OpenAI’s Data Agent for ChatGPT Work can move from finding business data to producing analysis and taking approved actions. That last step changes the security model: the agent is no longer only answering questions, so organizations need explicit read, export and write boundaries.
OpenAI announced broader access to the Data Agent on September 10, 2026. It is installable as Data in the ChatGPT Work plugin directory and is designed to connect databases, files, semantic layers and BI systems.
The workflow has four permission layers
| Layer | Typical capability | Required control |
|---|---|---|
| Discover | Find tables, files, metrics and dashboards | Catalog visibility by user and group |
| Read | Query rows, documents and semantic models | Source-native row and column permissions |
| Export | Create tables, charts, dashboards and apps | Output classification and sharing policy |
| Act | Write back or trigger an approved connected action | Named approval, narrow tool scope and audit event |
Semantic layers matter more than schema access
A database schema explains where data is stored. A semantic layer explains what a metric means, which filters apply and which relationships are valid. OpenAI positions the agent as able to use both raw sources and business context.
That can reduce plausible but incorrect joins. It can also amplify a bad metric definition. Teams should version metric definitions and save the semantic objects used for each published result.
Approved actions need a real approval object
A natural-language request such as “fix the forecast” is not an approval record. A safe action should carry the requester, target system, exact mutation, affected rows or objects, time limit and rollback plan.
- Separate read tools from write tools.
- Require the agent to present the exact planned change before execution.
- Bind approval to that plan rather than to the whole conversation.
- Reject execution if the plan, user, target or data has changed.
- Save the tool input, response, approver and resulting object identifiers.
Run a role-matrix test before launch
Create test identities for an executive, analyst, regional manager, contractor and revoked employee. Give them intentionally different source permissions. Ask each identity the same set of questions and compare what the agent can discover, read, summarize, export and change.
The test should include indirect leakage. A user may be blocked from a table but still receive its numbers through a generated dashboard, cached artifact or summary created by another user.
A six-step pilot
- Connect one low-risk database and one governed semantic layer.
- Keep every tool read-only and run 30 completed questions with known answers.
- Compare queries, joins, metric definitions, citations and missing-data behavior.
- Enable artifact creation for a restricted test workspace and inspect sharing defaults.
- Add one reversible write action with exact-plan approval and a low impact ceiling.
- Revoke access, rotate credentials and verify that cached sessions cannot continue.
Measure more than answer accuracy
| Metric | Why it matters |
|---|---|
| Permission precision | Unauthorized facts or actions are a release blocker |
| Metric fidelity | A fluent answer can still use the wrong business definition |
| Evidence completeness | Reviewers need the source objects and transformations |
| Correction time | The agent should reduce total work, not shift it to reviewers |
| Action reversibility | Every write needs a bounded recovery path |
| Total cost | Include model, connector, compute, retries and human review |
What OpenAI has not published
The launch page does not provide a plan-by-plan public price, universal connector matrix or service guarantee for every source and action. Availability can depend on the organization’s ChatGPT Work configuration and connected systems.
Information gain: the Data Agent should inherit source-native permissions, but every generated artifact and action creates a new boundary that must be tested independently.
My take: start at read-only truth
The Data Agent can be valuable where analysts lose time finding definitions and moving results between tools. The dangerous adoption path is to grant broad write access before the organization can reproduce read-only answers.
Start with metric fidelity and permission precision. Then add artifacts. Add actions last. Our agent trust-gate architecture and MCP migration guide provide related patterns for approval and state.
Primary sources
Checked September 11, 2026. Capability and availability statements come from OpenAI. The role matrix, approval object and pilot sequence are MustHave.ai analysis.
