To answer what data can ChatGPT agent access through connected apps, start with one rule: the agent inherits the connecting user’s existing access, bounded by the OAuth scopes granted at connector setup and by workspace admin controls. Exact behavior varies by connector type, authorization path, sync state, and workspace tier. Connectors set the ceiling; runtime policy decides whether each action should run. Administrators need a data-type-by-data-type answer and a control at the moment each tool call executes, not just at setup.

Last updated: August 2026.

ChatGPT agent combines browsing, tool use, and connected apps so it can retrieve content and take actions for a user. That range is useful. It also means the answer to “what can it touch” depends on scopes, inherited roles, indexing, retention, residency, and training settings that most buyers evaluate too late. This guide walks each dimension, maps data types to permissions, and shows where connector configuration ends and execution-level governance begins. ChatGPT agent sits in the human-to-agent phase of AI adoption: employees delegate tasks to an agent that reasons, retrieves, and acts. That raises different governance questions than a simple chat session.

ChatGPT Agent permissions: data types the agent can reach per connected app

Each connector exposes a specific slice of data, not the whole service. The precise data types depend on which connectors OpenAI supports and what each connector’s documented scopes cover. Per OpenAI’s connector documentation, connected apps can surface mail messages and attachments, files and documents the user can open, calendar events and attendees, and repository or code content where applicable (OpenAI, 2026). Database or business-record access depends on the currently supported connector list. Verify whether a given database or CRM connector exists and what it exposes against that page before relying on it. Confirm the current connectors and documented scopes there before approving any connection, because available connectors and their scope coverage change over time.

Map data by type for every connector your workspace approves. The table below sets the evaluation frame: what a connector may expose, whether the scope is read or read-write, and the question an administrator should ask before authorization.

Review source-system least privilege before you authorize any connector. ChatGPT agent cannot compensate for overbroad access already granted inside a connected app. If a user has broad access to shared drives, an approved connector carries that access into agent tasks wherever the connector, scope, and workspace policy permit retrieval.

How OAuth scopes and inherited access set the ceiling

An OAuth scope is the permission string a connected app requests when a user or administrator authorizes it, and it defines the maximum data the agent can reach through that connector. A read-only scope supports retrieval and summarization. A write or action scope can permit changes, sends, shares, or deletes where the connector and workspace policy allow those actions. Two variables compound the scope: the connecting user’s existing role in the source system, and whether the connection was authorized per user or by an administrator for the whole workspace.

Authorization responsibility differs by path. With per-user authorization, the individual employee approves the connector and its scopes for their own data, so accountability sits with that user. With workspace-level administrator approval, one administrator enables a connector for many users at once. That centralizes control but broadens the blast radius of a single approval. Both paths need a documented owner.

Inherited access is the part buyers underestimate. The agent sees what the user sees, subject to the scope granted. If a customer-success lead can open a wide set of shared documents, the agent acting on their behalf reaches that same set within scope. This is why least-privilege hygiene in the source systems matters before ChatGPT agent connects. OWASP ranks Excessive Agency (LLM06) and Sensitive Information Disclosure (LLM02) among the top risks for AI applications, because over-scoped access turns a helpful agent into an uncontrolled data path (OWASP, 2025).

1. Enumerate every connector your workspace allows and the scopes each requests from its source documentation.
2. Separate read scopes from write and action scopes; flag any scope that can send, modify, delete, or share content.
3. Confirm whether each connection is user-authorized or admin-authorized for the whole workspace, and record who authorized it.
4. Map inherited access in the source system: what the connecting user can already open or send is the effective ceiling for the agent.
5. Confirm retention, residency, training policy, indexing behavior, and Compliance API events for the exact workspace tier before approval.
6. Decide which actions need an inline control at the moment of execution, separate from the standing scope grant at setup.

ChatGPT Agent permissions: read access versus write and action

The sharpest line in connected-app risk is read versus act. Read-only scope lets the agent retrieve and summarize content: pull a document, read a thread, list calendar events. Write and action scopes let it take consequential steps: send a message, edit a file, share a document link, update a record, or push a code change. OpenAI’s ChatGPT agent documentation describes the agent taking actions for the user across connected services and the browser (OpenAI, 2026).

Autonomous action is where connector configuration and runtime governance split apart. A standing scope permits an action unless workspace policy, connector behavior, or a runtime control stops that specific execution. Approving a scope once does not approve every future action taken under it. That gap between permissioned access and real-time execution is the control problem this guide returns to throughout.

When you decide what to approve, separate the authorization question (which scopes to permit) from the execution question (what the agent actually does under those scopes). Both need a deliberate answer. Read more about access control at the agent execution level in the Aurascape guide to least-privilege access control for AI agents.

Admin controls, RBAC, connector sprawl, and personal-account bypass

In short: admin console controls govern sanctioned connectors inside the managed workspace, but they do not reach personal accounts or endpoint AI apps. Enterprise, EDU, and Business workspaces give administrators controls to approve, restrict, or block app connections, apply role-based access control (RBAC), and set security and compliance policy for connectors (OpenAI, 2026). These settings are the front door: they set which connectors are allowed, who may authorize them, and what compliance posture applies to managed workspace traffic.

Permission sprawl follows connector adoption without ongoing review. Stale connectors keep broad write scopes that outlive the project they were approved for. Admin-enabled connectors approved for one team reach more users than intended. Employees who switch roles carry over connector authorizations that no longer fit their current access. Each stale or over-broad scope is an open window an approved action can run through.

Pair admin connector policy with discovery that covers managed workspaces, personal accounts, endpoint AI apps, and API traffic. A personal ChatGPT account outside the managed workspace can move organizational data outside administrator-approved connector policy and outside the workspace logging path the team relies on for sanctioned use. ISACA found 90% of organizations report employees using AI tools, but only 38% have a formal, comprehensive AI policy (ISACA, 2026). Connector approvals inside the workspace do not close the personal-account gap.

ChatGPT Agent data retention, residency, indexing, and training policy

In short: retention, residency, indexing, training, and logging behavior are tier and connector specific, so confirm each one against OpenAI’s admin documentation before approval. Separate three things buyers often conflate: content used to answer a task in the moment, content retained or indexed so it can be retrieved across later sessions, and content used to train models. These are different questions with different answers, and each carries its own compliance weight.

For each approved connector, confirm whether content is indexed for retrieval, how long related records are retained, where workspace data is processed or stored, whether training exclusion applies, and which Compliance API events are available for review.

Retention and residency controls govern where content rests and for how long. They do not classify the specific data moving through a connector at the moment of retrieval or action. Classification at the interaction layer is a separate control. Compliance API logging records workspace-level activity for later review. Interaction-layer evidence captures who triggered a governed tool call, what data the agent retrieved or transmitted, and what policy decision applied at that instant. For regulated industries, the combination of residency, training exclusion, and Compliance API logging decides whether ChatGPT agent can be approved for data that carries GDPR, HIPAA, or sector-specific obligations. See the Aurascape guide to AI compliance frameworks for regulated industries for a broader governance reference.

Prompt injection risk and ChatGPT Agent audit logs

Connected apps expand the attack surface by feeding the agent content it reads but did not originate. A document retrieved through a file connector, a webpage browsed during a task, or a mail attachment opened to summarize can each carry embedded instructions that redirect the agent’s next action. This is indirect prompt injection: the malicious content reaches the model through a trusted data source rather than the user’s prompt. OWASP lists Prompt Injection as LLM01, a top risk for AI applications (OWASP, 2025).

EchoLeak (CVE-2025-32711) demonstrated a zero-click indirect prompt injection in an enterprise copilot: the exploit needed no user action beyond opening content the agent retrieved through a connected service (NVD, 2025). Scope restriction alone does not stop it, because the agent is already authorized to read the content. The control is inline inspection of the action the agent attempts after reading it. The Cloud Security Alliance found that 82% of organizations have unknown AI agents operating in their environments, which makes connector visibility and runtime governance a practical approval requirement (Cloud Security Alliance, 2026).

Audit is where many connected-app deployments fall short, because a network log rarely shows what the agent did inside a connected app. A defensible audit record for each governed agent action should capture a specific set of fields:

1. The user who triggered the action, and the account or tenant, sanctioned or personal.
2. The connector and the data type touched.
3. The action attempted (read, send, modify, share, delete) and the recipient or destination.
4. The policy decision that applied, and the log source that recorded it.

Where Aurascape governs the access connectors grant

Connector settings define what access the agent could use. Aurascape governs what the agent actually does with that access at the moment of each tool call in governed workflows. Aurascape discovers and secures local AI agents and their interactions, and adds a Zero-Bypass MCP Gateway that marks approved tool calls and blocks unmarked ones, governing the agent-to-tool execution path inline rather than observing it (Aurascape, 2026). Model Context Protocol (MCP) is one common tool-execution pattern, not the whole agent access-control problem. Aurascape governs approved agent workflows at the interaction layer, including MCP tool execution and other traffic paths that traverse the Aurascape proxy.

Three capabilities close the gaps connector administration leaves open. Discovery surfaces shadow AI apps and personal ChatGPT accounts routing organizational data outside admin-managed connectors (Aurascape, 2026), covering the personal-account and endpoint-AI paths the admin console cannot reach. Real-time inline classification, backed by 600+ real-time data classifiers, inspects the specific content the agent is about to retrieve or transmit through a connected app (Aurascape, 2026). And context-aware policy actions, allow, coach, warn, block, and redact, apply to the exact interaction, producing interaction records for governed agent actions, governed by RBAC for privacy. For an overview of agent access control principles this approach builds on, see the Aurascape guide to AI agent identity and access management.

Frequently asked questions

What data can ChatGPT agent access through connected apps?

It can access the data types each connector exposes, within the OAuth scope granted at setup and the connecting user’s own access in the source system. That generally includes mail messages and attachments, files and documents the user can open, calendar events and attendees, and code content where applicable. Confirm the current connector list and documented scopes against OpenAI’s connector documentation before approving any connection.

Does the agent get more access than the user who connects it?

No. The agent operates within the connecting user’s access and the connector’s OAuth scopes. Broad user permissions in the source system carry over into agent tasks, which is why source-system least-privilege review matters before any connector is authorized.

Can ChatGPT agent send emails or modify files autonomously?

Only when the connector holds write or action scopes and workspace policy allows those actions. A read-only scope supports retrieval. A write or action scope can permit sends, edits, shares, or deletes depending on connector and workspace configuration.

How do administrators restrict connected apps?

Enterprise, EDU, and Business admins can approve, restrict, or block connectors and apply RBAC and compliance policy from the admin console (OpenAI, 2026). These settings govern sanctioned connectors inside the managed workspace. They do not reach personal accounts or endpoint AI apps routing organizational data outside the workspace.

Is content from connected apps retained or used for training?

It depends on workspace tier and connector settings, so follow a decision path: check the workspace tier, check the connector’s sync or indexing behavior, check the training policy and whether training exclusion applies, check the residency setting, and check which Compliance API events are available. Confirm each against live OpenAI admin settings before approval.

What is the prompt injection risk from connected apps?

Externally sourced content the agent reads through a connector, such as a document, webpage, or attachment, can carry embedded instructions that redirect its next action. This is indirect prompt injection. EchoLeak (CVE-2025-32711) showed a zero-click variant in an enterprise copilot (NVD, 2025). Scope restriction alone does not prevent injection; inline inspection of the action the agent attempts is the additional control.

What does runtime governance add beyond connector admin controls?

Connector controls set standing scopes. Aurascape adds runtime checks for the content, recipient, action, user context, and policy decision when governed agent activity runs through the interaction layer. A write-scoped connector still faces inline classification and policy enforcement at each specific action, not only at the moment the connector was authorized.

Aurascape closes the gap between connector approval and agent execution: discover the AI apps, agents, and personal accounts touching your data, classify the specific content each connected app exchanges in real time with 600+ data classifiers, and govern every governed agent action inline with allow, coach, warn, block, and redact, backed by interaction records for each governed step.

See how Aurascape governs what ChatGPT agent can access and act on in your environment →