ChatGPT Work permissions vs open-source agent governance

What an admin console controls

An admin console controls people and the product surfaces their role can reach. OpenAI's roles and workspace permissions page names six control boundaries that a request must pass: the ChatGPT workspace, local clients, hosted Codex workflows, the Platform API, plugins, and the connected systems themselves (checked October 2026). Inside the workspace boundary, a seat decides which surfaces a member can use, and a built-in role decides administrative authority. The Owner role manages workspace-wide settings, the Admin role manages supported operations and groups, the Member role has no administrative rights, and the Analytics Viewer role can access workspace analytics.

Only workspace owners configure role-based access control and create custom roles. An owner assigns a custom role through a group or directly to one member, and groups can be managed by hand or synced through SCIM. For each eligible permission, the workspace default sets the baseline, and a role either grants access with On or withholds it with Off. A plugin becoming available in a workspace does not grant access to data: the connected service still decides which data the signed-in account can read. OpenAI's own ChatGPT Work admin FAQ describes governance as three layers, one for who can use Work on each surface, one for who can build, publish, share, schedule, or configure reusable agents, and one for the local runtime.

What governs an agent's reach

Kortix separates what a person may do from what an agent may touch. An agent is agents/<name>.md (behavior) plus an agents.<name> block in kortix.yaml (governance). Access comes as roles: one assignment binds one principal, a person, a group, or an agent's service account, to one role at one scope, and an optional object narrows that assignment to a single agent, skill, secret, app, or trigger.

An agent carries a second, separate binding: the Kortix permissions its manifest declares under agents.<name>.kortix_permissions. A session can only do what both allow, and the two bindings never widen each other. Per-resource permissions for people and agents. Roles, groups, and an audit trail. Every connector call runs under one of three policies, shown as Allow, Ask, or Block. Approval holds the call; the agent's turn pauses and resumes. Approval gates are off until you set them. The connectors and automation page covers how a connector is declared in kortix.yaml and how those policies attach to each call, down to the arguments.

The change-request gate

A session runs on its own branch, and session work reaches main through a change request. Merge is default-deny for agents. A session can never merge a change request it opened itself, whatever it has been granted. The agent commits on the session branch, pushes the branch, opens the change request with kortix cr open, and stops. A person reviews the diff and merges.

Nothing merges itself: work reaches main through a change request a person approves, unless an admin granted the merge capability. Opening and merging are separate permissions, project.gitops.push and project.gitops.merge, so a token can open change requests without the power to merge them. Kortix permissions are repository state in the manifest, so the same access model travels with the repository. Run it on Kortix Cloud, in your VPC, or on your own on-prem network, and the self-hosting setup keeps the grants in the repo you control.