Always-on agents need standing authority limits, not one-time approvals

OpenAI says its new dots can work towards goals 24 hours a day from their own cloud computer and connect to more than 4,000 apps through plugins. That changes the control problem. A tool that keeps acting between conversations is not merely a chatbot with more integrations; it is a persistent identity with delegated authority.

OpenAI is starting focused enterprise pilots for specialist dots in areas including procurement, invoice processing, email marketing, customer support and commercial contracting. Each specialist dot can have its own identity, credentials and access to the systems required for its role. That is the right architectural unit for governance, but only if the permissions are treated as durable privileges rather than setup choices.

Persistent work needs persistent access controls

A one-time approval answers whether an action was acceptable at one moment. It does not answer whether an always-on agent should retain the same authority tomorrow after its task, context or connected systems change. Enterprise deployments need explicit role boundaries, credential lifetimes and revocation paths for every persistent agent identity.

OpenAI says specialist dots will be integrated with Microsoft Agent 365 governance plus enterprise identity and access controls. The practical test is whether administrators can inventory each agent, see what it can reach, constrain those permissions and revoke them without depending on the agent itself to cooperate.

An agent that keeps working after the conversation ends needs an access model that survives the conversation too.

Approval should follow the action class

OpenAI describes built-in safeguards, access controls, and review and approval of actions. Teams should turn those concepts into an action taxonomy before rollout. Reading a project document, sending an external message, changing a contract record and initiating a payment should not inherit the same approval policy simply because one agent can technically perform all four.

Low-impact actions can operate within standing limits. Irreversible, financial, privileged or externally consequential actions should cross an explicit review boundary. The control belongs at the tool and identity layer, where enforcement does not depend on the model deciding that its own next step is sensitive.

Treat the agent inventory like a service-account inventory

The useful operating model already exists in identity governance. Give every specialist agent an owner, purpose, credential set, approved tools, data scope and expiry or review date. Log actions against that identity and alert when behaviour moves outside its normal role.

Always-on agents make dormant privilege harder to notice because useful work can continue without a human session. Before scaling them, security teams should be able to answer three questions from one inventory: which agents can act now, what each can change, and who can stop them. Persistent autonomy is manageable when persistent authority is visible and revocable.

Written by the Devence Lab research team.