OpenAI Dots Builds Its Agent on a Permission Ladder

The most important sentence on OpenAI’s dots page is not about what the agent can do — it is about what the agent is structurally forbidden from doing.

Every quotation below is verbatim from OpenAI’s own dots product page of 29 September 2026, read directly. This is a single-source piece by design. No safeguard described here has been independently tested by this publication, and OpenAI’s own warning is quoted rather than paraphrased: dots can still make mistakes, so consequential work should always be reviewed. Specialist dots are a preview in focused enterprise pilots and the Microsoft Agent 365 integration is described as work in progress; neither is shipped. Nothing here is investment advice.

What Happened

On September 29, 2026, OpenAI launched dots — described on its own page as “remarkably capable, always-on agents built to handle everything.” Each dot is “powered by GPT-6 Astra,” runs on its own cloud computer, “learn from feedback over time,” and can “work towards your goals 24/7.” A dot is reachable “whether it is through ChatGPT, Slack, or Teams”, and separately the page offers to “simply hop on a voice call”. Dots reach “over 4,000 apps” through plugins. The capability half of the announcement takes roughly a paragraph.

What takes considerably more space is the constraint architecture. Before any capability claim is made actionable, OpenAI sets out, in sequence, what the agent may not do, what it cannot see, and which tasks it is structurally prevented from completing at any permission level. The page’s single most precise sentence sits near the top and frames everything that follows: “Certain sensitive tasks, such as changing a password, always stay with you.”

Three states exist on the page and they are not equivalent. Shipped today, rolling out to Pro and Business Premium users in eligible markets: personal dots, with the first included in existing plans at no extra cost and extended limits for the first month. A preview only: specialist dots, where “Your company sets up each dot with its own identity, credentials, and access to the systems it needs to complete its tasks” — OpenAI is explicit that “We’re starting with focused enterprise pilots” across procurement, invoice processing, email marketing, customer support, and commercial contracting.

Work in progress: “We’re also working with Microsoft to integrate specialist dots with their enterprise governance and security controls in Agent 365.” Those are three meaningfully different commercial positions and the distinction matters.

The Structural Read

Read the safeguards on the dots page as a ladder, because that is how they are constructed. The first rung is isolation: “Each dot works on its own cloud computer, while your computer and its contents stay separate unless you choose to connect it” — paired with an inspection right: “You can open your dot’s computer at any time to inspect its work.” The second rung is credential handling, designed so the model itself is never in possession of secrets: “For signing into supported websites, dots can use saved passwords without exposing them to the model.”

The third rung is where the architecture becomes structurally interesting rather than merely careful. Background activity — what OpenAI calls “proactive research,” the work the dot does when you are not actively engaged — is constrained by construction, not configuration:

Read-only tools cannot send a message however the prompt is phrased. That is the point. The fourth rung is rules: “Dots start with built-in rules for when to act independently and when to ask for approval. Custom Rules let you allow specific actions, require approval, or block them. Built-in safety requirements always apply” — and every action is followable “including background work, in Activity View.” The fifth rung is a gate: “Dots use auto-review to check actions that could affect your accounts or share information against your instructions, Custom Rules, and safety requirements.

This helps determine what work can proceed, what needs approval, and what you must do yourself.” And there is a stop: “If our monitoring system detects a safety concern, it can pause or stop the dot’s work.”

This publication has spent the week on vendors building machinery to govern what an agent may do — a wallet capped to a budget, credentials as a first-class component, an approval gate on publish, send, and spend — and on Nvidia putting the same idea into a DPU. Dots is that argument made by a model maker, in software, on its own product. The pattern is consistent across all of them: a limit that has to hold against the agent cannot be a preference the agent can be talked out of.

A password the model never receives cannot be leaked by the model. A task that always stays with you is not delegable at any permission level. That comparison is anchored only to pieces this publication has already published; no market-size claim follows.

One observation is available only because two pages went up on the same day. Dots is powered by GPT-6 Astra, the flagship. Hours earlier, OpenAI shipped GPT-6.1 Sol, whose single price change was a halved cached read that its own page describes as “giving developers more room to build and run capable agents that reuse context across requests.” The agent-priced model is not the one powering the agent product.

OpenAI gives no reason for that split, and this piece offers none: it is an observation about two pages published on the same day and nothing more.

On training, both sentences together, as they appear: “We don’t use content from ChatGPT Business, Enterprise, or Edu workspaces to improve our models by default.” And: “We don’t train directly on proactive research or your dot’s notes to itself. Information from them may be used if it helps inform an eligible conversation or task, depending on your settings.” The single outside example the page offers: an early tester’s dot “noticed he’d forgotten to invoice a publication, prepared the invoice, and sent it after his approval” — note the last three words.

OpenAI’s own caveat belongs next to all of it: “Dots can still make mistakes, so always review consequential work.” No safeguard described in this piece has been independently tested by this publication.

Three Implications

The Bottom Line

OpenAI launched an always-on agent today, and the most structurally significant part of the announcement is a sentence about what the agent will not do: certain sensitive tasks always stay with you — not as a default, not