ChatGPT Dots: The Enterprise Rollout Starts With Permission

TL;DR: Dots launched September 29, 2026; Enterprise, Edu and Healthcare receive a beta that starts disabled until a workspace administrator enables it.^[1][2] Shared plugin permissions and a separate local-computer switch make access design the first deployment decision.^[3] Start with a bounded workflow and evaluate completed work, approval handling and information exposure together.

Cover: newly generated editorial ink engraving of a permission gate between a workstation and filing cabinets. It is illustrative artwork, not a product screenshot or measured evidence. Analysis dated October 5, 2026; launch dated September 29.

An always-on agent changes the enterprise purchasing question. A persistent assistant needs a job description: what it reads, what it produces, who reviews it and when its mandate ends.

October 4 X discussions, including Ayush Sin’s explainer and JOJO’s comments about local permissions, are commentary leads rather than independent confirmation of product guarantees.^[7][8] The important evidence is in OpenAI’s launch documentation and current help pages. This analysis concerns deployment boundaries, rather than repeating our Astra infrastructure coverage.

The Admin Gate: Availability Is A Decision

OpenAI’s setup guide says the Enterprise beta, including Edu and Healthcare, is initially off. Business Premium availability covers supported ChatGPT regions; Pro excludes the EEA, Switzerland and UK. Access rolls out gradually.^[2] That is a meaningful distinction for a global organization: a colleague’s personal account is not a reliable guide to the corporate rollout.

Treat administrator enablement as the beginning of a pilot. Assign a process owner and choose one repeated problem with an observable finish line. A weekly internal evidence brief is a better initial assignment than a broad instruction to improve operations. The former lets reviewers compare the agent’s findings with the underlying records and identify missing context.

The first Dot is included on Pro and Business Premium, according to the launch post. That statement is not an Enterprise price quote.^[1] Procurement should obtain the applicable commercial terms before modeling a workforce-wide return. Software availability, consumption capacity and a successfully completed business task are different inputs to that calculation.

The Access Map: Shared Plugins, Separate Device

Plugin permissions carry across Dots, ChatGPT, ChatGPT Work and Codex. Connecting a local computer is a separate choice.^[3] The setup guide says local access begins off; enabling it permits work on that device.^[2] Do not interpret the local switch as a fresh boundary around every connected app.

An access inventory should therefore record the account behind each connection, its permitted resources and the responsible owner. Then assess local-device access separately. An analyst may need a connected document store for a briefing while having no operational reason to expose a laptop’s working files.

This matters commercially because connection convenience can outrun process design. A system that already has access to several services can begin producing impressive work before anyone has agreed which information belongs together. The pilot should make that agreement explicit, especially when projects have different client, legal or confidentiality boundaries.

The current enterprise plugin guide adds another distinction: installing a plugin and authorizing its included app are separate controls. Disabling the app can leave skills that do not depend on it installed. Provider OAuth consent, enabled actions and ChatGPT permission settings are also separate checks.^[9] This is general workspace guidance, not a promise that every app exposes identical controls in Dots.

The practical inventory needs more than an “installed” column. Record the underlying app, the permitted action set and the provider account. For a document briefing, test the read path with the intended user; do not infer that a visible plugin means the necessary documents are accessible. Conversely, removing one app capability should not be reported as removal of every capability in the plugin.

Effective access deserves particular attention. OpenAI’s RBAC guide says ordinary custom roles combine additively: another role can grant a permission that one role sets to Off. Product eligibility and Lockdown Mode are evaluated separately.^[10] A pilot group’s restrictive role therefore needs review alongside each participant’s other direct and group roles. Test the actual access after a role change rather than relying on the label of the new role.

The Background Mode: Reading Is Its Own Responsibility

OpenAI restricts proactive-research tools from messaging people, changing plugin content or controlling a browser or computer.^[3] This narrower mode is useful for discovering relevant updates. It should not be confused with a continuing task that already has authorization to act.

Reading still creates a governance question. Decide which records the agent should consider and how reviewers will distinguish current evidence from obsolete notes. A proposed daily brief might require source links, document dates and an explicit statement when the latest record contradicts an earlier one. These are our recommended acceptance criteria.

The privacy FAQ says disconnecting a plugin stops new access without erasing previously retained context.^[3] Removing a connection is consequently an access change, not a complete offboarding plan. Define what happens to the agent’s context and its independently stored deliverables when a pilot ends.

OpenAI’s enterprise privacy commitments separately say business data is not used for training by default and workspace administrators control Enterprise, Edu and Healthcare retention. Deleted conversations are removed within 30 days unless legal retention is required.^[11] That conversation policy should not be treated as a universal expiry timer for Dot context or files held elsewhere.

The rollout owner should map three lifecycles: source-system records, the agent’s retained context, and the deliverables it creates. A decision to end the pilot must identify which owner handles each one. The no-training default is an important commercial protection, but it does not answer whether an outdated customer document remains available inside an active workflow. Retention and task scope need their own decisions.

The Approval Layer: Review The Consequence

OpenAI describes sandboxed cloud workspaces, supported sign-in flows that keep passwords outside model context, and separate checks before consequential actions. Secrets pasted into readable messages or documents do not receive the same sign-in protection.^[4] Keep credentials out of task briefs.

Auto-review checks proposed actions against the relevant instructions and policy; approval remains bounded by that policy.^[5] For the process owner, the useful question is whether the requested result can be reviewed before it creates an external commitment. A prepared customer reply with its recipient and evidence visible is easier to assess than a broad standing mandate to handle customer communications.

Measure review burden alongside output quality. If each apparently finished result requires reconstructing the evidence from scratch, the workflow has transferred work rather than removed it. A good pilot records rejected proposals, corrections and escalations so the next scope decision is based on behavior.

The Pilot Scorecard: Boundaries Need Evidence

OpenAI reports 45 passes in 49 scope-change evaluation episodes, including all 17 explicit permission-change cases. Its chained-task tests also found moderate scope violations. These are vendor evaluations, not a production failure rate.^[6] They support a practical point: persistence deserves its own acceptance test.

Test a revocation, a conflicting source and a changed objective in your pilot. Require the agent to preserve the latest mandate, identify uncertainty and bring consequential decisions back to the owner. Track accepted deliverables and the effort needed to reach them. Avoid declaring success from a striking demonstration alone.

The enterprise opportunity is substantial, but its strongest starting point is modest: one accountable owner, one useful recurring outcome and an access map that everyone understands. Always-on work earns broader responsibility by staying inside the responsibility it already has.

Last updated: October 5, 2026