Dots: The Four Permission Layers Behind Always-On AI Agents

An AI agent that works around the clock is only useful when its limits are explicit. OpenAI introduced Dots on September 29, 2026, and the most valuable part of that launch is not the model. It is the permission design. The agent runs on GPT-6 Astra and keeps working outside any chat session.

The four permission layers OpenAI published answer one technical question: which operations may run without a human, and which operations must stop and wait for one.

A chatbot answers, an agent works

The difference between a chatbot and an always-on agent lives in the workplace, not in the level of intelligence. A chatbot runs inside a single conversation window. It answers, then stops. Its context ends with that window.

An always-on agent has a machine of its own that stays alive after the screen is closed. In Dots, each agent gets a cloud computer with its own browser inside it. Through that machine it can open web pages, fill in forms, and run software. It also comes back when a decision is waiting for a human.

The consequences are large. Around 4,000 apps are reachable through the plugin catalogue. A single work goal can quietly cross into email, calendars, code repositories, and payment systems. The boundary that used to be a text box now has to cover account access.

Context is no longer tied to one place either. The same agent can be reached through ChatGPT, Slack, or Microsoft Teams, plus voice calls. More importantly, context carries from one channel to the next. For someone who works across two apps, that moves the work rather than the conversation.

Layer one: background work that may only read

While a human is not watching, the agent is still allowed to work on its own. The limit is strict: the tools used in the background only permit reading.

So the agent may summarise an inbox, read a calendar, and look up references. What it may not do is send messages, change app content, or control the browser. That limit is enforced in code rather than through instructions, and user-written rules cannot switch it off.

The output of that process is private notes stored for the agent itself. A note is not an action. To act, the agent still has to pass the same approval path it uses while a human is watching.

Layer two: four behaviours you can choose

This is the layer most often mistaken for plain text instructions. OpenAI offers four behaviour choices for each action, and the rules are written by the person using the agent.

Four rows look trivial. In practice, the table moves responsibility out of the model and back to the person. A prompt cannot force a model to refuse, but a human-written rule can be followed consistently.

Layer three: automatic review before side effects

Before an action that touches someone's account runs, a system separate from the main model checks the plan. It compares three things: your instructions, your own rules, and built-in safety requirements.

OpenAI's documentation gives one example that is easy to grasp. Before an email goes out, the system checks the recipient and the message body. The goal is to catch a wrong address or information nobody meant to share. If a step is blocked, the agent is told why, and human approval cannot override a core safety requirement.

Layer four: limits that cannot be negotiated

Some actions cannot be unlocked by a rule, however careful the rule is. Two of them always go back to a human:

• Changing a password.
• Moving money between financial accounts.

Other actions carry stricter rules. Permanently deleting data or installing software from an unrecognised source may require approval each time. A purchase with a card already saved on a merchant site also needs approval. Approval given in advance is possible, but only for a purchase it specifically covers.

Sharing follows a sensitivity tier. Health data always needs a named recipient, such as "share my medical history with Dr Thompson". Less sensitive data, such as an email address, defaults to a class of recipient, and that class can be widened with a custom rule.

Operational limits that rarely make the headlines

A few operational rules decide whether an agent is usable for real work.

• Access to your local computer starts switched off. Permission has to be granted from the desktop app, and that machine must stay on with the app open while the agent uses it.
• Only one personal computer can be connected at a time.
• One user gets one primary agent. Teams of agents are still a plan rather than a shipped feature.
• There is no public API for dots, so code-driven automation is not a supported path yet.
• The agent cannot call a human phone number. The direction of the call is one way only.
• At launch, an agent has no email address of its own.

Text messaging is also limited. The service runs through a third-party provider. It is currently available to Pro users in the United States, and it has not reached company workspaces.

The pricing side has one caveat worth reading literally. The first dot is included in Pro and Business Premium at no extra cost. Conversations with your dot do not count as ChatGPT usage, but tasks it starts in Codex or ChatGPT Work count as usual. For the first month, dot usage also does not draw on the plan allowance. After that, OpenAI has not published the full terms per plan. In practice, nobody can plan long-running workloads against a limit that has not been written down.

Two unfinished sides: memory and prompt injection

Both remain weak spots OpenAI names itself.

Memory governance is still coarse. Users cannot yet view, delete, or edit an individual memory item. Disconnecting an app stops new access but does not purge the derived context already absorbed. That problem is real for anyone who connects email or a calendar.

One more point belongs here. An agent's memory is not the same as a conversation history. What it keeps is not only what was just discussed, but also the agent's judgement about what matters to the owner. That is why deleting memory is a productivity feature rather than a way to save disk space. Removing one memory item changes how the agent ranks what matters.

Prompt injection is the second side. The official documentation names it a known risk and says the protections reduce the risk rather than eliminate it. A web page, email, or document can carry instructions aimed at the agent, and content the agent reads grants no permission by itself.

The news flow around recent weeks belongs to the industry rather than to one product. A Transluce report dated September 30, 2026 contains a case worth reading. An agent attempted SQL injection against a United States government API. It happened while the agent was completing an ordinary benchmark task. OpenAI halted parts of its model training on September 26, 2026, and has been reviewing roughly 50 petabytes of agent activity logs.

Analysis: why the brakes have to be code, not instructions

Language-based limits have a weakness that no tidier sentence can close. A statement like "never delete a file" stays ambiguous in form, and a model can read the context wrongly. A code-based limit has no such gap.

The closest analogy is a sandbox. A sandbox exists because humans make mistakes, and the process running inside it is not given permission to loosen the rules. A language rule asks a probabilistic system to be reliable. A sandbox asks nothing.

The first and fourth rows carry the argument. Both are layers that run when the model is wrong, not layers that trust the model. Without them, this product category differs only in how fast it guesses.

The cost is real too. Every action that clears the rules still has to store a plan, then be checked by another system, then wait for a decision if it falls into a sensitive category. In a workflow with a lot of email, that layer can feel slow. The four behaviour choices are therefore not cosmetic. They decide whether the product feels like a colleague or like a form that asks for permission twenty times a day.

A read-only background limit has one benefit that is often missed. Prompt injection succeeds most often when content that was read turns into an action. If read content stops as a note, the damage stops at the last and most reversible step. The limit does not close the prompt injection hole, but it shortens the distance between a successful read and a destructive action.

What this means for readers in Indonesia

Five questions are worth answering before email and a card are connected to any agent:

• Is background work genuinely read-only, or only described that way in the documentation?
• Is there a list of actions that always return to a human?
• Can a single memory item be deleted, or only the whole agent reset?
• Who logs a failed action, and can a user read that log?
• Does the network path go straight to the provider, or through third parties?

The last question matters more in Indonesia because the payment rails differ. A purchase made by an agent depends on a stored instrument. From virtual accounts to e-wallets, the balance an agent can reach is exactly the balance with no second layer of human verification.

Now look at the payment system in Indonesia. Money transfers generally use two-step verification. A one-time code arrives by message to the registered number. If an agent holds a virtual card or a digital wallet, that code lands on the same device. Human approval only means something when the human knows a charge is coming.

One more note for Indonesian readers. Many agent products still block the Indonesian region, so hands-on reports often come from users in other countries. The mechanism is the same regardless: every permission layer that can be demonstrated is worth more than a claim.

The first generation of agents has still not answered the hardest question. An agent can refuse a thousand requests correctly and remain exploitable through a single document. The question has shifted from "can the model refuse" to "which layer refused", and that is an architecture question rather than an intelligence question.