Policies for ChatGPT Enterprise
AI summary
ChatGPT Enterprise policy templates help you identify governance issues across seven categories: security, guest access, oversharing, inactive accounts, unused resources, licensing, and operations. Each template checks specific objects and flags violations with severity ratings; recommended templates guide you to prioritize which checks to run first.
These are the policy templatesPolicyA policy is a governance rule that Rencore Governance checks against your inventory, for example Teams without owners.Read more for ChatGPT EnterpriseChatGPT EnterpriseChatGPT Enterprise is the business plan of the ChatGPT AI assistant by OpenAI.Read more, grouped by what they look for. Each template checks one kind of object and flags every item that breaks the rule. The severity shows how serious a violation is; a Recommended pill marks the templates Rencore recommends you start with.
See the ChatGPT Enterprise inventory reference for the objects these templates work on.
Security 5
Risky settings, weak credentials and access that is wider than it should be.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Agent runs without a human and reaches external systems Recommended | Detects published agents that ran from a schedule, webhook or API call in the last 30 days and can reach a connector. | Critical | ChatGPT agent |
| Pending invitation grants owner or admin rights Recommended | Detects pending invitations that would grant the owner or admin role on acceptance. | High | ChatGPT invitation |
| ChatGPT login bypassed SSO Recommended | Detects users who signed in with a password rather than through the identity provider in the last 30 days. | High | ChatGPT user |
| ChatGPT user with no Entra ID identity Recommended | Detects ChatGPT users who do not match any Entra IDMicrosoft Entra IDMicrosoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant.Read more user by email. | High | ChatGPT user |
| ChatGPT workspace with too many admins Recommended | Detects workspaces where more than five users hold the admin role. | Medium | ChatGPT Workspace |
Guests and external access 5
Guests, external usersExternal userAn external user is an account whose home tenant belongs to another organization, invited into your tenant to work with you.Read more and content shared outside your organization.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Shared Codex environment with repository access Recommended | Detects CodexChatGPT CodexCodex is the OpenAI coding agent that is part of a ChatGPT Enterprise workspace.Read more sandboxes that are shared and can reach source repositories. | High | ChatGPT Codex Environment |
| Invitation sent to an external domain Recommended | Detects invitations to addresses that match no Entra ID user or match a guest. | Medium | ChatGPT invitation |
| Custom GPT calls an external domain without authentication Recommended | Detects custom actions that call an external host with no authentication configured. | High | ChatGPT custom GPT |
| Plugin listed to the whole workspace bundles an MCP server Recommended | Detects discoverable plugins that install an MCP server any member can reach. | High | ChatGPT plugin |
| Over-shared project with external data sources Recommended | Detects ChatGPT projects that are broadly shared and also pull from an external system. | Critical | ChatGPT project |
Oversharing 3
Content that more people can open than need to.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Publicly reachable custom GPTs Recommended | Detects custom GPTsCustom GPTA custom GPT is a version of ChatGPT that someone in your ChatGPT Enterprise workspace configured for one purpose and can share with others.Read more reachable outside the workspace by link or through the GPT store. | High | ChatGPT custom GPT |
| Publicly reachable ChatGPT projects Recommended | Detects ChatGPT projects reachable outside the workspace or by every member. | High | ChatGPT project |
| Workspace-wide custom GPTs with editable configuration Recommended | Detects custom GPTs every workspace member can reach and edit. | Medium | ChatGPT custom GPT |
Leavers 4
What people who left, or whose accounts are disabled, still own or hold.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Inactive user still holding objects Recommended | Detects inactive workspace users who still own GPTs, projects, agents, Codex environments or library files. | High | ChatGPT user |
| Manually managed ChatGPT user Recommended | Detects workspace users who are not provisioned through SCIM. | Medium | ChatGPT user |
| Custom GPT with an inactive owner Recommended | Detects custom GPTs whose owner is inactive or no longer in the workspace. | Medium | ChatGPT custom GPT |
| ChatGPT project with an inactive owner Recommended | Detects ChatGPT projects whose owner is inactive or no longer in the workspace. | Medium | ChatGPT project |
Clean-up 5
Inactive, empty, ownerless or outdated objects you can archive or delete.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Idle Codex machine still paired | Detects developer machines not seen for 30 days that are still paired for remote control. | Low | ChatGPT Codex machine |
| Stale custom GPT | Detects custom GPTs whose configuration has not changed in 90 days. | Low | ChatGPT custom GPT |
| Stale invitation | Detects invitations still pending more than 30 days after they were sent. | Low | ChatGPT invitation |
| Stale ChatGPT project | Detects ChatGPT projects whose configuration has not changed in 90 days. | Low | ChatGPT project |
| Unused Codex environment with repository access Recommended | Detects Codex sandboxes that can reach repositories but have never run a task. | Medium | ChatGPT Codex Environment |
Licenses and costs 5
Licenses, spend and storage that cost money without being used.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Codex seat with no Codex usage Recommended | Detects users on a Codex seat who have not used Codex in 30 days. | Low | ChatGPT user |
| Group without a default spend limit | Detects groups with no default cap, whose members fall through to the workspace default. | Low | ChatGPT group |
| Idle ChatGPT seat Recommended | Detects users with no usage this month or last month. | Low | ChatGPT user |
| ChatGPT user with no spend cap Recommended | Detects users whose effective spend limit is unlimited. | Medium | ChatGPT user |
| ChatGPT user over 80% of their spend cap Recommended | Detects users whose month-to-date usage has passed 80% of their effective cap. | Medium | ChatGPT user |
Operations 3
Day-to-day hygiene: naming, ownership, settings and configuration.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Connector scope failing to sync Recommended | Detects external data sources attached to a project whose last sync failed. | Medium | ChatGPT connector scope |
| Service account credential expiring within 30 days Recommended | Detects active service account credentials that lapse in the next 30 days. | Medium | ChatGPT service account credential |
| Shared custom GPTs affected by the GPT retirement Recommended | Detects custom GPTs shared beyond their owner, which stop working when OpenAI retires custom GPTs. | High | ChatGPT custom GPT |
Frequently asked questions
How many built-in policies does Rencore Governance provide for ChatGPT Enterprise?
How many built-in policies does Rencore Governance provide for ChatGPT Enterprise?30 built-in policies, such as Agent runs without a human and reaches external systems, Codex seat with no Codex usage and 28 more.
How are the ChatGPT Enterprise policies grouped?
How are the ChatGPT Enterprise policies grouped?By category: Security, Guests and external access, Oversharing, Leavers, Clean-up, Licenses and costs and Operations.
Which ChatGPT Enterprise policies are recommended?
Which ChatGPT Enterprise policies are recommended?Agent runs without a human and reaches external systems, Codex seat with no Codex usage, Connector scope failing to sync and 22 more.
Which module includes the ChatGPT Enterprise connector?
Which module includes the ChatGPT Enterprise connector?The ChatGPT Enterprise connector is part of the AI & Agents module of Rencore Governance, an add-on module on the Premium and Enterprise Plans. The connector is in preview.