ChatGPT Work Security: Admin Controls and Rollout

ChatGPT Work gives staff an agent that runs longer, multi-step tasks across files and apps, so the workspace settings around it decide what it can reach and do. OpenAI describes Work as an agent designed for longer, multi-step work and finished deliverables such as research, analysis, documents, spreadsheets, presentations, reports and Sites. This guide is for ChatGPT workspace owners, identity teams and security engineers who need to turn Work on in a controlled way: identity and roles, apps and connectors, action approvals, data controls, logging and user guidance. It builds on the ChatGPT Enterprise Security Guide and focuses on what changes when an agent, rather than a chat, acts on your data.

This is an independent guide from NHI Mgmt Group, based on OpenAI's public documentation as of November 2026. It is not sponsored or reviewed by OpenAI. Product features change, so confirm settings against OpenAI's current documentation.

Key takeaways

Work inherits your workspace controls. OpenAI states that workspace settings and role-based access controls still determine member access, so a clean RBAC model is the first control, not an afterthought.
Enterprise and Edu need EKM for Work. OpenAI lists Work as available to eligible Enterprise and Edu workspaces with Enterprise Key Management enabled, with a gradual rollout.
Apps and actions are where the risk lives. Enterprise and Edu start with apps disabled; enable them per role, and use Action control to allow read actions only until a use case justifies write actions.
Approvals are configurable. App permissions decide when ChatGPT asks a user to confirm an action, from Always ask to Never ask; set a conservative workspace default and override per app.
Logs leave the platform or they are lost. The Compliance Logs Platform keeps events for 30 days, so stream them to your SIEM or archive from day one.

What ChatGPT Work is and what it can reach

Work is an agent mode inside ChatGPT. A user describes an outcome, Work plans and carries out the steps, and the user can review progress, answer questions, change direction and approve important actions while it runs. According to OpenAI's Work help article (checked November 2026):

Surfaces: web and mobile on eligible paid plans, and the desktop app based on plan and workspace.
Local files: on desktop, Work can use local files and desktop apps only with the user's permission, when the plan and workspace allow it. Local files stay on the device unless the user moves or shares them. Local chats stay on the computer, while cloud Work chats sync across web, mobile and desktop.
Projects and Scheduled Tasks: Work can be organised in Projects and run as recurring or trigger-based Scheduled Tasks, which means some agent activity happens without a person watching in real time.
Usage: Work follows the Codex usage structure, so usage limits and budgets in the admin console apply.

From a security view, Work is a delegated identity: it acts with the user's role, the user's connected apps and, on desktop, the files the user grants. The controls below shape each of those.

Identity, SSO and roles

OpenAI's Enterprise admin quickstart orders setup as roles, domain verification, SSO and Directory Sync, groups and RBAC, then workspace settings. Do this before Work reaches general members.

Control	Where it is set	What to do
Domain verification	Global Admin Console, Domains (DNS TXT record)	Verify every corporate email domain. OpenAI notes DNS changes can take up to 24 hours and the flow allows up to 7 days; review affected existing personal accounts first.
SSO (SAML)	Global Admin Console, SSO	Configure SAML with a metadata URL or manual SSO URL, issuer and signing certificate. Send signed, unencrypted assertions with a stable primary email. With Entra, confirm whether the claim is email, UPN or preferred_username.
SSO enforcement	Per product policy: Required, Optional or Off	Test on Optional, then set ChatGPT to Required. Protect at least one global admin before setting the Admin Console policy. Required applies to members on verified domains.
Directory Sync (SCIM)	Global Admin Console	Provision and deprovision from your IdP and confirm synced groups map to the intended product assignment.
Roles	Permissions and Roles	Keep Workspace Owners few; use Workspace Admins, Analytics Viewers and custom roles for narrower duties. Set a restrictive default workspace role.
Groups	Workspace or tenant groups	Groups grant nothing alone; attach roles to them. Use a pilot group for Work and a separate admin group for Codex and agent settings.

OpenAI points out that IdP MFA, device rules and conditional access apply only when a user signs in through the IdP. Users who sign in another permitted way may bypass them, so enforcement to Required is what makes your IdP policies real for Work sessions. Turning off Allow External Domain Invites stops new guest invitations but does not remove existing guests: review those separately. See the SCIM Provisioning Guide for joiner, mover and leaver design.

Apps, connectors and action control

Work is most useful, and carries most risk, when it can read and act in business systems. OpenAI's admin controls for apps describe these settings:

Enable by role: on Enterprise and Edu all apps are disabled by default. Owners enable them in Workspace settings, Apps, and grant them per role under Permissions and roles, Custom roles, Connected data (Allow members to use apps, then Select).
Action control: for apps that support it, allow all actions, read actions only or a custom set, and decide how new actions are handled (enable all, enable new read actions only, or disable new actions). OpenAI notes that provider scope approval does not automatically enable new actions.
Synced Google Drive: limit sync to named Shared Drives or folders, exclude file types from indexing, and choose per-user authentication or admin-controlled access.
Microsoft apps: Outlook, Teams and SharePoint need permissions granted in Microsoft Entra ID; review those consents as you would any enterprise application.
Developer mode and custom apps: only owners, or users granted the setting on Enterprise and Edu, can enable developer mode. New MCP actions stay unavailable until an admin reviews them in Action control and selects Refresh. OpenAI states custom apps are not verified by OpenAI, so treat them as third-party code.

The quickstart also lists what to audit: enabled apps and connectors, write or open-world actions, allowed OAuth domains, apps in GPTs, GPT action domains, and Workspace Agent and Codex access. Each connected app is an OAuth grant that lets an agent act as the user, so the Consent Phishing and Illicit OAuth Grants Guide and Agent Permission Drift both apply.

Approvals and human oversight

App permissions set when ChatGPT asks the user to confirm an action. Set a workspace default under Connected data and override it per app from the App permissions menu. OpenAI lists options that can include:

Setting	Behaviour (per OpenAI docs)	Our suggested use
Always ask	Confirms each action	Default during the pilot, and permanently for apps that hold regulated data
Any changes	Confirms actions that change data	Collaboration apps once read-only use is proven
Important actions	Confirms consequential, sensitive or hard-to-reverse actions; some high-risk actions are blocked	Broad rollout for low-risk apps
Never ask	No confirmation	Avoid for any app with write actions

The suggested-use column is NHI Mgmt Group's recommendation, not OpenAI's. Workspace Agents use separate per-agent controls, so review those apart from Work. Scheduled Tasks deserve extra care: a confirmation prompt helps only when a person is present to answer it. See the Human-in-the-Loop for AI Agents Guide.

Data protection, keys and network controls

Training: OpenAI's enterprise privacy page states that it does not train on business data and that customers own and control their data.
Retention: the same page says ChatGPT Enterprise customers control how long data is retained. Set retention to match your records policy before Work creates large volumes of documents and reports.
Encryption and EKM: OpenAI states data is encrypted at rest with AES-256 and in transit with TLS 1.2 or later. Enterprise Key Management is a prerequisite for Work on Enterprise and Edu; document key ownership, rotation and revocation in your key management runbook.
Residency: configure data residency or inference residency where your obligations require it.
IP allowlisting: restrict workspace access and Compliance API access to corporate egress ranges.
Lockdown Mode: restricts web, search, browsing and related networked capabilities; consider it for groups handling highly sensitive material.
Managed mobile: ChatGPT for Intune supports managed mobile access and needs an active tenant SSO connection.
Desktop files: OpenAI advises granting access only to the files the task needs. Pair that with endpoint controls on where sensitive files live.

Logging, monitoring and the Compliance Platform

OpenAI's Compliance Platform for Enterprise and Edu has two access patterns: the Compliance Logs Platform, with immutable, append-only events for auditing, and the Stateful Compliance API, which queries current state. Conversations that use apps appear in the Compliance API, and all app calls are recorded in the Compliance Logs Platform. Partner integrations cover eDiscovery, DLP and SIEM.

Retain logs yourself: the Logs Platform keeps data for 30 days, so export to your SIEM or archive continuously.
Track platform changes: OpenAI released a new conversation logs system on 5 March 2026 and stated that the deprecated stateful route would be removed on 5 June 2026. Confirm your integration uses the current source.
Admin actions: the Admin plugin, which lets admins manage the workspace from a conversation, works within each user's existing role and records what was requested, whether it completed and what changed. Include those records in admin activity reviews.
Usage controls: set weekly per-user alerts or hard limits and monthly shared budgets; unusual usage spikes from Work are also a useful signal.

Metric (ours)	Source	Target
Share of members signing in through SSO	IdP logs, Admin Console	100% on verified domains
Apps with write actions enabled and a named owner	Apps settings, Action control	Every write-enabled app has an owner and review date
App calls reaching the SIEM within the hour	Compliance Logs Platform export	Above 99%
Leavers with ChatGPT access after deprovisioning	SCIM and workspace member list	Zero after 24 hours
Developer mode grants reviewed in the quarter	Role settings	All

Phased rollout

Prepare: verify domains, configure SAML on Optional, enable SCIM, define roles and a restrictive default role, set retention, IP allowlisting and EKM where required.
Pilot: enable Work for a small group, with two or three read-only apps, App permissions on Always ask, developer mode off, and logs flowing to the SIEM.
Review: after two to four weeks, review app calls, confirmations and user feedback; agree which apps justify write actions and who owns each.
Expand: set SSO to Required, add groups in waves, move low-risk apps to Important actions, and publish user guidance through Workspace Policy.
Roll back: remove the group from the role that grants Work or the app, set the app's actions to read only, and revoke the related OAuth consent at the provider if needed.

User guidance

Use Workspace Policy and Workspace Instructions to show staff the rules at the point of use. Ours, in short:

Grant narrowly: give Work only the files and apps the task needs, and disconnect apps you no longer use.
Read before approving: confirm what an action will change, who will receive it and whether it can be undone.
Treat inputs as untrusted: web pages, emails and shared files can contain instructions aimed at the agent; stop the task if it starts doing something you did not ask for.
Keep secrets out: never paste credentials, API keys or customer secrets into a task.
Check deliverables: review generated documents and reports before sharing them outside the team.

The AI Acceptable Use Policy Template gives policy wording you can adapt.

Framework mapping

Control area	NIST SP 800-53 Rev 5	NIST CSF 2.0
SSO, SCIM and deprovisioning	IA-2, AC-2	PR.AA-01
Roles, app access and action control	AC-3, AC-6	PR.AA-05
Retention, encryption and EKM	SC-28, SC-12	PR.DS-01
Compliance logs and SIEM	AU-2, AU-6, AU-12	PR.PS-04, DE.CM-03
User guidance	AT-2, PL-4	PR.AA-05

Practitioner checklist

Verify all corporate domains and set ChatGPT SSO to Required after testing on Optional.
Enable SCIM and test that a leaver loses access within your target time.
Set a restrictive default workspace role and grant Work through a named group.
Enable apps per role only, starting with read actions and new actions disabled.
Set App permissions to Always ask for the pilot and never Never ask on write-enabled apps.
Restrict developer mode and review new MCP actions before selecting Refresh.
Configure retention, IP allowlisting, EKM and residency to match your obligations.
Stream the Compliance Logs Platform to your SIEM before the 30-day window passes.
Publish Workspace Policy guidance and review app grants each quarter.

ChatGPT Work Security: Admin Controls for Safe Agent Rollout