Workspace owners and administrators can use supported settings to manage access

142and eligible credit-based usage:

143 

144- **Work access:** Choose which people or groups can access Work through the

145 permissions available to your workspace.

146- **Model and speed settings:** Where available, configure the starting Work &

147 Codex model, reasoning level, speed, and Fast Mode availability in Workspace

148 settings > Models. Fast Mode can consume more credits for supported models.

149- **User usage limits:** Set supported monthly workspace defaults, group

150 limits, or individual overrides to manage each user's eligible usage.

151- **Workspace overage limit:** Control how much eligible usage can continue

152 after the shared credit allocation runs out.

153- **Usage alerts:** In Billing, configure available usage thresholds and

154 recipients where supported. Alerts notify; they don't stop spending.

155- **Credit balance and reporting:** In Billing, review remaining credits and

156 download usage reports available to your role. Where your agreement includes

157 committed credits, compare observed usage with your contracted allocation and

158 billing period to assess pacing.

159- **Invoices:** Review issued invoices and the corresponding billing period

160 when your workspace role includes invoice access.

161 

162An individual user override takes precedence over group and workspace defaults.

163When a person belongs to more than one group, the highest applicable group limit

164applies. A group without a configured limit doesn't impose a zero-credit cap.

165Check the effective limit for each pilot participant.

166 

167Usage limits don't add credits or determine who can access Work. A model

168default or employee guidance can influence consumption, but neither replaces an

169enforced usage limit or workspace overage setting.

170 

171Control availability, reporting detail, invoice access, and billing behavior

172depend on your plan, workspace configuration, and agreement. Reports might not

173reflect activity immediately; compare the report timestamp and billing period

174before reconciling usage with an invoice. For cross-product applicability and

175current setup procedures, see

176[ChatGPT usage limits and spend controls](https://learn.chatgpt.com/docs/enterprise/usage-limits).

177 

178## Measure usage alongside outcomes

179 

180Choose a recurring workflow with a clear existing baseline, such as account

181research, meeting preparation, or finance reporting. Use the access, tools,

182and model capabilities appropriate to the work rather than assuming every task

183requires the most advanced option.

184 

185During a pilot, compare the same workflow before and after you introduce Work.

186Depending on the task, your organization might measure:

187 

188- Time required to complete the work.

189- Output quality, completeness, or consistency.

190- Rework, manual coordination, or error rates.

191- Whether the team completed the intended deliverable.

192 

193Review these customer-measured outcomes alongside observed credit consumption

194and any actual billing impact. Usage alone doesn't establish savings, and

195projected time improvements aren't guaranteed financial returns.

196 

197## Start with a controlled rollout

198 

199Before expanding access:

200 

2011. Confirm your agreement, remaining credits, applicable rates, and overage

202 settings.

2032. Select a limited group and a workflow your organization can evaluate.

2043. Configure supported access permissions, user limits, alerts, and the

205 workspace overage limit.

2064. Compare combined Chat and Work consumption against the group's existing

207 baseline.

2085. Review observed outcomes and any actual billing impact before expanding the

209 rollout.

210 

211For broader access, data, governance, and rollout guidance, see the

212[ChatGPT Work admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq). For

213contract-specific pricing, credit availability, and invoicing questions,

214contact your account team.

Details

1# Plugin management

2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 

5## Before you begin

6 

7Workspace admins can import a plugin marketplace from GitHub and keep its plugins up to date from the repository. A marketplace is a JSON catalog that lists the plugins to import.

8 

9Use a GitHub account that can read the marketplace repository and any other repositories it references. Public and private GitHub repositories are supported. Complete any GitHub organization approval required for your repository access before importing.

10 

11Review the repository content before importing. New plugins start with **Available** installation and authentication on install. New marketplaces have automatic daily sync enabled. Import processes all valid entries, and future syncs automatically add any new plugins in the repository.

12 

13## Configure a marketplace sync

14 

151. Open **Admin** > **Plugins** and select **Add** > **Import marketplace**.

162. In **Source**, enter the repository URL, such as `https://github.com/example/team-plugins`. Use the repository URL only, without a branch or folder URL.

173. If the marketplace is in a subdirectory, enter that directory in **Path**. For example, use `team-tools` for `team-tools/.agents/plugins/marketplace.json`. Leave **Path** empty for the repository root. Do not enter the manifest filename.

184. Optionally enter a **Branch, tag, or commit**. Leave this empty to use the repository's default branch. Use a branch to receive future commits; a fixed commit stays at that revision.

195. Select **Import marketplace** and authorize GitHub access when prompted. The initial import can take up to an hour for very large marketplaces. Subsequent daily syncs typically take a few minutes.

206. Review **Import results**, then open each imported plugin to configure its installation policy and any required apps.

21 

22To request an update without waiting for the daily sync, open the marketplace under **Admin** > **Plugins** > **Marketplaces** and select **Sync now**.

23 

24## Supported formats

25 

26The selected directory must contain one of these files:

27 

28| File | Format |

29| ---------------------------------- | -------------------------------------------------------------------- |

30| `.agents/plugins/marketplace.json` | A Codex marketplace with a `plugins` array. |

31| `.claude-plugin/marketplace.json` | A Claude-compatible marketplace with a `plugins` array. |

32| `.claude-plugin/plugin.json` | A standalone Claude plugin, when no marketplace manifest is present. |

33 

34In a marketplace, entries can reference native plugins with `.codex-plugin/plugin.json`, Claude-compatible plugins, Agent Plugins 1.0 packages, or supported skill packages.

35 

36For a Codex marketplace, use local paths for plugins in the same repository:

37 

38```json

39{

40 "name": "team-plugins",

41 "interface": {

42 "displayName": "Team plugins"

43 },

44 "plugins": [

45 {

46 "name": "team-tools",

47 "source": {

48 "source": "local",

49 "path": "./plugins/team-tools"

50 }

51 }

52 ]

53}

54```

55 

56The path is relative to the selected marketplace root, not to `.agents/plugins/`.

57 

58A Claude-compatible marketplace can use a path string for each local plugin:

59 

60```json

61{

62 "name": "team-plugins",

63 "plugins": [

64 {

65 "name": "team-tools",

66 "source": "./plugins/team-tools"

67 }

68 ]

69}

70```

71 

72Codex marketplace entries also support `source: "url"` for a plugin at a GitHub repository root and `source: "git-subdir"` for a plugin in a GitHub subdirectory. For example:

73 

74```json

75{

76 "name": "team-tools",

77 "source": {

78 "source": "git-subdir",

79 "url": "https://github.com/example/team-tools.git",

80 "path": "./plugins/team-tools",

81 "ref": "main"

82 }

83}

84```

85 

86Git sources can select a `ref` or a full 40-character commit `sha`. The authorizing GitHub account must be able to read every referenced repository. Workspace import currently only supports GitHub repositories.

87 

88## Configure workspace access

89 

90GitHub import and sync do not apply repository installation or authentication policies, including `AVAILABLE`, `INSTALLED_BY_DEFAULT`, `NOT_AVAILABLE`, `ON_INSTALL`, and `ON_USE`. Workspace admins configure these settings for each plugin. Syncing an update or moving an existing plugin to GitHub management preserves its workspace policies.

91 

92Use **Installation policy** to choose **Available** or **Installed** for each eligible role. Required apps must also be enabled, and members must have access to the connected service. Importing a plugin does not grant app access or connect members' accounts. See [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors) for role, app, and action controls.

93 

94## Move an existing plugin to GitHub management

95 

96Add `pluginId` to the existing plugin's marketplace entry:

97 

98```json

99{

100 "name": "team-tools",

101 "pluginId": "plugin_0123456789abcdef0123456789abcdef",

102 "source": {

103 "source": "local",

104 "path": "./plugins/team-tools"

105 }

106}

107```

108 

109Open the plugin from **Admin** > **Plugins** and copy the ID after `/admin/plugins/` in its URL. Put `pluginId` beside `name` and `source` in the marketplace entry. The existing plugin must be in the same workspace.

110 

111This moves an uploaded or otherwise unmanaged workspace plugin to GitHub management. The plugin keeps its ID, sharing, and workspace policies. Future updates come from GitHub; archive uploads can no longer replace the managed plugin. A plugin already managed by another GitHub source cannot be taken over this way.

112 

113## Desktop-only plugins

114 

115Any imported plugin that declares MCP servers in `mcp.json` or `.mcp.json` is marked **Desktop only** and works only in the ChatGPT desktop app. This includes servers that use a remote HTTPS URL. The same restriction applies to other supported MCP configuration forms, such as inline server declarations.

116 

117## Reference an existing app with `.app.json`

118 

119Add `.app.json` at the plugin root. The filename includes a leading dot; `app.json` without the dot is not supported.

120 

121```json

122{

123 "apps": {

124 "team-tools": {

125 "id": "asdk_app_example",

126 "required": true

127 }

128 }

129}

130```

131 

132Replace `asdk_app_example` with the existing app's ID. Supported app IDs start with `asdk_app_`, `connector_`, or `templated_apps_`. Use the app ID, not a `plugin_...` ID. For example, a plugin URL containing `plugin_asdk_app_example` represents the app `asdk_app_example`.

133 

134The key `team-tools` names the reference within this file. Set `required` to `true` when the plugin depends on the app. You can add more entries to reference other existing apps.

135 

136For a native plugin, set `apps` to `./.app.json` in `.codex-plugin/plugin.json`. Here is a complete manifest for this example:

137 

138```json

139{

140 "name": "team-tools",

141 "version": "1.0.0",

142 "description": "Use the team's approved tools.",

143 "author": {

144 "name": "Example team"

145 },

146 "apps": "./.app.json",

147 "interface": {

148 "displayName": "Team tools",

149 "shortDescription": "Use approved team tools",

150 "longDescription": "Connect to the team's existing app.",

151 "developerName": "Example team",

152 "category": "Productivity",

153 "capabilities": ["Read"]

154 }

155}

156```

157 

158Keep the files in this layout:

159 

160```text

161team-plugins/

162├── .agents/plugins/marketplace.json

163└── plugins/team-tools/

164 ├── .codex-plugin/plugin.json

165 └── .app.json

166```

167 

168The reference does not create an app or grant permissions. Admins must make the app available to the intended roles, and members must complete any required authentication. Existing app permissions, action controls, and service access still apply.

169 

170## Keep plugins up to date

171 

172New marketplaces check for updates daily. Open **Admin** > **Plugins** > **Marketplaces**, select the marketplace, and choose **Sync now** to request an update without waiting for automatic sync.

173 

174Sync can add new marketplace entries and update existing plugins. Review changes to the repository before merging them, because automatic sync will import any new plugins.

175 

176After a sync, review the status and saved report. **Completed — N errors** means the pass finished but some plugins could not be processed. If an update to an existing plugin is invalid, its last working version is retained. Fix the reported problem in GitHub, then select **Sync now** to retry.

177 

178Removing an entry from the repository does not delete its imported workspace copy. It is marked **No longer in source**. Deleting the marketplace in ChatGPT deletes all plugins imported from it.

179 

180## Reconnect or change GitHub access

181 

182To **reconnect GitHub access**, first confirm that the GitHub account used for the import still has access to the repository and any referenced repositories. The admin who originally imported the marketplace should then open the GitHub plugin in ChatGPT and reconnect their account, since marketplace sync uses that admin’s GitHub connection.

183 

184To **transfer to a new owner**, the new workspace admin should open **Admin** > **Plugins** > **Add** > **Import marketplace** and import the same marketplace using the same **Source**, **Path**, and **Branch, tag, or commit** values. Future syncs will use their GitHub connection.

185 

186Do not delete the marketplace just to reconnect it or change ownership: deletion also removes its imported plugins.

Details

31 31 

32## Related docs32## Related docs

33 33 

34- [ChatGPT Work: usage and cost](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-usage-and-cost)

34- [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup)35- [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup)

35- [Governance](https://learn.chatgpt.com/docs/enterprise/governance)36- [Governance](https://learn.chatgpt.com/docs/enterprise/governance)

36- [Workspace analytics](https://learn.chatgpt.com/docs/enterprise/workspace-analytics)37- [Workspace analytics](https://learn.chatgpt.com/docs/enterprise/workspace-analytics)

Details

341### How does ChatGPT Work usage translate into spend over time?341### How does ChatGPT Work usage translate into spend over time?

342 342 

343[ChatGPT Work and Codex share pricing, credits, and usage limits](https://learn.chatgpt.com/docs/pricing).343[ChatGPT Work and Codex share pricing, credits, and usage limits](https://learn.chatgpt.com/docs/pricing).

344Consumption varies with the model and capability, context size, task duration,344For eligible credit-based agreements, review employees' combined Chat and Work

345tool use, and output size. Standard Chat usage is separate.345usage against the shared workspace credit allocation. Consumption varies with

346the model, applicable reasoning or speed settings, processed input and output,

347and eligible tools or features.

348 

349Using committed credits doesn't automatically increase your invoice. Actual

350charges depend on the remaining credit balance, contracted rates, account

351overage eligibility, and configured workspace overage limit. For planning

352examples, effective user limits, reporting boundaries, and billing details,

353see [ChatGPT Work: usage and cost](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-usage-and-cost).

346 354 

347The highest-variance patterns are often workflows that run frequently,355The highest-variance patterns are often workflows that run frequently,

348retrieve or process large amounts of information, call multiple tools or apps,356retrieve or process large amounts of information, call multiple tools or apps,

plugins.md +4 −0

Details

123 123 

124Use the separate **Installed** row to review plugins you already installed.124Use the separate **Installed** row to review plugins you already installed.

125 125 

126Workspace admins can import and sync a GitHub marketplace for their team. See

127[Plugin management](https://learn.chatgpt.com/docs/enterprise/plugin-management) for setup and access

128requirements.

129 

126### Install and use a plugin130### Install and use a plugin

127 131 

128Once you open the Plugins Directory:132Once you open the Plugins Directory:

Details

22products. During development, use a local marketplace to test the package22products. During development, use a local marketplace to test the package

23before submitting it to the universal directory.23before submitting it to the universal directory.

24 24 

25For workspace distribution through GitHub, see

26[Plugin management](https://learn.chatgpt.com/docs/enterprise/plugin-management).

27 

25Start with a skill when you are still iterating on one personal workflow.28Start with a skill when you are still iterating on one personal workflow.

26Build a plugin when you want to share that workflow, package related skills,29Build a plugin when you want to share that workflow, package related skills,

27connect to an external service, or distribute a stable capability to a team.30connect to an external service, or distribute a stable capability to a team.