Field note
ChatGPT App Permissions: Read vs Write Actions
An enabled ChatGPT app is not one permission. Review connection scope, available actions and when the user must approve.
An enabled ChatGPT app is not one permission. Review connection scope, available actions and when the user must approve.
Three layers, not one switch
When someone says "we turned on the Slack app in ChatGPT", three separate decisions have been made, usually by three different people.
Layer 1: workspace enablement. On Team and Enterprise plans the admin decides which apps and connectors are available at all, and to whom. On personal plans there is no admin; the user decides.
Layer 2: connection scope. When a user connects their account, the app asks for OAuth scopes. OpenAI's own example for an app server lists scopes such as files:read and files:write. That grant is what the app can do with that person's account, regardless of what any prompt says.
Layer 3: per-action confirmation. Apps built on the Apps SDK expose tools. OpenAI's guidance tells developers to use the host's confirmation prompts for destructive actions and to require human confirmation for irreversible operations. In practice, a well-built app marks its tools read-only or write, and ChatGPT asks before a write. A badly built app may not.
Reviewing only one layer gives you a false sense of control. An app that is enabled, connected with a write scope and built without confirmation prompts can change records because a web page told the model to.
Read actions still carry risk
Read is safer than write, but read is not free. A read action moves data from the source system into the conversation, where it is subject to ChatGPT's retention, memory and sharing controls rather than the source system's. A read of your CRM's customer list is now a chat that can be shared by link, exported or remembered.
For a UK firm the practical questions are: what data classes can this app read, is any of it personal data, and where does it go after the chat. Our note on ChatGPT connectors and oversharing covers the source-side audit.
Write actions: the questions to ask
For each app that can write, answer these before rollout.
| Question | Why it matters |
|---|---|
| Which writes exist: create, update, delete, send, pay? | Delete and send are usually not reversible. |
| Is the write reversible in the source system? | A draft can be discarded; a sent email cannot. |
| Does ChatGPT prompt before each write? | Confirmation is the control that catches prompt injection. |
| Can a user switch the prompt off or "always allow"? | A one-time review becomes standing permission. |
| Whose identity performs the write? | The user's account leaves an audit trail; a shared service account does not. |
| Is the app first-party, or a third party's MCP server? | A third party sees the data in every call. |
The difference between a permission and an approval matters here. A permission is what the scope allows. An approval is a person saying yes to one action. We explain why both are needed in AI agent approval versus permission.
A rollout that stays reversible
- Inventory. List every app enabled in the workspace, who connected it, and the scopes granted. If the admin console does not show scopes, ask the user to open the app's connection settings in their account.
- Classify. Mark each app read-only, write-capable, or unknown. Unknown means off until answered.
- Pilot read-only. Enable read apps for one team for a month. Check what turned up in chats that should not have.
- Test one write against a test record. Ask the app to update a dummy contact. Confirm that ChatGPT asked first, that the source system logged the user's identity, and that the change can be undone.
- Check the audit trail on the source side. ChatGPT's logs are limited; the CRM, mailbox or file store must be able to show what changed and who authorised it.
- Decide who may connect write apps. In most small firms this is a named few, not everyone.
- Review quarterly. Apps change their tools. A scope granted in March may cover new write actions by September.
What to write into policy
"Apps may be connected to ChatGPT with read access after IT has recorded the app and the data it reaches. Write-capable apps require approval by the data owner, must prompt before every action, and may not be set to always allow. Personal ChatGPT accounts may not be connected to company systems." Add a sentence naming who can revoke a connection and how quickly.