1# Manage dots permissions and capabilities
2
3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.
4
5A dot is a personal agent in ChatGPT that can take on ongoing work, use connected apps, and delegate tasks to Work or Codex. You choose who can use dots and which capabilities they can access. Members connect their accounts and tell their dots what to work on.
6
7For detailed settings, see [Manage dots in ChatGPT workspaces](https://help.openai.com/en/articles/20001554-manage-dots-in-chatgpt-workspaces). The [privacy, security, and safety FAQ](https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs) covers data handling and approvals.
8
9
10
11
12## Find what you need
13
14| If you need to… | Start here |
15| -------------------------------------------------- | -------------------------------------------------------------------------------------------- |
16| Give a group access | [Set up dots for work](#set-up-dots-for-work) |
17| Choose which data and tools a dot can use | [App access](#2-configure-app-access) and [computer capabilities](#available-admin-controls) |
18| Set up Slack | [Slack connections and dot identities](#3-configure-communication-channels) |
19| Understand background work and approvals | [Actions and ongoing work](#actions-and-ongoing-work) |
20| Track usage or investigate an action | [Models and usage](#models-and-usage) and [Data and compliance](#data-and-compliance) |
21| Remove access when someone changes roles or leaves | [Manage access changes](#manage-access-changes) |
22
23
24
25
26
27
28
29## Set up dots for work
30
31
32
33
34
35
36
37
38
39
40### 1. Configure role-based access
41
42Workspace owners manage access through workspace defaults and custom roles. To give selected groups access, keep the workspace default off and assign a custom role to those groups. Check every role assigned to a member: if one role grants access, turning it off in another role won't remove it.
43
44Review these permissions in **Permissions**:
45
46- **Use dots**: Allow members to use dots.
47
48- **Add dots to Slack and Microsoft Teams**: Allow members to connect their dots to supported messaging channels where available.
49
50- **Allow local computer access**: Allow dots to use a member’s local computer.
51
52- **Use custom rules for dots**: Allow members to add or edit rules for their dots.
53
54For role creation, assignment, and access checks, see the [role-based access control guide](https://learn.chatgpt.com/docs/enterprise/roles-and-workspace-permissions#set-the-workspace-default-then-create-targeted-custom-roles).
55
561. Open **Admin Console** > **Permissions**.
57
582. Under Permissions > Workspace default > Workspace capabilities, enable Use dots (Beta) if it should be available by default; otherwise grant access through a custom role.
59
603. Set Slack participation and custom dot rules. Local computer access requires a separate admin opt-in; review [local computer access setup](https://learn.chatgpt.com/docs/enterprise/cloud-local-access#enable-local-computer-access) before enabling it.
61
624. Under **Let agents use cloud computers**, review **Use a browser**, **Allow network access**, and **Allow computer use** where your policies allow browsing websites, accessing online services, and interacting with apps. Review both workspace defaults and custom roles.
63
645. Under Workspace capabilities, set Use password manager according to your workspace policy.
65
666. Save, then check access for an intended member.
67
68When you enable dots, you may be asked to turn on cloud computer capabilities that are still off. Dots, Work Cloud, and team automations share these permissions. Choose the capabilities your organization's policies allow.
69
70To review them later, go to **Admin Console** > **Permissions** > **Workspace default** > **Workspace capabilities** > **Let agents use cloud computers**. Local computer access is a separate opt-in.
71
72
73
74
75
76
77
78Members still need to complete [Slack](https://learn.chatgpt.com/docs/dots/channels#slack) and [local-computer setup](https://learn.chatgpt.com/docs/dots/computers-and-apps#connect-your-computer) after you enable access. Supported app connections they've already set up may be available to their dot.
79
80<span
81 id="3-configure-approved-apps-and-actions"
82 data-localization-body-anchor
83/>
84
85
86
87
88### 2. Configure app access
89
90Dots can use supported ChatGPT app connections. When setting up access, check:
91
921. **Which apps members can use.** Set available apps and allowed actions in [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors).
932. **What the connected account can access.** Check the account's permissions in the source app. Enabling dots doesn't give it access to every shared drive, channel, or document.
943. **When approval is required.** An app can be available while some actions still need approval. See [app permissions](https://help.openai.com/en/articles/20001495-managing-app-permissions-in-chatgpt) for the options.
95
96For example, permission to read a document may not include editing or sharing it. To restrict access to a particular source, check the connected account and app permissions.
97
98<span
99 id="4-choose-communication-channels-and-destinations"
100 data-localization-body-anchor
101/>
102
103
104
105
106### 3. Configure communication channels
107
108Members can connect Slack to their dot in two ways:
109
110| Setup | Member experience | What to configure |
111| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
112| Connect the member’s Slack account through Plugins | Members talk to their dot in ChatGPT. It can use their Slack connection without having its own Slack identity. | Slack plugin access, the connected account, allowed actions, and approvals. |
113| Give the dot its own Slack identity | The owner can message or mention the dot in Slack, and its posts are visible to people in that conversation. | Dots messaging permission, Slack app approval, and each member’s dot setup. |
114
115Turning off a dot's Slack identity doesn't remove its access through the member's connected Slack account. Check both when removing Slack access. For member setup, see [Messaging](https://learn.chatgpt.com/docs/dots/channels#slack).
116
117**Before members connect their dots to Slack**
118
119- **ChatGPT workspace owner:** Enable Use dots and Add dots to Slack and Microsoft Teams for the intended members through workspace defaults or custom roles.
120
121- **Slack workspace owner or app manager:** Ensure the ChatGPT app is installed in Slack. Approve app requests if required by your workspace. See [Slack’s app approval guidance](https://slack.com/help/articles/360024269514-Manage-app-requests-for-your-workspace).
122
123- **Each member:** Connect your dot to Slack from its profile. See [Message your dot in Slack](https://learn.chatgpt.com/docs/dots/channels#slack).
124
125Enabling the ChatGPT permission does not install an app in Slack or connect a member’s dot.
126
127<span
128 id="5-record-approval-and-oversight-responsibilities"
129 data-localization-body-anchor
130/>
131
132
133
134
135
136
137
138
139
140
141<span
142 id="manage-ongoing-work-and-access-changes"
143 data-localization-body-anchor
144/>
145
146
147
148
149## Available admin controls
150
151| **Area** | **Admin capability** |
152| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
153| Access to dots | Grant or revoke dots access through workspace permissions. |
154| Cloud and connected local computers | Control Use a browser, Allow network access, Allow computer use, Use password manager, and local-computer access. |
155| Messaging and participation | Enable or disable Slack participation. |
156| Connected apps | Set available apps and allowed actions through [Plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors). |
157| Custom dot rules | When disabled, members cannot add or edit custom rules, and saved rules do not apply. |
158| Models | Enterprise model controls and defaults do not apply to the main dot. Review delegated Work and Codex tasks separately. |
159
160
161
162
163<span
164 id="can-we-use-o-if-our-workspace-requires-ekm-or-zdr"
165 data-localization-body-anchor
166/>
167
168<span
169 id="does-background-work-count-toward-usage-limits"
170 data-localization-body-anchor
171/>
172
173<span
174 id="enterprise-availability-and-limitations"
175 data-localization-body-anchor
176/>
177
178## Review availability and data requirements
179
180Before enabling dots, review current availability in [Getting started with your dot](https://help.openai.com/en/articles/20001530-getting-started-with-your-dot) and the workspace notices shown during setup. If your organization requires data or inference residency, Enterprise Key Management, or specific compliance coverage, confirm support for dots with your account team before enabling access.
181
182Check requirements for the dot itself, tasks it delegates to Work or Codex, and any connected computer. For cloud browser, network, and computer use, see [cloud security](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-security). For work on employee devices, see [local computer access](https://learn.chatgpt.com/docs/enterprise/cloud-local-access).
183
184
185
186
187
188
189
190## Dots FAQ
191
192
193
194
195### Access and eligibility
196
197<span
198 id="does-access-to-o-grant-access-to-apps-and-websites"
199 data-localization-body-anchor
200/>
201
202
203
204
205<ToggleSection title="Does access to dots grant access to apps and websites?">
206
207No. Dots access does not grant access to apps or websites. App connections require authorization; website work uses the browser’s signed-in account.
208
209</ToggleSection>
210
211<span
212 id="whose-account-does-o-use-for-connected-work"
213 data-localization-body-anchor
214/>
215
216
217
218
219<ToggleSection title="Whose account does a dot use for connected work?">
220
221For apps, a dot uses the connected account. For websites, it uses the account signed in to the cloud browser. Check the permissions for each account. See [Managing app accounts](https://help.openai.com/en/articles/20001494-connecting-and-managing-app-accounts-in-chatgpt).
222
223</ToggleSection>
224
225<span
226 id="can-o-use-a-local-computer-vpn-or-existing-sign-in"
227 data-localization-body-anchor
228/>
229
230
231
232
233<ToggleSection title="Can a dot use a local computer, VPN, or existing sign-in?">
234
235A dot’s cloud computer is separate from a member’s local computer. Local work requires a connected, online computer with ChatGPT open and access enabled. Local sign-in, VPN access, and device policies do not automatically extend to the cloud computer.
236
237</ToggleSection>
238
239<span
240 id="can-we-use-o-with-policies-that-target-an-operating-system"
241 data-localization-body-anchor
242/>
243
244
245
246
247<ToggleSection title="How do cloud policies affect local computer access?">
248
249If any cloud policy has `enforce_residency` enabled, local computer access is unavailable for dots. Work Cloud remains available. See the [local-access safeguard](https://learn.chatgpt.com/docs/enterprise/cloud-local-access#check-data-handling-and-the-local-access-safeguard) for the policy requirements.
250
251</ToggleSection>
252
253
254
255
256### Actions and ongoing work
257
258<span
259 id="can-o-keep-working-when-the-user-is-away"
260 data-localization-body-anchor
261/>
262
263
264
265
266<ToggleSection title="Can a dot keep working when the user is away?">
267
268Yes. Members can assign [ongoing responsibilities](https://learn.chatgpt.com/docs/dots/tasks-and-memory#assigned-work). Workspace permissions and approval rules still apply. Local work requires the computer to stay online with ChatGPT open and access enabled.
269
270[Proactive research](https://learn.chatgpt.com/docs/dots/tasks-and-memory#proactive-research) uses restricted tools to read connected apps. It cannot send messages, change content, or control a browser or computer. To act on what it finds, the dot needs the user's authorization and the required permissions and approvals.
271
272</ToggleSection>
273
274
275
276
277
278
279
280<ToggleSection title="Who can message a dot or see its results?">
281
282Only the owner can direct their dot through a Slack direct message or supported channel mention. Messages from other people do not start work.
283
284A dot may use other participants' messages as context when its owner brings it into a Slack thread. Anyone with access to the conversation can see its posts. Information from another channel doesn't give the dot permission to share it with a new audience. Check recipients before posting work content.
285
286Microsoft Teams access is limited to an invite-only alpha.
287
288</ToggleSection>
289
290<span
291 id="does-o-always-ask-before-sending-or-changing-something"
292 data-localization-body-anchor
293/>
294
295
296
297
298<ToggleSection title="Does a dot always ask before sending or changing something?">
299
300[Auto-review](https://learn.chatgpt.com/docs/dots/controls#how-action-review-works) checks proposed actions against the user's instructions, custom rules, and safety requirements. Asking a dot to draft a message doesn't give it permission to send it. See [app permissions](https://help.openai.com/en/articles/20001495-managing-app-permissions-in-chatgpt) for approval options.
301
302</ToggleSection>
303
304<span
305 id="how-should-we-stop-work-or-remove-a-users-access"
306 data-localization-body-anchor
307/>
308
309
310
311
312<ToggleSection title="How do admins revoke dots access?">
313
314See [Manage access changes](#manage-access-changes) for steps to remove access and check connected accounts, computers, and ongoing work.
315
316</ToggleSection>
317
318<span
319 id="how-do-custom-rules-affect-confirmations"
320 data-localization-body-anchor
321/>
322
323
324
325
326<ToggleSection title="How do custom rules affect confirmations?">
327
328[Custom dot rules](https://learn.chatgpt.com/docs/dots/controls#set-custom-rules) guide when a dot acts or asks for confirmation. If you turn them off, members can't add or edit rules, and saved rules won't apply. The dot still follows default rules and the user's instructions.
329
330Custom rules don't grant tool access or override workspace permissions and built-in safety requirements. Turning them off also doesn't make the dot ask before every action. Check capability and app approval settings to control what it can do.
331
332</ToggleSection>
333
334<span
335 id="what-safeguards-help-protect-work-done-by-dots"
336 data-localization-body-anchor
337/>
338
339
340
341
342<ToggleSection title="What safeguards help protect work done by dots?">
343
344Built-in safeguards help defend against malicious instructions and can pause or stop work when monitoring detects a safety concern.
345
346Members can follow progress in [Activity View](https://learn.chatgpt.com/docs/dots/controls#review-work), redirect work, and check results before using them.
347
348</ToggleSection>
349
350
351
352
353### Models and usage
354
355<span
356 id="do-existing-model-controls-and-defaults-apply-to-o"
357 data-localization-body-anchor
358/>
359
360
361
362
363<ToggleSection title="Do existing model controls and defaults apply to dots?">
364
365Enterprise model controls and defaults do not apply to the main dot. Tasks it delegates to Work or Codex follow those products' permissions and controls. Check dots permissions and the settings for Work and Codex when configuring access.
366
367</ToggleSection>
368
369
370
371
372<ToggleSection title="How should admins monitor adoption and usage?">
373
374Use the [Analytics API](https://learn.chatgpt.com/docs/enterprise/analytics-api) to see who is using dots. Tasks a dot starts or manages in Work or Codex count toward those products' usage limits and appear in their reporting. Include those tasks when reviewing usage, and check current plan terms when setting budgets. See [Work usage and cost](https://learn.chatgpt.com/docs/enterprise/chatgpt-work-usage-and-cost) for the available controls.
375
376The daily usage endpoint `/v1/analytics/workspaces/{workspace_id}/usage` identifies dots with `client_id = DOTS` and supports per-user or workspace-level reporting.
377
378</ToggleSection>
379
380<span
381 id="which-data-policies-should-we-review-for-o"
382 data-localization-body-anchor
383/>
384
385
386
387
388### Data and compliance
389
390OpenAI does not use ChatGPT Enterprise data to improve its models by default. For OpenAI’s business data commitments, see [Enterprise privacy](https://openai.com/enterprise-privacy/).
391
392<span
393 id="what-does-o-remember-between-requests"
394 data-localization-body-anchor
395/>
396
397
398
399
400<ToggleSection title="What does a dot remember between requests?">
401
402A dot keeps its own context, separate from ChatGPT Memory. Turning off ChatGPT Memory stops memory sharing with the dot, but doesn't erase information it already has. Disconnecting a plugin stops future access through that connection; it doesn't remove information the dot has retained.
403
404Deleting a dot removes its own context. Files, Codex threads, and ChatGPT conversations it created are stored separately and aren't all deleted with it. Follow the deletion steps for each location.
405
406See the [dots privacy FAQ](https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs) for what is retained and deleted, and [Getting started with your dot](https://help.openai.com/en/articles/20001530-getting-started-with-your-dot) for the member’s Pause and Reset controls.
407
408</ToggleSection>
409
410<span
411 id="how-can-admins-investigate-work-o-has-done"
412 data-localization-body-anchor
413/>
414
415
416
417
418<ToggleSection title="How can admins investigate work a dot has done?">
419
420Members can follow their dot's work in Activity View. Admins can use [Compliance API](https://learn.chatgpt.com/docs/enterprise/compliance-api#confirm-the-administration-boundaries) records to investigate user messages and dots' replies. Check which records are available before relying on exports for an audit, DLP, legal hold, or e-discovery.
421
422Supported dots records are available through the Compliance Logs Platform, including user prompts and responses, supported tool-call events, and connected-app MCP calls and results. Records identify the user and workspace; dots-attributed records use `client_id = DOTS`, and the agent object includes the dot ID, name, and type when available.
423
424Workspace owners or admins can select their workspace in Admin Console, then open **Credentials > Admin keys** and create a key with the appropriate available permissions: `enterprise.analytics.usage.read` for unified usage reporting, or `CODEX_LOG` access for dots compliance records. Only workspace owners can grant broad compliance or **Conversation messages** access where supported. Use the [Admin API reference](https://chatgpt.com/public/admin/api-reference) to list and download compliance JSONL files and select records with `client_id = DOTS`.
425
426</ToggleSection>
427
428## Manage access changes
429
430When someone changes roles or leaves, check their dot's permissions, connections, and ongoing work:
431
4321. **Remove dots access.** Check the workspace default and every role assigned directly or through groups. Remove each permission that grants access; any remaining grant can keep it enabled.
4332. **Check connected accounts and devices.** Review plugin authorizations, website sessions, local computer access, and the dot's Slack identity. Each has its own settings.
4343. **Decide what happens to ongoing work.** Check active tasks, recurring schedules, and tasks delegated to Work or Codex. Decide what should stop and who should take over any remaining responsibilities.
4354. **Delete data where needed.** Access changes and deletion are separate steps. Follow the deletion process for the dot's context and any files or tasks stored elsewhere.
436
437For adding and removing workspace members, see [User lifecycle management](https://learn.chatgpt.com/docs/enterprise/user-lifecycle). For dots access removal, see [Manage dots in ChatGPT workspaces](https://help.openai.com/en/articles/20001554-manage-dots-in-chatgpt-workspaces).
438
439### Respond to an unexpected action
440
441Ask the member to pause their dot and review the affected task. Save the task link and available activity records, check the app or computer permissions involved, and follow your organization's incident process. Whether you can undo an action depends on the action and the service. See the [privacy and safety FAQ](https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs) for how to report an issue.
442
443## Help members work well with dots
444
445Help members choose work to delegate and connect the accounts and tools they'll need. Encourage them to tell their dot what to do, when to do it, and who should see the result.
446
447For example, “Prepare a weekly project update for me to review” asks for a draft. “Post the approved update in our team channel every Friday” also gives permission to post. Members should check important results and know how to review activity, change a schedule, and pause their dot. Share [Getting started](https://learn.chatgpt.com/docs/dots/getting-started), [Tasks and memory](https://learn.chatgpt.com/docs/dots/tasks-and-memory), and [Controls](https://learn.chatgpt.com/docs/dots/controls) to help them get started.
