Which product and account does this cover?
ChatGPT chat, Work, dots, and the separate local controls in Codex.
- Chat and connected apps
- App availability and permission choices vary by plan, region, connection, and workspace.
- Work and Codex
- Work is available on supported surfaces for eligible paid plans. Managed workspaces control Work Cloud, Work Local, and Codex Local separately.
- Dots
- Gradual rollout: Pro 100/200/500 for adults outside the EEA, UK, and Switzerland; Business Premium worldwide; Enterprise worldwide with admin enablement.
What the permission settings mean
Connect one account and inspect its reach
Open Settings → Plugins, choose the app, and follow Connect or setup. Read the provider's access request before authorizing it. Start with the account that has only the source access this job needs; connecting your everyday account can expose much more.
Installing a plugin is not authentication. Some Google setup flows offer Select fewer apps; individual requested permissions may still be required.
Start with explicit review
Choose Always ask where offered. Inspect the target and action before approving. Allow low-risk actions delegates some decisions to automatic review; Allow all actions is broader and not always offered.
A written instruction such as “draft only” explains your intent. It does not remove write permissions from an app. For a stronger boundary, use a provider identity with read-only access and leave unnecessary connections unavailable.
Separate apps, the browser, and local commands
Connectors, signed-in browsers, and computer access are separate routes. Inspect each before treating work as read-only.
In Codex, select an appropriate restricted permission profile and inspect its scope; Ask for approval does not mean every permitted operation pauses. ChatGPT web does not have Codex's local sandbox selector. Where offered, Settings → Data controls → Work network access controls code and shell networking, not web search, plugins, or the remote browser.
Keep dots visible and review their rules
For a dot, use desktop/web Settings → Personalization → Custom rules under Permissions. Add specific rules for sending, publishing, deleting, or sharing. Rules do not grant new access or disable required safety review.
Open the dot's Activity to inspect ongoing and delegated work. Pause stops its main task; stop delegated tasks separately and disable future runs in Scheduled. Revoke local access through the dot's Computers controls when it is no longer needed. Closing a laptop is not a substitute.
Manage memory, training, and disconnection separately
Review Settings → Personalization → Memory to inspect or correct remembered information where supported. Settings → Data controls → Improve the model for everyone controls personal-account model improvement; switching it off does not delete chats. Codex's Include environments setting is separate.
Disconnect an app account through Settings → Plugins → app → its account menu → Disconnect. This stops future access through that connection, not retention of earlier chats, files, or memories. Dots also retain their own context: individual dot memories cannot currently be edited or deleted; deleting the dot removes its context, while separately stored files and conversations remain.
Practice with fictional material
Check the read boundary and keep the draft in chat
Use two harmless practice documents with different unique markers. Give the connected identity Viewer access to A and no access to B. Keep B out of uploads, memory, other connections, and signed-in browser sessions.
- Start a fresh conversation. Select Always ask if offered and keep browser/computer access unavailable for this test.
- Ask for the marker and source link from A, then ask for B's marker without revealing it. Approve only the intended read.
- Ask: “Draft a reply here only. Do not create an email draft, send, share, edit, or schedule anything.” Decline any change request.
- Inspect the tool activity, the source's version/activity history, and the mail account's Drafts and Sent folders. A provider draft is itself a write.
Check the evidence
- A is correctly sourced; B is reported inaccessible rather than guessed.
- The reply appears in chat; no provider draft, message, source edit, or schedule was created.
- This verifies the tested route and task. Repeat after changing accounts, connections, or permissions.
Common questions
Does disconnecting prove old information is gone?
No. Test future access with a new harmless fact added after disconnection. An answer from an old copy or memory does not establish current source access.
Does a successful test guarantee every future task?
No. Keep source permissions narrow and review consequential work; automatic review and rules can make mistakes.
Official sources
These instructions were checked against product documentation on October 31, 2026. The practice exercise is a suggested test for your own permitted workspace, not a claim that these controls were configured in your account.
Keep the whole workflow in view.
Set permissions for the tools you use.
Start with the overview, then follow the guide for your assistant or connection. Check what it can read, what it can change, and where approval happens.
Read the Controls overview