What is a Dot allowed to do while it is only reading, and what needs a yes from you?

While an OpenAI Dot is only researching, the tools it uses for that research cannot send messages, change app content, or control your browser or computer. A follow-up that would send, edit, pay, delete, or change a password is a different action, and it needs the permission and the safety check that go with it. Asking for a draft does not give permission to send the draft. OpenAI says that in the controls guide, in one sentence: asking your Dot to draft replies does not give it permission to send them.

There is no switch I found named “reading mode.” What exists is this research limit, plus plugin permissions that can allow a read and refuse a send, plus custom rules, plus a short list of actions you must do yourself. A Dot announced on 29 September 2026, on GPT-6 Astra, with its own cloud computer, can look through apps you connected. Looking is not the same grant as acting.

What can the research pass actually touch?

Apps you have connected, with the tools OpenAI says are fenced for that research. The controls page says a Dot can research information from those apps to look for ways to help, and that those particular tools cannot send messages, change what is in the app, or drive the browser or the computer. Any follow-up is subject to the same permissions and safety requirements as any other action. So a morning pass that reads a calendar and an inbox, if those plugins allow read, can come back with notes. It cannot, on that research path, send the email it noticed or rewrite the document it opened.

Plugin permissions are the other half, and they are separate from custom rules. Open Plugins is the control next to the rules. Your existing ChatGPT app permissions apply to the Dot. The computers guide uses the example that matters here: you can allow it to read email without allowing it to send email. If the plugin is read-only, a later “send this” does not inherit a send scope from the fact that reading worked. If the connection expires, you reconnect it before anything continues. Disconnecting the app does not delete what the Dot already read. Deleting the Dot is how OpenAI says you delete information it obtained. Read the confirmation. Reset or Delete removes conversations, memories, and scheduled tasks, and it does not undo a message that already left.

OpenAI also says it does not train models directly on proactive research or the Dot’s private notes. If that research becomes part of an eligible conversation or task, your ChatGPT data settings apply. Reading is still data leaving the app and entering the Dot’s work. The training line is not a promise that the read never happened.

What needs a yes, even if you think you only asked it to look?

Anything that could affect your accounts or share information goes through an automatic review first. The review checks your instructions, your permissions, your custom rules, and built-in safety requirements. It can let the action proceed, ask for your approval, or include a step you must do yourself. Changing a password is the example they give for a step you do yourself. The safety FAQ adds transferring money to that takeover list, and says permanently deleting data or installing software may require approval each time. A supported sign-in form does not show the password to the model, and changing the password is still your hands on the computer, not a research side effect.

A saved login needs your confirmation before it is reused to sign in. Custom rules cannot remove that confirmation, and they cannot turn off the takeover for a password change. They also cannot grant access to an app or a computer the plugin does not already allow. A rule is an instruction the Dot tries to follow. OpenAI says it can make mistakes. If your workspace disables custom rules, saved rules do not apply and you cannot edit them.

The four rule types, under Settings, then Personalization, then Custom rules, then Add, are worth naming because “yes” is not one button:

• Take action without asking does the specified action with no approval.
• Take action when you say so proceeds when you explicitly request it, and otherwise asks immediately before acting.
• Ask before taking action asks every time for that action.
• Hand off to you asks you to do the action instead.

OpenAI’s examples match the split in the question. Ask before taking action for sending messages to customers. Hand off to you for deleting shared project files. Writing style and how you like updates belong in the conversation, not in these rules. The rules are about when an action may happen. You do not need a rule for every approval. A clear instruction can cover future actions inside its scope. An action outside that scope needs another decision. “Draft the replies” is inside a reading-and-drafting scope. “Send them” is outside it until you say so.

Where does a draft stop being reading?

When it would leave your account or change something. Sharing information is on the review list. A summary that stays in the Dot’s chat with you is not the same event as a message posted where other people can see it. A Slack or Teams connection, where your plan allows it, is a way to talk to the Dot. OpenAI’s computers page says adding a contact method does not connect your inbox. Messaging the Dot in Slack does not grant send-on-Gmail. If the Dot later posts in a channel, other people in that channel can see the post. That is a send, into a room, and it is not covered by “I only let it read email.”

Computer control is also outside the research fence. Research tools cannot control the browser or the computer. A task that clicks through a site, edits a local file, or uses a connected PC is an action with its own permission. Local access starts off, and it needs Allow access on one computer, with the ChatGPT app open while that machine is in use. Cloud files on the Dot’s own computer are the Dot’s workspace. Telling it to read a doc there is still not permission to email the doc.

Scheduled tasks are where a read quietly becomes a habit. Open Scheduled and read the instructions, the timing, and the destination. A schedule that says “check the inbox and draft” can stay inside the research fence. A schedule that says “check the inbox and reply” is a send, every time it runs, unless a rule or the review stops it. Pause stops the Dot’s current main task. It does not stop every delegated task, and it does not cancel future scheduled runs. Open the delegated task in Activity to stop that one. Disable or delete the schedule separately. Stopping work does not undo a completed action. A message already delivered is not recalled by Delete either.

What should you leave as a human yes?

Leave send, publish, pay, delete, install, permission changes, and password changes as yeses. Use the plugin to allow read and not send on the inbox. Use Ask before taking action for customer messages if you want a card even when you were the one who said “send.” Use Hand off to you for deletes. Leave Take action without asking for something you have already watched succeed and could stand to see happen again, and write it narrowly. A rule that allows “everything in email” is how a read becomes a send without a fresh yes.

Give the ongoing instruction a scope you could read aloud: who is involved, what should happen, and when. “Look at this week’s customer mail and draft replies in my voice” names a read and a draft. It does not name a recipient list, a send, or a standing order for next week. A specific instruction can cover future actions inside that scope. The controls page says an action outside it needs another decision. If you later say “send the three I marked,” that sentence is the yes. It is not hidden inside the earlier draft request. If you want that yes every time, add Ask before taking action for sending. If you want the Dot to stop and let you press the control, choose Hand off to you. Take action without asking is the rule that removes the card, so do not put a send on it while you are still deciding what “only reading” means.

Leave the Activity list as the place you look, not the chat’s last bubble. Background work shows up there, including tasks waiting on a decision, a connection, a sign-in, or an approval. Reading can finish while you are away, because the research tools are allowed to look. The yes is what stands between that look and the next verb. If you did not grant the next verb, the Dot is supposed to stop at the draft. Check that it did. The review can be wrong in the direction of a mistake, which is why OpenAI tells you the rules are instructions, not a lock, and why the plugin permission is the lock you can actually see.