OpenAI source-first coverage reconciliation

Research started 2026-11-05 against base 99eaa3d1a38ce28ed421ac4020e37e898ea98c9e. Scope: all current OpenAI product families and their customer-controlled security surfaces. This inventory starts from official documentation indexes, before selecting additions. It is not generated from the finished guides.

No tenants declared — Tier 0+1 only. No product credentials were read or created, no product settings changed, and no product agents installed. Public documentation retrieval and offline fixtures do not establish tenant availability or earn maturity status. Historical Ona live evidence remains historical; changed implementations lose invalidated marks.

Baseline

Dots contract reconciliation before edits

The current dots admin/security pages were downloaded and read in full on 2026-11-05. They document Admin Console > Dots, individual admin pause/resume/delete and identity, CODEX_LOG records with client_id = DOTS, an agent object where available, supported regional/EKM/HIPAA eligibility, independent delegated-task containment and category-specific deletion. These replace the October guide’s contrary claims. The main dot does not inherit Enterprise model defaults.

The public ChatGPT Admin API reference rendered its shell but not a current operation schema in both HTTP and real-browser retrieval. Current Global policy API support is documented; this is an unverified contract, not absence. Historical October group/plugin/memory/offboarding scripts and governance Sigma fields cannot be presented as freshly verified contracts. Retire those generated artifacts and their includes, including the two Dots 6.2 API/CLI scripts that wrongly treated API Platform organization audit events as evidence of ChatGPT workspace policy. The API Platform retains its own independently verified guide. Replace the log exporter with the current first-party downloadable list/download contract; retain only current native TOML emitters. No documented permission or lifecycle feature is removed from guide scope by this automation decision.

Guide Version/date Leveled controls Controls with includes Pack files Types
chatgpt-enterprise 0.3.2 / 2026-10-10 22 7 12 api, config, siem
chatgpt-dots 0.1.1 / 2026-10-09 18 11 16 api, cli, config, siem
ona 0.2.2 / 2026-10-10 22 20 48 api, cli, config, siem, terraform

Enterprise baseline has two API files keyed to 6.6, silently shadowing the run inventory. Its JSONC role/action/approval/checklist examples require native-interface verification; illustrative structures cannot count as executable packs. The whole-corpus validator also reports debt in other vendors, which this lane does not change.

Product and management-plane discovery

Initial successful retrievals on 2026-11-05: https://learn.chatgpt.com/llms.txt, https://developers.openai.com/llms.txt, and https://learn.chatgpt.com/docs/enterprise/dots-admin-guide.md, through public HTTPS curl. Ordinary sandbox DNS failed; escalated public HTTPS retrieval succeeded. The indexes name Work local/cloud, Codex developer and security surfaces, workspace collaboration/admin features, API and Agents, plugin development, Sign in with ChatGPT, Ads, Workspace Agents and commerce. An index entry is a research lead, not verification of its controls.

Source-derived candidate / precise source Plane Conditions, defaults, lifecycle and read/write questions Initial disposition
Dots administration — Manage dots in your workspace Console/admin List, pause, resume and delete personal dots now documented; effective roles additive; shared cloud capabilities and separate local opt-in Verified omission/correction candidate; reconcile dots 7 and limitations 8
Agent Security and managed configuration Global policy, local executor, MDM Requirements versus defaults, precedence, environments and fail behavior; policy API versus UI scope Reconciled below and in product companion ledger; existing dots 4.2 is not all client coverage
Work cloud security and local security Cloud and installed clients Browser/account/network, local mounts, approvals, local persisted state and offboarding Reconciled below and in product companion ledger; no existing product guide
Codex documentation index CLI, IDE, desktop, cloud, managed device Full client/config/auth/sandbox/network/policy/storage census, not just central admin Reconciled below and in product companion ledger; no existing product guide
API documentation index Organization/projects and developer APIs Admin keys, RBAC, project keys/service accounts, data controls, webhook verification, hosted tool egress and state cleanup Reconciled below and in product companion ledger; no existing product guide
Plugin controls, shared connections and Slack/Teams ChatGPT and source services Actors/scopes, per-action approval, publisher trust, shared identity, revocation and attribution Reconciled below and in product companion ledger; reconcile common controls and dots separately
Space, Sites, Teams Workspace sharing/publishing Audience and existing-access boundaries; external disclosure and schedules Reconciled below and in product companion ledger
Codex Security Cloud plugin, local plugin, CLI and SDK Repository scope, validation execution and findings export; distinguish tool security from security scanning Reconciled below and in product companion ledger
Ads, plugins, SIWC and commerce indexes Distinct developer integration planes Determine current status and customer security settings before deciding guide placement Explicit scope-resolution candidates
Ona acquisition/current docs Separate Ona console, CLI, policy, API and Terraform Closed versus announced acquisition; current provider resources/data sources and old live evidence Reconciled below and in product companion ledger; preserve product directory/control IDs
Atlas, Sora, Health and other named products Product-specific Verify current availability, retirement and configuration boundaries from official sources Unverified research leads; not claims of absence

Six-surface questions recorded at discovery

For every admitted handle the final census records status separately from evidence, and enforcement separately from verification. No unavailable reference proves absence.

Surface Read/write decision to verify
Terraform Check complete first-party provider resource and data-source indexes and changelogs; do not assume a community provider is official
API Check ChatGPT Admin/Compliance/SCIM, Workspace Agents, policy and API Platform categories; REST versus GraphQL remain separate questions
CLI Recheck official OpenAI CLI, Codex CLI and Ona CLI, including companion commands; a chat or inference CLI does not imply workspace admin writes
SDK Check actual official admin/security clients and webhook verification; no invented SDK shape
Config Requirements, config.toml, MDM/system policy, cloud environments, plugin manifests and native Ona/Veto; no policy-shaped JSON placeholders
SIEM Check documented exported event families and delivery semantics; unknown tenant schema is a limitation, not an invented event name

Findings and final reconciliation

Initial research format (completed reconciliation follows). Findings use TYPE | title | what the guide should say | fetched source | target; source candidate dispositions and pack counts remain separate.

2026-11-05 source-derived candidate inventory (before guide edits)

All learn pages below were fetched successfully as actual Markdown with matching titles in this session, not accepted as HTML shells. Public retrieval snapshots and status records are held in the ignored validation directory. The public ChatGPT Admin API page was also checked in a real browser: only its shell rendered, with a disabled Download OpenAPI button. Its current schema is unverified. Previously observed October contracts are historical evidence, not a freshly verified current schema. OpenAI’s current downloadable Compliance script was successfully fetched and read; its workspace list/download paths and has_more/last_end_time pagination are independently current.

Candidate / source observation Conditions, precedence, default and lifecycle Disposition / target
SSO: tenant Access connection plus per-product sign-in policy Global admin for shared tenant; standalone Business owner; Optional while testing, Required per intended product; Off disables SSO Correction common 1.1; no API-membership inheritance
MFA: user Security and login enrollment, no workspace/org native enforcement IdP MFA requires required IdP sign-in; enrollment does not revoke existing sessions Correction common 1.2; remove invented admin Require MFA toggle
SCIM: tenant Directory/Product access and product-level scopes coexist Tenant global admin, workspace owner or API owner separately; standalone Business unavailable; Teachers staff only Correction common 1.3, Teachers edition disposition; test other direct/group grants
Roles: seats, built-in admin, custom roles and groups are distinct Ordinary On grants additive; Off is nongrant, Lockdown restrictions separate Correction common 1.4, dots 1.1 and Work 1.1
Lockdown: managed custom role limits supported egress Does not govern Codex networking, training, memory or every managed app; personal per-chat disable differs New common 1.5
Data handling and Work cloud: content categories have separate storage, retention and EKM eligibility Local execution still sends selected context; snapshots, browser state, files, chats and exports separate; no strict ZDR for Work/local access Common 2.1–2.3; Work 3.2; dots 5.1/5.2
GPTs and sharing: build, access and share independently Do not replace GPT controls with plugin controls; sharing doesn’t grant source-account permission Correct common 3.1
Plugin controls: installation, role access, actions, new tools, approvals and content restrictions separate Installed plugin can have blocked app; disabling app need not remove skills; existing connections unaffected by verified-domain new-connection restriction Common 3.2/3.4; dots 2.1; source-system revocation
Plugin public CSV export Public catalog visible to workspace, up to 48h old; excludes custom plugins and member entitlements Common 6.4 review only; never claim effective-permission or trifecta detector
Space: sharing restriction blocks new shares/changes, preserves old access Chat/project deletion doesn’t purge separately stored Library files; copied summaries have destination audience New common 2.5
Sites: create/publish, external and public access separate; grants additive Owner first publish; editors can republish; plugins use visitor identity; UI hiding doesn’t authorize record access New common 2.5; server-side integration boundary recorded
Workspace connections: separate use/manage and source account scope Drive SA without DWD vs delegated access; GitHub user sign-in currently, not GitHub App; disconnect not delete saved copies New common 5.3
ChatGPT Slack and Teams: service-account tools may exceed invoker access ChatGPT role, source install and surface connection separately; selected channels doesn’t prevent DMs; conversation audience sees output New common 5.4, distinct from personal dots channels
Teams/Team Tasks: team SA and connections, prior run/file access shared Member invite/removal, same-workspace join link no owner approval; no per-task/run ACL; pause/delete doesn’t interrupt active run; ownership transfer disables inaccessible connections New common 5.5
Workspace Agents authentication: dedicated token scope Admin enables personal access token permission; Workspace Agents scope is separate from Admin key and API key Common 6.8
Workspace Agents triggers: POST enqueue, beta GET status Stable trigger agtch_, run apirun_; idempotency per event; completed not response retrieval; response content API unavailable Correct common 6.6/6.8; real status-read pack
Compliance: ChatGPT Admin keys and workspace logs Conversation grant owner-only; narrower supported grants; 30-day log platform; current event contract cannot be inferred from removed PDF Correct common 4.3/6.6; one section/type pack; drop invented event enums
Managed configuration: enforced requirements versus defaults and repository instructions Device > supported cloud > system precedence; within policy environment specificity, across higher priority; auth keys device-only Work 1.1/2.1; distinct enforcement and evidence paths
Native config/auth storage requirements TOML /etc/codex or ProgramData, macOS MDM com.openai.codex; keyring fails when unavailable, auto may fall back to plaintext Work 1.1; config emitter only, no deployment claim
Browser and computer: separate native feature gates, origin rules and app identities Browser origin rules don’t constrain Computer Use controlling browser; allow_locked_computer_use=false doesn’t disable already enabled state Work 2.2/2.3; no universal browser allowlist claim
Managed command networking Canonical network_proxy requires Codex 0.166.0; older experimental_network compatibility; full approved escalation can bypass proxy Work 2.4; distinguish hosted web search/apps/browser, VPN, cloud env network
MCP/plugin marketplace requirements MCP name+identity; string command doesn’t pin arguments; marketplace Git/local/host admission doesn’t cover bundled/remote/web/mobile Work 2.5; defaults cannot masquerade as enforcement
Agent Security Global vs execution overrides Global policy API/Terraform documented; contract unverified here. Local/Codex Cloud UI only. Work cloud containers/dots cloud computers have separate execution controls Work 2.1–2.5; dots 4.2; no false local/cloud inheritance
Managed hooks Cloud orchestration supports admin MCP hooks only when enabled, not local/plugin command hooks; PreToolUse transport/timeout/malformed fail-open Work 2.6 and dots 4.3; telemetry not complete audit/enforcement
Cloud environments: published saved filesystem and environment network secrets Existing task keeps saved state; republish affects new tasks; network-secret destination expands restricted allowlist; VPN separate; Legacy still used for review/integrations Work 3.1
Native OTel requirements 0.166.0; macOS desktop 26.1027.30824 bundles alpha without requirements OTel enforcement Work 3.3; exclude prompt/response/tool-result content; current Compliance coverage tested separately
Service accounts: workspace pay-as-you-go SA distinct from API project SA No inherited creator plugins/roles, separate token/config rights, token lifetime, disable revokes all, SCIM userType management Work 1.2; UI implementation/current API schema unverified
Codex Security: CLI/SDK local scan executes with process permissions without interactive approval info --json, scan --dry-run; untrusted scan config can spawn MCP/change destination; Cloud uses personal GitHub connection, not workspace connection Work 4.1; dry-run fixture only
Prisma AIRS: eligible prompt-text external guardrail Block vs Allow-prompt failure separate, Allow default; test then Enable; excludes API-key auth, outputs, tools/results/files/images Work 4.2; no invented universal DLP
Manage app updates: native in_app_updates requirement Enabled by default; disable needs managed patch owner; settings fetch failure may leave updater enabled; not CLI/IDE/mobile Work 4.3
Dots admin: Admin Console > Dots inventory, identity/status/messaging, pause/resume/delete Admin pause can’t be member-resumed; restore previous state; removal of all grants disabled; billing stops; deletion leaves files/threads/chats Correct dots 7.1/7.2 and old limitations; individual attribution now documented
Dots security: current residency, EKM, HIPAA, snapshot/category clocks Storage AU/CA/Europe/IN/JP/SG/KR/UK/US; inference US/EU, not UAE; no strict ZDR, FedRAMP unavailable; region/EKM snapshot wipe 5-day/7-max; otherwise no max for active dot and no early purge; deleted within 30 days of dot delete Correct dots 5.1/5.2; preserve old heading anchor as historical title
Dots identity and logging CODEX_LOG, client_id DOTS and agent ID/name/type where available; TOOL_CALL_SUGGESTED / APP_MCP_CALL/RESULT supported, detailed output/site/approval coverage gaps Correct dots 6.1/6.2; analytics usage not authorization evidence; don’t invent events for lifecycle until schema verified

Automation census and scope decisions

Cross-product ownership and bounded dispositions

OpenAI → OpenAI → ChatGPT common, Dots, Work/Codex, API Platform/Agents, Ona and Statsig. Separate consoles and contracts do not inherit this hub’s settings. Statsig is independently authored in its own ledger. Ads and integration-developer products are reconciled in the API ledger. Teachers district membership/SCIM and Healthcare/clinical plugins are explicit edition sections in common; personal Free/Go/Plus/Pro, Health and Clinicians have account controls, not Enterprise inheritance. Health/Clinicians BAA and connected-service eligibility must be checked per workflow. A healthcare workspace is not permission to use every feature with PHI; event-triggered tasks are specifically not BAA-covered.

Lifecycle records: Sora discontinuation retires web/app April 26 and API September 24, 2026. ChatGPT release notes announced Atlas retirement for August 9, 2026; do not create a live browser guide or equate an announcement with tenant shutdown evidence. Neptune transition hub states SaaS/API shutdown March 5, 2026 and separate self-hosted contract transitions. Pierre announcement dated November 4, 2026 explicitly keeps companies independent pending closing: Pierre/Code Storage and Trees/Diffs/Highlights remain pending-acquisition records, not OpenAI-inherited products. TBPN is acquired media with no documented customer security configuration plane; exclude from hardening controls with that reason.

Additional source candidates before Work guide authoring: Windows sandbox documents preferred MXC with 0.162+ one-command probe, required Windows builds/capabilities, separate prefer_mxc, allow_mxc, legacy fallback allowlist, MXC loopback exception and deny-read glob process-start timing. Managed deny-read prose and implementation differ by native Windows path; do not promise shell enforcement from direct-file-tool enforcement. Linux app is preview with signed distribution repositories, not identical to Windows/macOS updater policy. These are covered in Work 2.1 and 4.4. Managed filesystem deny_read exact/glob paths prevent reads (read-only alone does not) and disallow full access where enforceable; native Windows direct-file versus sandbox subprocess caveats are retained.

Before common-guide edits, the SIWC trial’s website integration and account security notification references were fetched and read. They expose relying-party controls, not API Platform project policy: one-time state/nonce/PKCE-S256, exact registered callbacks and validated identity; signed back-channel logout with fixed discovery/JWKS, 120-second lifetime, atomic replay store and issuer/client/sid or sub-scoped revocation. Cover common integration controls 5.6 and 5.7, with explicit partner-trial and application-owned boundaries.

Pack corrections selected before implementation: remove four unsupported enterprise JSONC pseudo-policies (roles, action control, approvals and checklist), an audit-sample script that cannot establish RBAC, the undocumented agent CSV detector, a no-op suspension script, the duplicate 6.6 invented agent.run inventory, and three Sigma rules containing CONFIRM_IN_TENANT_ADMIN_API_REFERENCE placeholders. These are invalidated implementations, not working controls removed to evade validation. Preserve their control IDs and document current console/evidence paths. Replace 6.6 with one current workspace Compliance exporter and add the verified Workspace Agents beta status GET at 6.8. No fabricated lifecycle or dot event values are admitted.

Further integration/account candidates before insertion: plugin authentication supplies OAuth2.1/PKCE-S256, protected-resource metadata, server-side per-invocation issuer/audience/scope checks, and runtime auth challenges (common 5.8). Commerce production and payment spec supply merchant/PSP-owned TLS, idempotency, order webhook HMAC and single-use bounded delegated-payment tokens (common 5.9); API Platform webhook verification is a different protocol. Health now connects personal medical/Apple Health data to ordinary chats when allowed; legacy Health Project remains separate, permission defaults follow global plugins for new connections, and disconnect deletes synced source data within 30 days but not retained conversations (common 2.6). These are real product-specific dispositions rather than generic Enterprise inheritance.

Final index reconciliation before additional Work controls

Successfully fetched public Markdown bodies by HTTPS on 2026-11-05, including explicit fetch failures for the guessed /docs/config.md path; current index supplied /docs/config-file/config-basic.md instead. No failed fetch is used as evidence of absence.

Candidate and current primary evidence Material observation and disposition
Codex mobile and remote connections Mobile is a controller of Cloud or a paired Mac/Windows executor, not another sandbox. Same account/workspace and per-device pairing; logout disables Remote Control but retains pairings. SSH app-server uses remote user credentials, filesystem and policy; no public listener. Append Work 1.3; public pairing-management API/CLI contract unverified.
Current Slack, Linear, GitHub Current Slack has moved from legacy @Codex to @ChatGPT, published workspace-shared environments, separate user task, approval/cancel and audience boundary; Slack Connect unsupported. Linear assignment/mention and automatic triage use issue creator identity, context-selected legacy environment/repo and latest-used fallback. GitHub review/fix triggers and repository push/admin configuration differ. Append Work 2.7; no invented common webhook, scope string, post-answer toggle or universal lifecycle API.
Config basics and managed configuration Trusted-project config, hooks and rules can affect local execution; untrusted status skips those project layers but user/system layers remain. Enforced MCP identities are separate. Add trust review to Work 2.5. Local cloud policy loads valid identity-matched cache or errors without one; refresh is not immediate running-task enforcement. Current retired untrusted approval policy supersedes older external recommendations.
Self-hosted configuration Admin-owned device requirements choose HTTPS endpoint for CLI/desktop, optional OAuth PKCE and server token verification; defaults and requirements separate in bundle. Cached settings and desktop startup/sign-in behavior documented. Append Work 3.4 with native bootstrap emitter; not ChatGPT workspace policy or an API credential deployment.
Local computer access Body obtained and compared with newer dedicated dots security/admin bodies. Its older beta residency/EKM exclusions conflict with those dedicated pages; retain dedicated current product eligibility and flag source drift, rather than importing stale exclusions. Runtime limitations and policy-plane distinctions agree and remain applicable.

Tier 2 discovery: current CIS catalog body read; no product-specific OpenAI/Ona benchmark identified there. CISA SCuBA landing page returned 403; DISA downloads redirected to a page with no readable body, leaving those lookups unverified. No baseline version or verified absence is inferred from either failure.

Admitted Tier 3 research: PromptArmor’s malicious config report and cross-platform configuration review were fetched in-session. Their repository-trust and integration-trigger leads are reconciled against the current primary pages above. Older recommendations for retired approval policy, legacy Slack behavior and policy-cache failure are not imported as current facts. Snyk’s older Gitpod WebSocket RCE report is historical context, not evidence of an unresolved current Ona flaw. No new third-party source admission was required.

Prism reconciliation before control insertion

The final product/Help cross-check identified Prism/Crixet, absent from the developer feature indexes already reviewed. On 2026-11-05 the official introduction and shutdown notice, current troubleshooting/security FAQ and migration guide bodies were fetched through web retrieval and read. A community discussion was a discovery lead only, not configuration authority.

Prism remains a personal-account collaborative LaTeX product until announced January 1, 2027 shutdown; it must not be grouped with already-discontinued Sora. Current access excludes users who are or have been Business/Enterprise members. Customer controls are explicit collaborator/link audience, personal data controls, individual Zotero linkage and private export/migration. No strict ZDR, no committed privacy/EU-only mode, and no automatic transfer of collaboration permissions/history/comments/live Zotero to Codex. Add full common2.7 and a distinct inventory record. Six surfaces: console export/share verified; current public Terraform resources/data sources, REST/GraphQL administration, CLI, SDK administration, native managed policy and audit/SIEM contract are unverified. Private app traffic is not a public API; no code pack is invented. Codex imported-project execution follows the separate Work guide, including trust and native build review.

CISA KEV fallback succeeded through the official cisagov catalog: catalog 2026.11.04, released 2026-11-04T20:00:05.774Z,1768 entries. A bounded case-insensitive search of vendorProject/product/vulnerabilityName for OpenAI, ChatGPT, Gitpod, Statsig and Codex returned zero matches. This is a catalog lookup result, not a claim of no vulnerabilities or a whole-CISA baseline verdict. The guessed ScubaDocs repository README returned 404; do not count it as a completed baseline read.

Frontier and specialized-program disposition

Fetched 2026-11-05: Frontier platform and introduction establish a separately deployed enterprise-agent platform with customer-specific identities, integrations and execution. Public documentation indexes and focused primary-domain searches did not expose a configuration reference for its console, Terraform/resources/data sources, REST/GraphQL, CLI, SDK, native policy or audit export. All remain unverified contract gaps; vendor governance claims are not operational instructions. Common ChatGPT/API controls do not establish Frontier enforcement. No marketing-only guide or pseudo-policy is created.

GPT-Rosalind Help was fetched and read: trusted-access Research/Discovery approvals differ, API approval is separate, and eligible workspace roles gate Life Sciences/Skills/Codex access. Current Admin Preview is separately off by default. Cover this specific model/workflow in common1.4; native public program-policy schema remains unverified.

SCuBA documented fallback: official ScubaGear README and ScubaGoggles README both fetched 200 and read on 2026-11-05. Their documented assessment scopes are Microsoft365 and Google Workspace respectively; neither supplies OpenAI/Ona product configuration in the fetched introductions. This bounds the lookup, rather than claiming the entire CISA baseline catalog was verified.

Integrated offline verification

The family validation record separates public-source evidence, offline contract checks, rendered output and outstanding tenant/CI validation. Native configuration emitters validate the declared profile; public SDK dependencies are pinned and locked. No live tenant was accessed.