Everyday AI data handling
ChatGPT
Set ChatGPT app access before linking data
For a ChatGPT Work connection that supports Action control, allow only the actions the task needs and choose an appropriate App permissions prompt policy. Verify the connected identity and source-system scope separately. A read-only action setting, a request for approval and a personal or shared account each govern a different part of the connection.
For Enterprise AI administrators and SaaS security
A prompt policy does not reduce the account’s source-system permissions.
Worked intended configuration and synthetic task. No app is connected or administrator setting changed.01
Separate the administrative layers
OpenAI documents plugin availability, underlying app availability, workspace or role access, connection authorisation and source-system permissions as distinct requirements. Making a plugin available does not automatically connect an account or approve every action it could perform.
Choose one app and one task for the review. Confirm that the connection exposes the relevant native controls before following the example. If it does not support Action control, record that limitation rather than describing the proposed configuration as active.
Source context: OpenAI: Apps and connectors for enterprise · OpenAI: ChatGPT Work security
02
Configure a restrictive example in native controls
In the workspace’s app administration, locate the connection’s Action control and App permissions settings. For the worked example, select read-only actions and, where offered, Any changes as the prompt policy. Read-only limits the allowed action set; Any changes controls approval behaviour and does not add a permission to write.
The example task is to read one synthetic reference note. Keep the source-system account limited to that test resource. These are documented control names and an intended configuration, not an API payload or a claim that every app exposes identical options.
| Native control | Worked example choice | Purpose |
|---|---|---|
| Action control | Read-only actions | Exclude unnecessary write capabilities |
| App permissions | Any changes, where offered | Prompt policy, not an action grant |
| Connected account | Personal test connection | Use the authorised person’s source scope |
| Source-system access | Synthetic reference only | Limit data visible to the connection |
Source context: OpenAI: Apps and connectors for enterprise · OpenAI: ChatGPT Work security
03
Review personal and shared connections separately
A personal connection uses the connected employee’s source-system permissions. A shared or agent-owned connection uses the permissions of its connected account, which can differ from those of the person making the request. The same prompt can therefore have a different effective data boundary depending on the connection selected.
Do not reuse the personal-account approval for a shared connection. Record its owner, resource scope and who may use it. Limit that account at the source system as well as through available app action settings.
Source context: OpenAI: ChatGPT Work security
04
Run a synthetic least-privilege check
The pack provides a fictional reference note and a verification plan. If an authorised administrator performs a test in an approved isolated connection, first confirm that the permitted read works. Then inspect the available tools and effective action settings without invoking a modification. Record that as a capability or settings inspection, not an observed denied request. An authorised negative-operation test, if needed, must use only the disposable synthetic resource and record its actual result separately.
Keep the action-setting result separate from a permission prompt. A prompt asking for confirmation is not the same as the write capability being excluded. Record the connected identity, effective settings, observed tool behaviour and source-system evidence. All test results in the download start untested.
05
Review changes to capabilities and connections
OpenAI’s app guidance recommends reviewing how newly added actions are handled where controls support it. Revisit the record when an app gains capabilities, a connection changes identity or source permissions expand. Preserve a permitted read path without silently granting broader actions.
This page focuses on native app configuration and its verification, not a general agent inventory or rollout narrative. Aona’s supported endpoint policy paths are another question; no claim is made that Aona configures ChatGPT Work apps or blocks every connector action.
Source context: OpenAI: Apps and connectors for enterprise
Put it into practice
ChatGPT Work connected-app permission exercise
Use native action and prompt controls with a restricted test identity, then record a synthetic read/write distinction.
Worked intended configuration and synthetic task. No app is connected or administrator setting changed.
Action control
Which app actions may be used
Example: read-only
App permissions
When ChatGPT asks before using them
Example: Any changes where available
Connection identity
Which source-system data and actions the account can access
Review personal/shared accounts separately
| Control or test | Intended example | Observed |
|---|---|---|
| Action control | Read-only actions | Unverified |
| App permissions | Any changes where offered | Unverified |
| Account | Personal test identity, restricted resource | Unverified |
| Read synthetic note | Allowed if configuration supports it | Untested |
| Write capability inspection | No write capability exposed by the reviewed read-only scope | Untested |
Work through your review
Use the checks to organise the evidence you need. Save your selections in Word, then add your notes and evidence. Your selections stay in this tab until you download them.
0 of 3 reviewed
Examples and review material
Read the detail here, or keep the PDF, editable Word document and spreadsheets together.
ChatGPT Work native app reviewRead
This is an inert configuration record and test plan, not an importable policy or API request. It connects no app and changes no settings.
For an authorised isolated test, choose a connection that actually supports Action control. In its native workspace app settings, review read-only actions and the offered App permissions choices. The worked example uses read-only plus Any changes where offered, with a personal account restricted to the synthetic note. Preserve all existing organisational restrictions.
Confirm the permitted read first. Inspect the available tools and effective action settings without invoking a modification. This establishes a capability/settings observation, not a denied-operation result. Any separately authorised negative-operation test must target only the disposable synthetic resource and retain its actual outcome. Do not approve a real write merely to complete the review. Repeat the identity review separately before considering a shared account.
Guide and sources
Canonical guide: https://aona.ai/resources/guides/chatgpt-work-connected-app-security/ Source review: 2026-09-21
- OpenAI: Apps and connectors for enterprise: https://learn.chatgpt.com/docs/enterprise/apps-and-connectors
- OpenAI: ChatGPT Work security: https://learn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-security
Intended native settingsRead
Notice: WORKED INTENT ONLY; NOT AN IMPORTABLE CONFIGURATION
Required control support: Action control must be available
Action control: Read-only actions
App permissions: Any changes where offered
Connection kind: Personal synthetic test connection
Source scope: Only the synthetic reference note
Applied: false
VerificationRead
| Case | Connected identity | Effective action control | Effective prompt policy | Intended result | Observed result | Evidence | Evidence type |
|---|---|---|---|---|---|---|---|
| Read synthetic note | PERSONAL_TEST_IDENTITY | Read-only actions | Any changes where offered | Allowed if supported | UNTESTED | Observed read if performed | |
| Inspect write capabilities without invoking them | PERSONAL_TEST_IDENTITY | Read-only actions | Any changes where offered | No write capability exposed by reviewed read-only scope | UNTESTED | Capability or settings inspection; no write invoked | |
| Shared account review | SHARED_ACCOUNT_TO_REVIEW | RECORD | RECORD | Separate source-scope decision | UNREVIEWED | Identity and scope review | |
| New action introduced | RECORD | REVIEW DEFAULT HANDLING | RECORD | No unreviewed expansion | UNTESTED | Capability or settings review |
Connection decisionRead
App/connection and native control availability: ____________________ Action control setting: ____________________ App permissions setting: ____________________ Personal/shared/agent-owned identity: ____________________ Source-system scope and owner: ____________________ Synthetic read result: UNTESTED Write-capability exclusion evidence: UNTESTED New-action handling and review owner: ____________________ Decision: NOT YET REVIEWED
Original practice files
Keep these examples in their original format to inspect the details described in the guide.
Synthetic reference noteTXT
SYNTHETIC U07 REFERENCE
The fictional team reviews one example note and records an owner.
No company account, customer information or confidential data is included.
Before you proceed
Keep these distinctions clear
- Using a prompt policy as an action allowlist
- When an app asks for approval and which actions it may use are separate controls.
- Assuming shared means the requester’s permissions
- A shared or agent-owned connection uses its connected account’s source-system scope.
Apply it to employee AI use
Bring your actual data path.
Aona secures employees’ AI use on supported, installed endpoint paths.
Aona does not configure native ChatGPT Work app controls or guarantee enforcement of every connected-app action.
Keep the native app/identity decision with the workspace administrator and scope any supported endpoint test separately.
Review your use caseFAQ
Questions for this decision
Does Any changes mean the app has read-only access?
Does enabling a plugin automatically authorise its app connection?
Does a shared connection use the requesting employee’s permissions?
Can the downloaded JSON apply these settings?
Evidence behind the guide
Sources and scope
Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.
- OpenAI: Apps and connectors for enterprise
Documents native Action control, App permissions, availability and source-system authorisation layers.
vendor · checked 2026-09-21 - OpenAI: ChatGPT Work security
Explains read-only/action prompting distinctions and personal versus shared connection permissions.
vendor · checked 2026-09-21