ChatGPT Work Permissions and Open-Source Agent Governance with Kortix

Kortix is the open-source AI Management System, and it answers the ChatGPT Work permissions question at the layer where the decisions actually happen. ChatGPT Work governs people inside a workspace through roles and groups. Kortix governs people and agents both, and the rules are files in one git repository the company owns. You can grep the rules, diff any change to an agent or a skill, and roll the configuration back.

The control problem a settings page cannot solve

An agent with a login and an API key can read a customer record, send an email, change a database, or move money. Most platforms answer this with an admin console: an administrator assigns a role, the role carries permissions, and everyone hopes the role is narrow enough. That model was built to govern people who click buttons. It fits badly when the thing doing the work runs thousands of steps a day on its own.

The gap shows up in what the console actually controls. OpenAI's Admin plugin for ChatGPT Work and Codex, announced on August 25, 2026, lets admins review effective permissions, manage access by role or group, adjust limits, and approve spending requests from a conversation (OpenAI). OpenAI states the plugin works within each user's existing role and permissions and does not grant broader access. The same documentation notes the plugin cannot create roles, change a role's permissions, or confirm access to a specific connector (ChatGPT Learn). Controls at that level manage people. The agent's own reach is set somewhere else.

The question behind the phrase "chatgpt work permissions" is usually about what the agent itself is allowed to touch, and who can prove it later.

One git repo holds the whole company

Kortix is built on a single idea: the company is a git repository. Agents are markdown files, skills are markdown files, memory is a folder of files, and the connector configuration, triggers, and machine image live in a manifest called kortix.yaml (Kortix docs). The repo is yours. It is versioned, so every change to an agent or a skill is a diff you can read, and every version is a rollback you can run. Nothing about the company's configuration sits in a vendor database you cannot query.

Because the rules are text, they are reviewable like code. A change to what an agent may do arrives as a commit with an author, a message, and a diff. You can grep the whole company for the agent that holds a given connector, or for the one secret a trigger depends on. A security review that ends with "prove which agents can send email" is a git grep away.

Permissions for people and agents, down to one call

Kortix separates two bindings that most platforms merge. People and agents get roles, expressed as assignments that bind a principal, a role, a scope, and an optional object: for example, the finance group, the member role, one project, and one secret (Kortix docs). An agent carries a second binding inside its manifest, listing the Kortix permissions it may use. A session can only do what both allow. The two never widen each other, so an agent cannot inherit a manager's power simply because a manager started the session.

Object assignments narrow permissions to a single resource. Agents are closed by default: a member reaches an agent only when an assignment names them, one of their groups, or everyone in the project. Other object types are open by default and get closed by an explicit grant. An object assignment restricts a project manager too, which is what makes "scope this agent to the finance group" a real instruction rather than a suggestion.

Below the resource level, Kortix governs the agent's tools per call. A connector action can be set to allow, ask, or block, and the rule matches down to a single shell command or the arguments a call was given (Kortix docs). An ask holds the call while a person approves it, and the approval applies only to that exact request: change the recipient, the amount, or the target and the agent needs a fresh decision. The same gate works from the web app, from Slack or Teams, or from the Review queue, and a deny can carry a message telling the agent what to do instead.

The human gate: work lands as a change request

Every agent works on its own branch inside an isolated sandbox, and a change request is the only route back to the default branch (Kortix docs). The agent commits, pushes, and opens the change request with a diff. It cannot merge its own work. That rule is structural, so no permission can grant it away: a session can open change requests without ever holding the power to merge them.

A human reads the diff and merges it, or sends it back with feedback that wakes the agent to revise. The durable record of what an agent changed is a reviewed commit in a repo you own, sitting next to the commit that authorized it, which a chat transcript cannot show.

Secrets that never enter the machine

Kortix stores project credentials encrypted at rest with AES-256-GCM under a key derived per project, and connector credentials are brokered server-side so they never enter the sandbox (Kortix docs). A secret carries two independent settings: whether agent code can read the value, and who is allowed to spend it. Delivery to a session is the role verdict of the person who started it, intersected with the agent's manifest grant, so both have to allow the value before it arrives.

The strongest exposure level keeps the real value outside the sandbox entirely. Agent code receives a handle, and Kortix substitutes the credential server-side for requests to hosts you approved, then strips any echo from the response. The real value is never an environment variable, a file, or an alias inside the machine. Kortix services that act for nobody, including the Git proxy and webhook signature checks, use only values shared with everyone, so an unattended trigger cannot quietly reach a personal credential.

Vendor-managed control versus an open governance layer

ChatGPT Work is a workspace whose administration happens inside OpenAI's product, where the documented admin controls work within existing roles and do not reshape what an agent may touch. Kortix is a governance layer you host and version, where the same repository that defines an agent also defines the bounds on it. If you are still choosing, the Kortix versus ChatGPT Work comparison covers the wider decision, and the frequently asked questions handle the shorter objections. For teams already convinced, how connectors and automations behave under those bounds and a migration off ChatGPT Work are both a matter of editing the same files.

FAQ

What happens when an agent is not granted a secret?

The session still starts, and the secret is never delivered, so the first call to that host fails as though the credential were wrong. Inside the session Kortix marks a declared key outside the agent's grant as "not granted," and a person can widen the grant from the agent's settings without restarting the session.

Can a project manager be restricted on one agent?

Yes. An object assignment narrows which objects a permission reaches, and it restricts a project manager along with everyone else. Account owners and admins are never restricted by an object assignment, so a business unit can scope an agent to its own group while the owner keeps full access.

How long does Kortix keep its audit log?

Kortix writes one audit row per API request, WebSocket upgrade, preview request, Git transfer, and SCIM call. Events stay in PostgreSQL for 90 days, then move to an S3 archive with Object Lock until 365 days, after which they are deleted. That archive cannot be shortened by anyone, including Kortix staff.

Can Kortix agents run with nobody present?

Yes. A trigger starts a session from a cron schedule or a signed webhook with no person asking, and the work still lands as a change request a human reads as a diff. Because nobody started the session, it holds no personal secrets, only values shared with the agent or the whole project.

Ready to own the rules? Get started with open-source Kortix.