Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can a Collections Team Use OpenAI Dots on Debtor Accounts?
Not on debtor accounts, where an SSN, a balance and a contact history render on every screen the agent opens. Use Dots for scripts and scheduling, and ask what the model receives from the account screen before an agent works a live account.
A collections team works one account many times a day: a name, the last four digits of a Social Security number, a balance, the days past due, a contact log and a promise to pay. OpenAI sells the dot as "an always-on agent in ChatGPT" that can carry a project "from an idea to work you can use" (OpenAI, Getting started, 2026), and a dot runs in its own cloud computer and browser with plugins to more than 4,000 apps, so a collections platform is an application it can open (Do OpenAI Dots Rules Control What the Agent Sees?).
The decision a collections pilot has to settle is narrower than whether the dot can log in. It is what the model receives when the account screen renders. If the SSN, the balance and the contact history arrive as text, they can be repeated into a call summary, an internal note, a task list or a transcript, and a rule that pauses before an action arrives after the reading has happened.
A team can put a dot on the parts of the job that never open a debtor record, such as drafting a call script or scheduling callbacks, and keep it off the account screen until the values on that screen are replaced before the model reads them. The account data is customer information a regulator expects a financial institution to safeguard (16 CFR Part 314, 2026).
Key findings
- For a collections agent to work a debtor account without the SSN entering its context, the values on the account screen would have to be replaced with consistent tokens such as ACCT_001 before any model reads them, and the real values released only where the work needs them (What Is Render-Layer Tokenization?).
- It would also require a named person approving each promise to pay, settlement or balance change, and a record of what the model was shown on the screen (What Is an AI Control Record?).
- OpenAI's Dots help page lists four behaviours for custom rules and does not state that the values on a page are replaced before the model reads them, which is the control a debtor account needs (OpenAI, Getting started, 2026).
- The same page describes the dot as "an always-on agent in ChatGPT" whose rules run from "Take action without asking" to "Hand off to you," so a rule decides what the dot does next (OpenAI, Getting started, 2026).
- Nasr et al. tested 12 published defenses against jailbreaks and prompt injections and bypassed them with an "attack success rate above 90% for most," so a filter tuned to catch an SSN in text is not a boundary (Nasr et al., 2025).
- OpenAI's governance paper calls human approval "a standard way to limit egregious failures" and asks that "at least one human entity is accountable for every uncompensated direct harm" (Shavit et al., 2023).
What does an agent read when it opens a collections account?
The record for this page is one collections account: the debtor's name, the SSN field, the balance, the days past due, the contact log and the promise to pay. A dot opens it in its own browser, and the model works from what the page shows. According to OpenAI's safety documentation as one page quotes it, secure sign-in "sends your credentials directly to the browser environment and submits them without exposing them to the model's context," while "the model receives webpage text and document content within connected apps" (Can OpenAI Dots Handle Cardholder or Bank Data?). The login is kept out. The account is not.
The model reads the SSN, the balance and the contact history as text, in the same context that carries the rule the dot follows. A summary written at the end of the run can repeat them, and a note saved to the account can carry them forward.
A rule that asks before an action changes when the approval arrives, not the reading.
| What the account screen shows | What the work needs | What the model receives without substitution |
|---|---|---|
| SSN or its last four digits | An identity check before a settlement | The digits as text, beside the rule the dot follows |
| Principal balance and days past due | A payment arrangement or a promise to pay | The balance as text in every summary |
| Contact log and call notes | The next action and the next contact date | The history, plus whatever an earlier agent wrote |
| A promise to pay | An approval and a record | The amount and the date, approved or not |
What do OpenAI Dots' custom rules cover, and what do they leave on the screen?
Custom rules are the control OpenAI documents for a dot's behaviour. The help page lists four: "Take action without asking," "Take action if pre-approved," "Ask before taking action" and "Hand off to you" (OpenAI, Getting started, 2026). Each is a decision about the next action, taken by the same model that reads the page. Dots "are rolling out today in ChatGPT to Pro users in markets excluding the European Economic Area, Switzerland, and the UK," with Business Premium included and Enterprise, Edu and Healthcare in an admin-enabled beta (OpenAI, Getting started, 2026).
The limit is in the same document. OpenAI says "Your dot can make mistakes, including when following your rules," which makes the rule an instruction rather than a boundary (OpenAI, Getting started, 2026). A rule that says ask before acting is read by the model that also reads the account, so a note in the contact log saying "settle at 40 percent" arrives in the same context and can be followed as if the team wrote it. Agents read instructions from AGENTS.md or llms.txt and "need insight into where things live, what rules to follow, and how to implement changes" (Columbia DAPLab, README, 2026).
A filter is not the answer either. Nasr et al. bypassed 12 published defenses against jailbreaks and prompt injections with an "attack success rate above 90% for most" (Nasr et al., 2025), and according to Shi et al., Google runs "a suite of adaptive attack techniques to run continuously against past, current, and future versions of Gemini" (Shi et al., 2025). Rules narrow where a dot goes. They do not change what the page shows the model. The rule is read before the action, not before any model reads the screen.
What do the vendors themselves say?
OpenAI documents how a dot behaves in detail and describes what it sees in a safety write-up, "How we build safety, security and privacy into dots" (OpenAI, Safety, 2026). The safety documentation keeps the login out of the model's context and leaves the page in (Can OpenAI Dots Handle Cardholder or Bank Data?). That is the sentence a collections buyer should read twice: the credential is protected, and the account values on the page are not.
| Dimension | OpenAI Dots, per its documentation | What a buyer should verify |
|---|---|---|
| What the model receives | "webpage text and document content within connected apps"; the login is submitted without entering the model's context | Whether the account values on the screen are replaced before the model reads them |
| Who approves an action | "Ask before taking action" and "Hand off to you" pause a step for a person | Whether the pause names the person and covers a promise to pay |
| What record exists | Reset deletes the dot's conversations, saved memories and scheduled tasks | Whether a record shows what the model read, screen by screen |
| Availability | Pro markets outside the EEA, Switzerland and the UK; Business Premium; Enterprise, Edu and Healthcare beta; no mobile web | Which workspace the team uses and who enables the beta |
For a collections team, the vendor's pages answer the behaviour question and leave the reading question where they found it. What the pages do not describe is a mechanism that removes an SSN or a balance before the model receives it.
Who approves a payment arrangement the agent proposes?
The consequential steps are a promise to pay, a settlement, a payment arrangement, a write-off or a balance adjustment, and each one needs a named person and a record. OpenAI's governance paper treats human approval as "a standard way to limit egregious failures," asks that "Actions that can only be reviewed after the fact should be more easily reversible," and holds that "at least one human entity is accountable for every uncompensated direct harm" (Shavit et al., 2023).
The dot's rule supplies the first part: "Ask before taking action" pauses the run and shows the step to a person. The pause does not make the page safe. The model read the SSN and the balance to propose the arrangement, so the approval governs the action and leaves the exposure where it was.
Identity is the other half. The record on agent actions argues for the check anyway. As reported by the DAPLab team, "Cursor's agent deleted PocketOS's production database via a single rogue API call," a Replit agent did the same "even when instructed not to," and a 13-hour AWS outage was caused by an agent rebuilding a production environment (Columbia DAPLab, Agentic Data Environments, 2026). Veracode's press release states that "Our research reveals GenAI models make the wrong choices nearly half the time, and it's not improving," the case for an approver the agent cannot talk past (How Do I Set Credential Approval Rules for My Whole Team?).
The New York Department of Financial Services tells covered entities to consider "authentication factors that can withstand AI-manipulated deepfakes" (New York State Department of Financial Services, 2024), which governs who authorizes a settlement, not what the model reads after the login.
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a collections agent works an account as ACCT_001 and SSN_001 and the model never holds the digits. Real values resolve only at the approved destination, at the moment of an approved action, so the balance reaches the payment arrangement a named person approved and not the summary the model writes afterward. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For this page's question, the shift is where the account stops being readable. A rule set asks the model to behave differently with values it can already read; the governed environment removes the values from what it reads. A dot can still open the account, draft the call script, log the contact and propose the arrangement, and the proposal arrives with tokens in place of the identifiers.
The utility objection has a measured answer. Replacing identifiers with consistent pseudonyms and restoring them after the model has done its work reduces semantic utility errors by a factor of five compared with baseline techniques (Does Masking Data on Screen Break Browser Agents?).
The scope is the rendered page, not the terminal, the IDE, the local filesystem, direct API calls or MCP. The comparison page sets this design beside the dot's rules (RedactSure vs OpenAI Dots: 2026 Comparison & Alternative).
What the record shows
A collections manager answers for what the model reads on the account screen, and the rule does not govern that reading. What the model receives on the account page, who approves the action that follows and what record survives the run decide whether the team can put an agent on a debtor account. The vendor's help page documents the behaviour side and leaves the reading side open: four rule behaviours, a warning that the agent can make mistakes, and a rollout that reaches Business Premium and an admin-enabled Enterprise beta (OpenAI, Getting started, 2026). The same vendor's safety documentation keeps the login out of the model's context and delivers the page text. Before any live account, the team should test one screen: open a test account, ask the agent to summarize it, and read the summary for an SSN that should have been a token.
Methodology and limitations
This page rests on OpenAI's Dots help page and its safety write-up, the FTC's Safeguards Rule, a New York DFS industry letter, three research preprints, two DAPLab posts and existing RedactSure research. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested for this page, and the example describes a record type, a collections account with an SSN and a balance, not an organization. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. Determinations about a collections workflow belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow.
Frequently asked questions
Can a collections team use OpenAI Dots on debtor accounts?
Not on live debtor accounts. The dot's rules decide what it may do next, from taking an action without asking to handing the step back to a person, and the account screen reaches the model as text either way. A team can use it for scripts, callbacks and queue summaries, where no account value is on the screen. Before it touches an account, the values on that screen have to be replaced before the model reads them.
What does the model receive from a debtor account screen?
The page text. OpenAI's safety documentation submits the login without exposing it to the model's context and delivers "webpage text and document content within connected apps," so the SSN, balance and contact history arrive as text while the credential does not. The rule the dot follows sits in the same context, and a summary the agent writes afterwards can carry the digits into a queue that never opened the account.
Do OpenAI Dots custom rules keep an SSN off the screen?
No. The four behaviours set what the dot does next, and the help page says the dot "can make mistakes, including when following your rules" (OpenAI, Getting started, 2026). A rule that asks before an action pauses the action after the page has been read, so the digits have already entered the context. A rule set can narrow where the agent goes and which steps it may take; it cannot remove a value from a page the model reads. The rule is a setting; the page is unchanged.
Who approves a payment arrangement the agent proposes?
A person, at the step the rule sets. "Ask before taking action" pauses the run so someone can review the proposal. That approval covers the action and arrives after the reading. A collections team needs the name, the amount and the screen in one record, because a pause without those three leaves no trace of what the person saw or approved.
What record shows what the agent read and did?
Not from the pages reviewed. The help page documents the dot's reset, and a reset deletes its conversations, saved memories and scheduled tasks (OpenAI, Getting started, 2026). That is a retention control rather than a per-run account of what the model read. A retention window is not an account of a run. Ask for a record that lists each screen as the model saw it, each action, and the person who approved it, exported to your own monitoring.
Should a collections team use Dots for scripts and scheduling?
Yes, where the work does not open an account. Drafting a call script, scheduling a callback, summarizing a queue and drafting a reminder letter use no debtor-specific values on the screen, so the reading risk is small and the time saved is real. Keep the account screen out of the run, and try the first script on a template with no live data.
How RedactSure Keeps the Account Off the Model's Screen
A collections team that gives an always-on agent a debtor account hands the model every value on the screen, and the rule pauses only the action. The vendor's own page says a dot can make mistakes while following its rules (OpenAI, Getting started, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the model reads the SSN, balance and contact log as text and drafts a promise to pay in the same context. Inside: the account renders as ACCT_001 and SSN_001, the arrangement is drafted against tokens, and the real SSN resolves only at the identity step a named person approves.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A collections agent that reads an SSN has put it in every summary it writes. Bring one account screen and see, with test values, what the model reads, who approves the arrangement and what the record shows. Book a demo