ChatGPT Work Can Act for Hours Without You. Here's the Governance Checklist Before You Turn It On.

On July 9, 2026, OpenAI shipped ChatGPT Work: an agent that takes an outcome, gathers context across your connected apps and files, breaks the goal into steps, and works on it independently — for hours, while you're away from your computer. It returns finished spreadsheets, slides, documents, and web apps. Not chat. Work.

The coverage has been about what it can do. That's the wrong question for anyone deciding whether to switch it on for a team. The question that decides your risk is the one nobody in the launch cycle is asking:

What is it allowed to do?

Capability is not the risk. Authority is.

An agent's danger has almost nothing to do with how smart the model is, and almost everything to do with what you've connected it to. ChatGPT Work running against a read-only folder of last quarter's slides is a productivity tool. The same agent, same model, connected to email, a CRM, and a payments dashboard, is something else entirely — because now the worst thing it can do is not "produce a bad slide."

Every connector you enable is a permission grant. That's the mental model. When OpenAI says the agent "gathers information across your connected apps and workflows" and can "take action across your apps and files," read it precisely: the reach you configure is the blast radius you accept.

This is not a criticism of the product. It's the same truth for every autonomous agent — OpenAI's, Microsoft's Sales and Service agents in Dynamics, Anthropic's Cowork, or something your team built on LangGraph. Autonomy plus reach equals exposure, and reach is a configuration choice, not a model property.

The five questions to answer before you enable it

These are the questions a security reviewer will ask you eventually. Answer them first, and you'll deploy with confidence rather than stall in review.

1. What is its worst-case action?

Given everything you've connected, name the single most damaging thing this agent could do if it went wrong — not maliciously, just confidently and incorrectly. Sends a draft to a customer list. Overwrites a shared model. Posts to a public channel. Whatever it is, write it down. If you can't name it, you don't yet know what you've granted. Most teams discover, at this step, that they connected something they shouldn't have.

2. Which actions are irreversible, and are they gated?

Divide the agent's possible actions into two piles: things you can undo, and things you can't. Reading a doc, drafting a file, searching — reversible, let it run. Sending an email, deleting a record, publishing, committing a payment — irreversible, and those need a human to approve before they execute. An agent working unattended for hours is precisely the agent that must not hold irreversible authority without a gate. Fast on everything safe; paused where it matters.

3. Is every action logged in a form you can review?

When something goes wrong — and across a fleet of agents running for hours, it will — the first question is "what did it do, and why?" If you cannot reconstruct the run, you cannot debug it, defend it in a compliance review, or learn from it. An unattended agent without an audit trail is an unattended agent you're trusting on faith.

4. Is the run bounded?

An agent that runs for hours is a new class of exposure. A supervised chat session is bounded by your attention; a long-horizon run isn't. Set explicit limits: how long can it work, how much can it spend, how many actions can it take, how far can it wander from the original goal? Bound the run and the worst case is bounded by design rather than discovered afterward.

5. What does it do when it's uncertain?

The most important behavior an autonomous agent has is what it does at the edge of its competence. Does it escalate to a named human? Stop and ask? Or improvise? An agent that guesses when uncertain, while acting unsupervised with real authority, is the shape of every incident in the failure library. Define the escalation path before you need it.

The industry just conceded the point

Here's what's quietly remarkable about this launch cycle. GPT-5.6 wasn't released the moment it was ready — it went through a government safety review first, limited to approved entities, before public availability. The most capable AI company in the world accepted a gate on its most powerful model because the potential worst case warranted one.

That's the whole argument of agent governance, applied one layer up. Powerful capability, released behind a review, with the worst case assessed first. If that logic is sound for a frontier model, it is sound for the agent you're about to let run unattended across your company's email and files for six hours.

And notice the direction the platforms are moving: approval flows, admin controls, audit trails, permission scopes. They're building these because enterprise buyers demand them — which means the buyers already understand that the interesting question about an agent isn't its benchmark score. It's the boundary.

The gap the platforms don't close

Each vendor governs its own agent, in its own console, in its own format. That works fine until you're running ChatGPT Work in one team, Microsoft's Service Agent in another, and a custom agent your engineers built on top of Claude. Now you have three governance models, three audit formats, and no way to answer a simple question across them: which of our agents can take irreversible actions without a human?

That's the gap. Not "the platforms won't ship controls" — they will, and they should. The gap is that no platform gives you a vendor-neutral way to declare and compare what each agent is allowed to do, because that isn't in any platform's interest. A common vocabulary has to sit above them.

That's what the AgentAz specification is: a small, declarative file that states an agent's authority — which tools run automatically, which require human approval, what its worst-case action is, and the trust level that follows. It doesn't compete with OpenAI's controls or Microsoft's. It describes agents in the same terms regardless of who built them, so a reviewer can read one file instead of learning three consoles. And because it's a file, a CI check can enforce that a later change doesn't quietly remove a gate that someone deliberately put there.

Before you turn it on

ChatGPT Work is a genuinely impressive product, and long-horizon agents are clearly where the industry is going. The teams that adopt it well won't be the ones who enabled it fastest. They'll be the ones who, before flipping the switch, wrote down what it was allowed to touch, gated the actions they couldn't undo, bounded the run, and defined what happens when it isn't sure.

That takes an afternoon. Skipping it is how a productivity tool becomes an incident report. You can check an agent's declared authority against the same criteria in a couple of minutes, or read how five real agents failed — every one of them for a missing boundary, not a missing capability — in the failure roundup.