Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does the ChatGPT Compliance API Record What the Agent Did in the Browser?
Not completely. OpenAI's compliance logs record the conversation and keep it for 30 days, and the admin FAQ says those records "don't establish a complete audit trail" for every browser interaction, tool call or approval, so ask what the log holds for each page before you treat it as evidence.
An auditor asks a district's technology office which student records an agent opened, and the office exports the conversation. The transcript shows the task and the agent's messages; it does not show the address of each page the agent loaded, the record it read there, or the time it happened. OpenAI's admin documentation gives its compliance logs a 30-day retention window and states that the records "don't establish a complete audit trail" for every browser interaction, tool call or approval, so the two answers an auditor needs, what was kept and what it proves, come from different places. A district that cannot name the pages an agent visited cannot answer a parent, an auditor or its own data protection officer, and it cannot tell whether a student's record was read or merely mentioned. That question is live for any organization pointing an agent at a student information system, a claims portal or a payroll console, because the log is the only account most of them will have after the task ends, and the record that survives is the one the vendor chose to write.
Key findings
- For the log to answer which student records an agent opened, the values on each page would have to be replaced with consistent tokens before the model reads it, so the conversation holds STU_001 where the name sat (What Is an AI Control Record?).
- It would also require a named person approving each read of a full record and an exported account of what the model received on every screen (What Is Supervised Delegation?).
- OpenAI's ChatGPT Work admin FAQ says its compliance records "don't establish a complete audit trail" for every browser interaction, tool call or approval, so the log does not establish which page an agent read (OpenAI, Work admin FAQ, 2026).
- The Compliance Logs Platform "retains data for 30 days," a window that bounds what any review can reconstruct (OpenAI, Work admin FAQ, 2026).
- A peer-reviewed design for governed tool use requires that "each governed action carries a typed Action Certificate that a planner-independent checker must accept before execution" (Kadyrbek et al., 2026).
- The Department of Education defines an education record as "directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of" it (U.S. Department of Education, 2026).
What does the Compliance API record from an agent conversation?
OpenAI's administrator documentation calls the record the Compliance Logs Platform, and the ChatGPT Work admin FAQ gives its retention term: "retains data for 30 days" (OpenAI, Work admin FAQ, 2026). The same page names the events those records cover, browser interactions, tool calls and approvals, and then says they "don't establish a complete audit trail" for every one of them (OpenAI, Work admin FAQ, 2026).
The agent's messages, the tool calls it made and the approvals it received are what a compliance export can carry. A conversation that says the agent opened a student's record and read the balance is a sentence about a page, not a row that names the page, the student, the time and the value read.
OpenAI retired ChatGPT agent in favor of ChatGPT Work, and it retired the Atlas browser in August 2026 (OpenAI, ChatGPT agent, 2026; OpenAI, Atlas retirement, 2026). OpenAI's help page for ChatGPT agent states that with connected apps the agent "can access sensitive data like emails, files, or account settings" (OpenAI, ChatGPT agent, 2026), and the review of that exposure sits in (Is It Safe to Let ChatGPT Work Access Sensitive Company Data?). An administrator asking about an Atlas session from before the shutdown and one asking about a ChatGPT Work run are asking the same shape of question, and the answer starts with what the export holds.
Does the log show which pages the agent visited?
Not from what OpenAI publishes. The admin FAQ lists browser interactions among the events its records cover and states that they do not amount to a complete audit trail, and a list of visited addresses, with a timestamp and the record opened at each one, is not described in the pages reviewed. What the pages did describe was reach: in logged-in mode the Atlas agent "can use sites you're already signed in to," and in logged-out mode it "won't use any pre-existing cookies" (OpenAI, Atlas agent mode, 2026). Of the 86 AI security products reviewed, 36 describe recording what the model was shown, and every record is a prompt, a conversation or a request payload at the product's own gateway or pipeline; none describes recording the rendered screen an agent read (How Many AI Security Products Control What an AI Agent Sees?).
A transcript can tell an auditor that an agent worked on a student's account. An index tells the auditor that one page was loaded at a stated minute and that the run ended without a submission. The first is evidence of a conversation. The second is evidence of access.
A conversation export can be searched for a name, and a search result is not a record of the page. A browsing agent's prompt is built from the page it reads, so the access question and the exposure question travel together. A review of browsing agents collects findings that "include prompt injection, domain validation bypass, and credential exfiltration" once untrusted content reaches the prompt (Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?).
What do the vendors themselves say?
OpenAI's pages describe where an agent may go and what a person is asked to watch. They describe the record less fully, and the gap between the two is what a buyer has to price.
In logged-in mode the Atlas agent "can use sites you're already signed in to," and the page's safeguards addressed "risks that can come from access to logged-in sites" (OpenAI, Atlas agent mode, 2026), a statement about access rather than about the record. The same page stated that it "cannot run code in the browser, download files, or install extensions" and "cannot access other apps on your computer or file system," limits on reach (OpenAI, Atlas agent mode, 2026).
ChatGPT Work's overview adds a limit that bears on any record of authenticated browsing: "Website sign-in through the cloud browser isn't available in Enterprise or Edu workspaces," and "Allowing a website doesn't approve every action on that site" (OpenAI, Work Overview, 2026).
The admin FAQ supplies the retention term and the completeness limit (OpenAI, Work admin FAQ, 2026). 1Password's account of its OpenShell integration shows what a custody design looks like on the other side of the question: "The agent can work with real systems without holding any credentials in its context," and a gateway "replaces a placeholder with the real value only when the agent sends a request to an approved host" (1Password, 2026), a custody design for a credential rather than a record of the page.
| Dimension | OpenAI, per its help pages | What a buyer should verify |
|---|---|---|
| Completeness | Records "don't establish a complete audit trail" for every browser interaction, tool call or approval (OpenAI, Work admin FAQ, 2026) | Which events are missing, and whether the gap is documented |
| Reach | Logged-in sites "you're already signed in to"; no access to other apps or the file system | Which accounts and records the agent can reach in one run |
| Custody pattern | Placeholders in the agent's context, with the real value only at an approved host | Whether the values the agent reads are tokens, and where the real value resolves |
What should a district ask for in writing before an agent opens student records?
The obligation is easier to state than the vendor's record. The Department of Education defines an education record as information "directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of" it, so the definition turns on what the institution maintains (U.S. Department of Education, 2026).
The first question to put in writing is what the model receives from a rendered screen during the task, and whether any value on that screen is replaced before the model reads it (How Do I Stop a Browser Agent From Seeing the Token It Creates?). The second is what the platform records for each page: the address, the time, the fields the model read and the values as the model received them. The third is who approved the read of a full record, and what the approval names.
A district can send those three asks to a vendor's trust team and compare the answers with the pages. OpenAI's help pages do not describe a per-page export with those fields, so a district should treat the absence as the answer until a vendor supplies it in writing (OpenAI, Work admin FAQ, 2026).
| Ask | Why it matters to an auditor |
|---|---|
| A page-level entry | A conversation line cannot show that one student's record was opened and another was not |
| Values as received | The difference between a name and STU_001 is the difference between a record of a student and a record of a task |
| A named approver | An approval with no name answers a different question from an approval with one |
What would a complete record of an agent's browsing contain?
A per-action artifact comes first. Kadyrbek et al. describe a design in which "each governed action carries a typed Action Certificate that a planner-independent checker must accept before execution" (Kadyrbek et al., 2026).
An accountable person comes second. OpenAI's governance whitepaper calls human approval "a standard way to limit egregious failures" and requires that "at least one human entity is accountable for every uncompensated direct harm" (Shavit et al., 2023).
Values the model can hold without holding the data come third. 1Password's design puts placeholders in the agent's context and resolves the real value only at an approved host (1Password, 2026), so a page record can state what the model read without becoming a copy of the student record.
A page identity and an export come fourth. The record has to name the address and the time, and it has to leave the vendor's console for the organization's own store, where the comparison between an enterprise browser and a render-layer control applies (Enterprise Browser or Render-Layer Tokenization?).
A conversation satisfies none of those four on its own. The incident record explains the urgency: a Columbia DAPLab position paper lists "Cursor's agent deleted PocketOS's production database via a single rogue API call" (Columbia DAPLab, 2026), and an investigator working from that event needs the action, not the chat.
What does a governed environment change?
A governed environment acts where the page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a student's record draws STU_001 where the name sits and BAL_001 for the balance, a figure the task does not use. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real values resolve only at the approved destination, at the moment a named person approves the action. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For the record question, that changes what the log is a record of. The conversation a vendor stores holds tokens, so a stored session is no longer a copy of the student record. The exported record names the page, the values the model received and the person who approved the read.
The record also changes retention. A conversation that holds STU_001 can be kept and deleted under the same schedule as other application data, because the values that made it a student record never entered it.
The scope is the rendered page of the task. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP.
The comparison for this product line sets the two designs side by side: RedactSure vs ChatGPT Work: 2026 Comparison & Alternative.
What the record shows
For a district that answers to auditors and parents, a log of which pages an agent visited has to be written where the page is rendered. OpenAI's pages describe reach and a retention term, and the admin FAQ states the limit: the records "don't establish a complete audit trail" for every browser interaction, tool call or approval (OpenAI, Work admin FAQ, 2026). The district should test the gap on one task. Give an agent a single student record to read, export the compliance log, and search the export for the record's identifier and the page address. If neither appears, the question of which records were opened has to be answered from a record written at the screen.
Methodology and limitations
This page rests on OpenAI's help pages for Atlas agent mode, the ChatGPT agent, the ChatGPT Work admin FAQ and the Work overview, on a peer-reviewed design for governed tool use, on OpenAI's governance whitepaper, on a 1Password vendor blog, on a regulator's definition of an education record, on a Columbia DAPLab position paper. Public documentation read in full gives a sound view of where each product applies its control. Vendor and research pages were read between October 20, 2026 and October 27, 2026, and each Sources line carries its date.
The products are described from their public documentation, and none was tested for this page. Where the page says a record does not establish something, it means the pages reviewed. The example describes a record type, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations belong to counsel, assessors and the organization's security and compliance officers.
Frequently asked questions
Does the ChatGPT Compliance API record what the agent did in the browser?
Not completely. OpenAI's admin FAQ gives its compliance records a 30-day retention term and says they "don't establish a complete audit trail" for every browser interaction, tool call or approval. An administrator can see what the agent said and which tool calls it made. A per-page list of the addresses it opened, with the values it read at each one, does not appear in the pages reviewed.
Can an administrator tell which student records an agent opened?
Not from the log as the pages describe it. The Department of Education's definition turns on what an institution maintains about a student, and a chat line that says the agent opened a record does not identify the record an auditor can match. The export expires after 30 days. An administrator needs the page address and identifier from the screen, or a record written where the page rendered.
How long does OpenAI keep agent activity in its compliance logs?
Thirty days, according to the ChatGPT Work admin FAQ, which states that the Compliance Logs Platform "retains data for 30 days." The same page says the records "don't establish a complete audit trail" for every browser interaction, tool call or approval. The term covers the platform's retention, not any copy the organization makes. A review that needs a longer window has to export and store its own copy before the window closes.
Does allowing a website approve what the agent does there?
No. ChatGPT Work's overview states that "Allowing a website doesn't approve every action on that site," and the same page says website sign-in through the cloud browser is not available in Enterprise or Edu workspaces. A site allowlist sets where the agent may go. It does not name a person for a submission, a read of a full record or a change to one, and it does not produce a per-action record.
What should a page-level record contain?
An entry for each action, with the page address, the time, the values as the model received them and the person who approved the action. The values should be consistent tokens where a policy names a field, so the record can be kept without becoming a copy of the student record. The entry should be exportable to the organization's own monitoring and tied to the invocation it describes.
Does a conversation transcript satisfy an auditor's request?
No, not on its own. A transcript shows what the agent said and which tool calls it made, which is evidence of a conversation. An auditor asking which pages were visited needs the page, the time and the record opened at each one. The two answer different questions, and the transcript is the one that exists by default. A district should ask for that entry in writing before the agent is pointed at student records.
How RedactSure Keeps the Page an Agent Read Inside the Record
An auditor's question about which records an agent opened ends in a log that cannot name the page. OpenAI's admin FAQ says its compliance records "don't establish a complete audit trail" for every browser interaction.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent opens a student's record and the conversation keeps the name and balance. Inside, the page draws STU_001 and BAL_001, a balance the task does not use; the real values resolve only at the record view a named person approved, and the export lists the page, tokens and approver.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An auditor's question about which records an agent opened should not end in a chat. Bring one task that reads a student record and see, with test values, what the model receives, who approves and what the export holds. Book a demo