If you run a ChatGPT Enterprise, Edu or Healthcare workspace and do nothing before November 18, 2026, every member gets access to dots on that date and billing for enabled dots starts the same day. OpenAI's admin guide says that "starting November 18, 2026, members have access by default unless the workspace opts out." The free admin preview ends then. That leaves you 12 days from today to choose one of three postures: opt out, limit dots to a pilot group through a custom role, or let the whole workspace have them.
Picking a posture means answering four questions first: who gets an agent that runs on its own cloud computer, what it may sign in to, how it gets paid for, and what your security team can see afterwards.
What Changes on November 18?
On November 18 the default flips from "admin enables it for chosen roles" to "every member has it unless you opt out." During the preview, the admin guide says admins in eligible workspaces "can enable dots for selected roles," and the preview is free. From November 18, access is on by default, and the same page says billing for enabled dots begins that day.
A dot, in OpenAI's product documentation, is "an always-on agent that keeps work moving across your tools and projects." Each one runs in the cloud with its own computer and browser, so it keeps working when the employee's laptop is off. People can reach it from ChatGPT, Slack, Microsoft Teams, texting (in beta for U.S. Pro users) or calls. The same page lists dots as generally available for Enterprise, Edu and Healthcare in eligible workspaces, and excludes workspaces with UAE data or inference residency.
Two details soften the flip. Members still choose whether to create a personal dot, so default-on means everyone can create one; nobody gets a dot automatically. And an admin who later revokes access is not stuck: the dot is hidden, paused and shown as disabled, and billing stops. Restoring the permission brings it back as it was.
How Will Dots Be Billed?
OpenAI has published the billing models but no prices. The admin guide's billing section says eligible Enterprise workspaces can pay a flat rate based on the type of work a dot does, or pay based on consumption. It gives no dollar figures.
The second line on that page will matter more to your finance team: tasks a dot hands off to Work or Codex are charged separately, at standard rates. A dot is built to delegate. Its tasks documentation says it can "divide work among background agents that run in parallel" and keeps running between conversations, including on saved recurring schedules. So one employee's dot can create a trail of Codex and Work tasks, each billed on its own meter, on top of whatever the dot costs.
There is no documented dot-specific spend cap. The user controls page covers pausing, deleting and approval rules and says nothing about spending limits. The admin guide only points to Work usage and cost controls and tells admins to check current plan terms when setting budgets. OpenAI's governance page adds that ChatGPT workspace usage controls "don't set a universal Codex limit." If you already run on OpenAI's pooled credit model, our breakdown of how ChatGPT and Codex will share one usage allowance in December is the other half of this budget.
Here is the strongest case for leaving the default alone. The flat-rate option exists precisely so finance can predict the bill, revocation stops billing immediately, and a workspace that has already invested in ChatGPT Enterprise gets the most value when people can try the newest agent without filing a ticket. That holds if your account team has given you the flat rate in writing before November 18. Without that, you are agreeing to a meter you have not seen.
Which Admin Controls Actually Scope a Dot?
Four workspace permissions decide who gets a dot and what it can reach. Per the admin guide, they are: Use dots; Add dots to Slack and Microsoft Teams; Allow local computer access; and Use custom rules for dots. They sit under Admin Console > Permissions > Workspace default > Workspace capabilities.
The pilot pattern OpenAI documents is to keep the workspace default off and assign a custom role to selected groups. Watch the overlap rule. A member keeps access if any assigned role grants it, so to revoke access you have to remove every "Use dots" grant, not just the one you remember adding.
Three more settings shape what a dot can do once it exists:
- Cloud computer permissions. Under "Let agents use cloud computers," admins control Use a browser, Allow network access and Allow computer use. The guide notes that dots, Work Cloud and team automations share these permissions. Turning off the browser for dots turns it off for those products too, so check with whoever owns Work before you change it.
- Plugin controls. A dot uses its owner's existing app connections and acts only within what that account and the workspace allow. The guide says enabling an app "alone does not authorize a send," because approval settings apply per action.
- Slack identity. A member can connect Slack through their own account or give the dot its own Slack identity. Turning off the dot's Slack identity does not remove its access through the member's connected account. If Slack is your concern, the plugin setting is the one that matters.
Local computer access is a separate opt-in with its own setup. For most first pilots it should stay off.
What Can a Dot Sign In To, and Who Sees It?
A dot signs in to websites from a cloud browser that holds its own sessions, separate from the employee's device. The security guide says laptop sign-ins and VPN connections do not carry over, and that for supported sign-ins "OpenAI sends the password directly from the private form to the cloud browser without exposing it to the model." The product page adds that saving a login is optional and that reusing a saved login for a new sign-in needs the user's confirmation.
Read the caveat in the same security guide carefully. It warns that code on the dot's computer can read an app token or browser cookie if that value is exposed to the code. Session cookies that live in a vendor's cloud browser are the same problem we covered when Sierra bought Anon to let agents log in to websites: whoever controls the browser controls the session. The admin guide's lever here is the "Use password manager" setting, which you should set to match your existing password policy before the default flips.
On prompt injection, the security guide says authority comes from the owner rather than from content the dot reads, and that auto-review checks write actions before they run. "A new recipient needs approval to send." Users set their own handling per action (from "Take action without asking" to "Hand off to you") under custom rules, and the controls page confirms admins can disable custom rules entirely. If your security lead wants approvals to stay on, that is how you enforce it. Our guide to agent approval gates covers why approvals that fire too often get rubber-stamped.
Know what "pause" does before you rely on it. Per the controls page, pause stops the dot's current main task. It does not stop every delegated task or cancel future scheduled runs (those have to be disabled under Scheduled), and deleting a dot does not reverse changes already made in connected apps. For an incident, revoking the role is the stronger stop.
What Your Audit Trail Will and Won't Show
Dot activity now reaches the Compliance API, but each event is kept for only 30 days. The admin guide says compliance records include user prompts and responses, supported tool-call events, and connected-app MCP calls and results, with dot records tagged client_id = DOTS. Admin audit logs capture pause, resume, delete and management changes. The security guide states that "the Compliance Logs Platform retains each event for 30 days from creation," so anything you need for longer has to be exported. OpenAI's Compliance API page describes the export script and recommends testing ingestion into a non-production SIEM first.
Two gaps remain. The admin guide says a requested tool call does not confirm the action completed, so an investigation still needs the receiving service's records. And the security guide says plainly that "neither dots nor Work with local computer access provides strict zero data retention." Deleting a dot removes its own data, with dot-owned backups deleted within 30 days, but files, Codex threads and ChatGPT conversations follow their own retention rules. If you are still deciding what events an agent log should hold, our agent audit logging guide sets out the minimum set.
Some of the gaps we flagged in October's beta review have narrowed. The current security guide says dots inference residency is supported for the US and Europe (not the UAE), and that customer-managed keys protect supported content at rest when Enterprise Key Management is enabled. Dots remain unavailable in FedRAMP workspaces.
What Happened the Last Time a Vendor Did This?
The closest recent precedent for a default-on rollout with an admin opt-out was paused partway through. Microsoft's message center item MC1152323, first published September 12, 2025, set the Microsoft 365 Copilot app to install automatically on Windows devices running Microsoft 365 desktop apps, enabled by default and excluding the EEA. BleepingComputer reported on March 17, 2026 that Microsoft had stopped the forced install, calling it "temporarily disabled," after a rollout that began in early December 2025. The message center item was later updated to a mid-June to mid-July 2026 rollout window.
An opt-out deadline only protects you if the person who owns the setting knows the date. The Copilot rollout put an app on desktops. The dots flip also starts a bill, so missing the date costs money from day one.
What to Do Before November 18
This Week:
- Decide your posture and write it down: opt out, pilot group, or whole workspace. If you cannot get a flat rate in writing from your OpenAI account team by Friday, take the pilot route, since it keeps the workspace default off and limits billing to a group you named.
- Open Admin Console > Permissions and list every role that would grant "Use dots" after the flip. Remove any grant you did not intend; one stray role keeps access alive.
- Ask your account team three questions in writing: the flat rate per type of work, the consumption rate, and whether dot charges and delegated Work or Codex tasks draw from your existing credit pool or bill separately.
Before November 18:
- Set "Use password manager," "Use a browser," "Allow network access" and "Allow local computer access" to match your policy. Agree any browser change with the Work owner first, because the settings are shared.
- Decide whether users may set custom rules. If approvals must stay on, disable custom rules for the pilot role.
- Have your security lead create an admin key with
CODEX_LOGaccess, pull a test export filtered onclient_id = DOTS, and schedule a job that copies those events out before the 30-day window drops them. - Send the pilot group a short note: what a dot may sign in to, that pause does not cancel scheduled runs or every delegated task, and who to call if a dot sends something it should not.
Put the opt-out decision on someone's calendar for November 17.
Continue Reading
- OpenAI's Dots Beta Skips Data Residency and Your OTel Collector
- ChatGPT and Codex Will Share OpenAI's Usage Allowance in December
- ChatGPT Extension Can Control Chrome Tabs on Salesforce, Gmail
- @ChatGPT in Slack and Teams Gives Unlicensed Staff a Shared Account
- Claude Duet checks Gmail, Slack and HubSpot every few hours
- Microsoft Starts Billing for Copilot Harness on December 1