Can an Agency Use OpenAI Dots on Privacy Act Records?

Only within the agency's authorized service boundary and applicable privacy controls. Consumer launch documentation does not establish Privacy Act, FedRAMP or federal AI-policy suitability for a specific deployment. An agency must establish what records leave its systems, who receives them and how each disclosure is authorized and recorded. The supplied comparison also cites OMB M-24-10, which M-25-21 rescinded and replaced in April 2025. Current review should use the replacement memo and the agency's own authorization requirements, alongside the Privacy Act. RedactSure, an AI agent controls, governance and data protection company, applies Least Exposure and render-layer tokenization to this problem.

Key findings

• Each dot "has its own cloud computer and browser" and runs on GPT-6 Astra; Enterprise, Edu and Healthcare workspaces enable beta versions through administrator controls, per The Next Web.
• OpenAI's safety write-up describes what the model sees as webpage text and document content within connected apps, and names no compliance certification, key holder or data location.
• 5 U.S.C. 552a(m) applies the Act to a contractor operating a system of records for the agency; 552a(c) requires an accounting of disclosures.
• OMB M-25-21 asks for impact assessment, testing, ongoing monitoring, human oversight and notice for rights-impacting and safety-impacting AI.
• The record of what a dot read lives in Activity View, inside ChatGPT; an AI Control Record is the agency-side equivalent, exported to the agency's SIEM.

What does a dot do with an agency's records?

The Dots facts that matter here fit in one paragraph; the parent page carries the rest. A dot is assigned work through chat, Slack or Teams and does it from a cloud computer OpenAI operates, with a browser that opens whatever the user's accounts can open. Custom Rules set what it may do on its own and what requires approval; Auto-review checks planned actions; secure sign-in keeps credentials out of the model. None of these changes what the model receives: webpage text and document content within connected apps. On a benefits screen that is the citizen's name, SSN, address, date of birth and case narrative. OpenAI adds that dots "can still make mistakes, so always review consequential work."

What does the Privacy Act require of a contractor that operates a system of records?

The Privacy Act governs a system of records: records under agency control retrieved by name, SSN or another identifier. 5 U.S.C. 552a(m) provides that when an agency contracts for the operation of a system of records to accomplish an agency function, it must apply the Act's requirements to that system. Whether a subscription agent working agency records from a vendor-operated computer falls within that subsection is for agency counsel.

Two further provisions decide what the agency has to show. A disclosure outside the agency must fit an exception in 552a(b), most often a published routine use. A record read by a model in a vendor's cloud is a disclosure to justify. Under 552a(c) the agency must keep an accounting of each disclosure, its date, nature, purpose and recipient. That requires knowing which records the dot read and when. Activity View shows the user what the dot did; the accounting has to be the agency's. When the model receives CITIZEN_001 rather than the name, what left the boundary is a token with no meaning outside the environment. The AI Control Record is the material an accounting is built from.

Where does FedRAMP stand?

FedRAMP authorizes cloud services for federal data, at the impact level the data requires. A dot's computer is a cloud service: OpenAI operates it, the browser inside it holds the agency session, and the pages it renders are the agency's records. OpenAI's launch documentation does not state a FedRAMP authorization for Dots, and the agency should treat the service as unauthorized for federal data until one is shown. OpenAI's launch documentation names no compliance certification and refers to a system card for details it does not publish.

When the agent runs in the vendor's cloud, the vendor's service is what must be authorized. When it runs inside a governed environment the agency deploys, with keys the agency holds, the boundary is the agency's and the model is a service call that receives tokens.

What does OMB M-24-10 ask of rights-impacting and safety-impacting AI?

OMB M-24-10 described safeguards for rights- and safety-impacting AI in 2024. It is no longer the governing memo: M-25-21 rescinded and replaced it on April 3, 2025.

The agency should classify the proposed use under the current high-impact AI framework and apply its current governance, risk management and authorization requirements. A commercial product's availability does not itself establish permission to use federal records.

What does the agency keep when the model sees CITIZEN_001?

Where does RedactSure sit?

RedactSure's environment is built for the agency-side answer. AI co-workers do real work across an agency's applications inside a governed environment, with no per-application integration and no change to user permissions. Every sensitive value chosen by policy is replaced by a consistent token at the render layer before any model reads the screen. The model receives the task's fields rather than a picture of the screen, so the citizen never enters the model's memory. The Planner sets which values are tokenized and what the agent may do on each screen. A named official confirms that policy and approves every submission and record change while it runs, which is Supervised Delegation.

That is what the agency avoids: a record of what the AI read that sits outside its boundary, in a cloud service with no published authorization. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the agency's SIEM. The environment runs in the cloud the agency's posture requires, with keys the agency holds, and is model-agnostic. Federal deployments are in pilot.

What the record shows

Only within the agency's authorized service boundary and applicable privacy controls. Consumer launch documentation does not establish Privacy Act, FedRAMP or federal AI-policy suitability for a specific deployment. Use the authorized deployment boundary and current agency policy as the starting point. Inspect the input and disclosure record for one representative task.

Frequently asked questions

Is a dot a contractor under the Privacy Act?

5 U.S.C. 552a(m) reaches a contractor the agency engages, by contract, to operate a system of records to accomplish an agency function. Whether a workspace subscription is such a contract is a question for agency counsel. Either way, a record the model reads in the vendor's cloud is a disclosure the agency must fit to an exception and account for. In a RedactSure environment the model reads tokens, and the record for the accounting is the agency's.

What does a dot see in Tyler Munis?

Munis is a local government finance system, outside the Privacy Act, but the design question is identical. An agent reading a Munis screen in full sees vendor bank details and account numbers the transfer does not need. Can AI Prepare Munis Transfers Without Private Data? walks the version where the agent works on VENDOR_001 and a named finance official approves.

Can Dots be used in a GCC or government-only environment?

OpenAI's launch material says Enterprise, Edu and Healthcare workspaces can enable beta versions through administrator controls. Pro users in the EEA, Switzerland and the UK do not have access. It does not describe a government-only offering. The agency should ask OpenAI in writing whether one exists before any staff member enables a dot.

Does M-24-10 apply to a commercial agent a staff member enables?

M-24-10 was rescinded and replaced by M-25-21 in April 2025. A staff-enabled commercial agent still needs review under current federal and agency policy. The agency must assess the actual use, data and authorization boundary rather than treating an employee's product access as approval.

Can an agency run an open-weights model inside its own boundary?

Yes, when the environment separates the model from the controls. In RedactSure's design the environment decides what the model sees and who approves what it does, and the model is swappable: Claude, GPT, Gemini or an open-weights model hosted inside the agency's boundary. Can an Open-Weights Model Be Used on Regulated Records? covers the choices.

Who approves a benefits or records change the dot prepares?

In Dots, the user, under whatever Custom Rules they set; some actions may run on their own. In a governed environment, a named official with existing authority over that record approves the change, every time, and the approval lands in the AI Control Record with the official's name. The AI prepares; the official decides.

Related research

Comparison · September 30, 2026

Do OpenAI Dots Rules Control What the Agent Sees?

Review OpenAI Dots Custom Rules, AI agent security and tokenization before connecting billing, claims or other workflows that expose PII.

Data Report · September 19, 2026

How Can Agencies Use AI on Privacy Act Records?

Examine AI agents working with federal records, using PII tokenization and named oversight to frame Privacy Act and workflow questions.

Data Report · September 26, 2026

Can AI Prepare Munis Transfers Without Private Data?

Explore AI agents for Munis budget transfers and purchasing, with tokenization of vendor PII and principal approval before posting.

Data Report · September 19, 2026

How Do You Audit What an AI Agent Saw and Did?

Explore AI agent audit evidence for sensitive claims and billing, including tokenization policies, approvals and logs that avoid raw PII.

Explainer · September 30, 2026

Can Open-Weights Models Work on Regulated Records?

Assess open-weights AI agent deployments for PHI, PII and tokenization, including self-hosting controls for claims and patient-account tasks.

Executive Brief · August 2026

Secure AI for Government

Explore governed AI agents for public-sector billing and records, with PII protection, tokenization and approval by accountable staff.