OpenAI Dots can work with connected apps, use a dedicated cloud computer and continue tasks beyond a single ChatGPT conversation. That makes them useful for ongoing work, but it also raises an important question: what can an OpenAI Dot access, which actions can it take independently, and what happens to your information afterward?
The answer depends on the apps you connect, the permissions granted to those connections, your action rules and the safeguards that apply to a particular task. Connecting an app does not give a Dot unrestricted access to every account or action.
Before delegating work involving email, documents, customer records or business systems, understand these boundaries and review the relevant controls.
Table of Contents
What Can OpenAI Dots Access?
OpenAI Dots can use supported app connections already configured in ChatGPT, ChatGPT Work or Codex, within the permissions granted to those connections. Their access is therefore determined by the connected service, its authorization settings and the actions available through the integration.
Dots also have their own cloud computer and browser environment. Depending on availability and permissions, they may interact with websites and applications to complete assigned tasks.
For eligible configurations, users can also connect a local computer. This is separate from the cloud computer and requires the appropriate connection and device permissions. In Enterprise workspaces, local computer access is controlled by a workspace setting and is off by default.
OpenAI documents these controls in its Dots privacy, security and safety FAQs.
The important distinction is that access to an app, permission to perform an action and approval to execute that action are separate controls. A Dot should not be assumed to have unrestricted access simply because an app is connected.
How Do OpenAI Dots Permissions and Approvals Work?
Dots have default action rules that determine when they can act independently, when they need approval and when the user must take over. Custom Rules let users establish additional boundaries for supported actions.
For example, you might allow a Dot to read relevant documents and prepare an email draft while instructing it not to send messages without authorization. The exact behavior still depends on the connected app, the action involved and the applicable safety requirements.
| Action or control | What to understand |
|---|---|
| Reading connected information | Depends on the app connection and granted access. |
| Drafting content | Can be part of a delegated task, subject to available tools and permissions. |
| Sending messages | May require approval or advance authorization within a specific scope. |
| Permanently deleting data | May require approval each time. |
| Changing passwords or transferring money | Highly sensitive actions require the user to take over and complete them. |
| Custom Rules | Can set additional boundaries but cannot override core safety requirements. |
Advance approval is not unlimited permission. For example, authorizing a recurring message does not automatically authorize unrelated messages to other recipients.
Be specific when setting rules. Define which actions are allowed, which require review and which should never be performed. Avoid broad instructions such as “handle my inbox” when the task could involve sending messages, deleting records or sharing confidential information.
For a wider explanation of agent design and control boundaries, see ToolJunction’s practical guide to building AI agents for business operations.
Can OpenAI Dots Work in the Background Without Approval?
Dots can conduct proactive research by reviewing information from permitted connected sources and saving private notes before you make a new request. However, proactive research has specific restrictions.
According to OpenAI, proactive research tools cannot directly send messages to other people, change content through plugins or control a browser or computer. Any follow-up action must still comply with the usual action rules and safety checks.
This distinction matters for business workflows. A Dot might gather information for a report, but that does not mean it can automatically publish the report, send it to customers or change a company record without the required authorization.
Background execution also does not eliminate the need for oversight. Review delegated work, particularly when it affects customers, finances, access permissions or business-critical information.
What Information Does an OpenAI Dot Retain?
Dots can retain context from conversations and connected plugins for as long as you keep the Dot. They can also receive memories and recent conversation context from ChatGPT, while conversations with a Dot can contribute to ChatGPT Memory.
These are related but distinct forms of context.
Turning off ChatGPT Memory stops further sharing between ChatGPT Memory and the Dot. It does not delete information the Dot has already received.
OpenAI states that a Dot’s own context does not retain credentials, images or screenshots. However, files created or used elsewhere, such as in ChatGPT Library, on a local computer or in a connected storage service, follow the retention rules of those locations.
This means you should not treat a single privacy setting as a complete deletion control.
If you handle confidential business information, check which sources the Dot can access and whether the task genuinely requires that information. Limiting unnecessary access is more useful than relying on cleanup after the information has already been processed.
What Happens When You Disconnect an App or Delete a Dot?
Disconnecting an app stops new access through that connection, but it does not necessarily remove information already incorporated into a Dot’s context.
Deleting a Dot removes its own context. Information that has been shared with ChatGPT Memory can be managed separately, while files stored in other locations remain subject to those locations’ retention policies.
Use this distinction when responding to an accidental disclosure or when an employee no longer needs access to a connected service.
A practical cleanup process is:
- Disconnect the app or ask the workspace administrator to remove its access.
- Review whether the Dot has already used or shared information from that source.
- Check ChatGPT Memory separately if relevant.
- Review files and records saved in external services or local storage.
- Delete the Dot if you need to remove its retained context, understanding that this does not delete files stored elsewhere.
Disconnecting access, deleting retained context and deleting a file are different operations. Do not assume that one automatically performs the others.
How Does OpenAI Protect Dot Data?
OpenAI describes several layers of protection, including app permissions, Custom Rules, automated review of certain planned actions and safety monitoring. The company also says content is encrypted while stored and while travelling between users, OpenAI and its service providers.
Another important issue is prompt injection. A website, email or document may contain malicious instructions designed to make an agent disclose information or perform an unintended action.
OpenAI says content encountered during a task does not itself grant permission. Its safeguards are designed to reduce the risk of malicious instructions influencing actions, but OpenAI acknowledges that these protections do not eliminate the risk.
For business deployments, workspace administrators can manage whether Dots are enabled and control capabilities such as local computer access. These settings are separate from permissions granted to individual app connections.
For more detail, consult OpenAI’s official guide to managing Dots in ChatGPT workspaces.
Data-use settings also matter. OpenAI states that Business, Enterprise and Edu workspace information is not used to train its models by default. For personal plans, model-improvement settings determine whether eligible content may be used for that purpose. Model training, retention and access permissions are separate questions, so do not treat them as interchangeable.
OpenAI Dots Security Checklist for Individuals and Businesses
Before connecting a Dot to work accounts, review the following:
- Limit app access: Connect only the services required for the task.
- Set action boundaries: Define which actions the Dot can perform independently and which require approval.
- Protect sensitive operations: Keep a person involved in consequential financial, account, customer-facing and irreversible actions.
- Review local access: Confirm whether local computer access is necessary and enabled.
- Check retained information: Understand how Dot context, ChatGPT Memory and externally stored files differ.
- Inspect delegated work: Use available activity information to review progress and investigate unexpected actions.
- Secure the account: Enable multi-factor authentication and protect access to the account and connected services.
- Plan for revocation: Know how to disconnect integrations and review information that may already have been processed.
For enterprise teams evaluating the wider security landscape, ToolJunction’s guide to LLM security tools for enterprise AI deployments explains why permissions, prompt injection defence, data protection and runtime controls address different parts of AI risk.
Frequently Asked Questions
Can OpenAI Dots access all my connected apps?
No. Access depends on the supported connection, the permissions granted and the actions available through that app. Connecting a service does not automatically provide unrestricted access to every function or record.
Can a Dot send an email without asking me?
The answer depends on the applicable action rules and any authorization you have given. Some actions may be pre-approved within a defined scope, while others require confirmation or user takeover. Review the rules before delegating external communication.
Does disconnecting an app delete information the Dot already read?
Not necessarily. Disconnecting stops new access through that connection, but information already retained in the Dot’s context may remain. Other stored files and ChatGPT Memory are managed separately.
Does turning off ChatGPT Memory erase a Dot’s existing context?
No. Turning off Memory stops further sharing between ChatGPT Memory and the Dot. It does not erase information the Dot has already received.
Are OpenAI Dots completely safe for confidential business data?
No system should be treated as risk-free. Permissions, approval controls, automated checks and monitoring reduce certain risks, but they do not guarantee that an agent will never make a mistake. Assess the sensitivity of the data, restrict access and review consequential work.
Final Verdict
OpenAI Dots can help with ongoing tasks, but their usefulness depends on giving them appropriate access without granting unnecessary authority. Review connected apps, define action boundaries, understand retention and keep human oversight for consequential work.
The most important principle is to treat permissions, approvals and data retention as separate parts of your security plan. A connected app does not mean unlimited access, an approval rule does not guarantee error-free execution, and disconnecting a service does not automatically erase information already retained.
Establish these boundaries before assigning a Dot work that involves sensitive information or business-critical actions.
