Over-shared project with external data sources

Last updated Oct 17, 2026 Preview Policies Access & Sharing

AI summary

Rencore Governance detects ChatGPT projects that are broadly shared and connected to external data sources; anyone with project access can read data from those systems. To fix these projects, change their sharing to invite-only and remove unnecessary connector scopes.

Severity: Critical External Access Recommended Preview

What it detects

Detects ChatGPT projects that are broadly shared and also pull from an external system.

Why it matters

This is the combination that matters most in the sharing-posture claim: a project readable by people who were never named, reading live data out of Slack, Linear, Google Drive or a website. Everyone with project access effectively has read access to those sources through it. Change the project's sharing to invite-only in its settings - the Admin API cannot change visibility, and Isolate only removes the people it was shared with by name - then remove the connector scopes it does not need from the connector scope inventory. Neither step destroys the project.

The rule

Every ChatGPT Project where Publicly Reachable is true and Connector Scopes is greater than 0

In Rencore Governance

Details

Applies to	ChatGPT project
Connector	ChatGPT Enterprise
Severity	Critical
Category	External Access
Recommended	Yes
Recommended automation	None
License type	Standard

Other policies that check ChatGPT project objects:

ChatGPT project with an inactive owner (Medium)
Publicly reachable ChatGPT projects (High)
Stale ChatGPT project (Low)

Frequently asked questions

What does the over-shared project with external data sources policy detect?

The Over-shared project with external data sources policy detects ChatGPT projects that are broadly shared and also pull from an external system.

Which objects does the over-shared project with external data sources policy check?

The Over-shared project with external data sources policy checks ChatGPT project objects from the ChatGPT Enterprise inventory and reports each one that matches its rule as a violation.

How severe is a violation of the over-shared project with external data sources policy?

Violations of the Over-shared project with external data sources policy have Critical severity. The policy is in the External Access category.

Which module includes the over-shared project with external data sources policy?

The Over-shared project with external data sources policy comes with the ChatGPT Enterprise connector (in preview) in the AI & Agents module of Rencore Governance, an add-on module on the Premium and Enterprise Plans.

Was this page helpful?