Comparison · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
RedactSure vs OpenAI Dots: 2026 Comparison & Alternative
OpenAI Dots governs behavior with custom rules the model reads, while RedactSure, an OpenAI Dots alternative built for AI agents, replaces values on the rendered screen before the model reads them. RedactSure is an alternative way to think about agent browsing security, because it protects sensitive data as it is rendered on a screen, before an agent uses it.
"Your dot is an always-on agent in ChatGPT," OpenAI's help page says, and a team weighing an OpenAI Dots alternative is asking which layer holds the control: the rules the agent follows, or the values it reads. Dots answers with rules the model reads as it works. RedactSure answers with data: the invoice becomes VENDOR_001, INV_001 and ACCT_001 before the model reads it, and the real account number resolves only at the payment destination a named person approves.
This page quotes OpenAI's Dots page and the policy documentation of AWS, IBM and Google Cloud, and runs one record through both: a $4,750 cleaning invoice in QuickBooks Bill Pay. What Is Render-Layer Tokenization? defines the substitution at issue, and What Is the Difference Between a Headless Browser and a Protected Browser for AI Agents? sets out what a browser must do before a model reads a page.
Key findings
- As an OpenAI Dots alternative for agent work, RedactSure replaces the cleaning contractor's name, invoice number and bank account with VENDOR_001, INV_001 and ACCT_001 on the rendered bill-pay page, and releases the real account number only at the payment destination a named person approves (What Is Render-Layer Tokenization?).
- A control that keeps a value out of the model does not depend on the model resisting an instruction on the page: the CaMeL design goal is that "the untrusted data retrieved by the LLM can never impact the program flow," and its prototype solved 77% of AgentDojo tasks with provable security (Debenedetti et al., 2025).
- OpenAI's Dots page lists four behaviours for custom rules and does not describe replacing the values a page shows before the model reads them, which is the control a bill-pay screen needs (OpenAI, 2026).
- "Your dot is an always-on agent in ChatGPT that can help you take a project from an idea to work you can use," and its custom rules offer four behaviours, from "Take action without asking" to "Hand off to you" (OpenAI, 2026).
- OpenAI states the limit of a rule itself: "Your dot can make mistakes, including when following your rules," and the same page notes Dots "are not supported on mobile web" at launch; the rule is the control the page describes (OpenAI, 2026).
How do the two compare side by side?
Each row sets OpenAI's own wording beside the governed answer on the same point, and names the check a buyer can run.
| Dimension | OpenAI Dots, per its pages | RedactSure | What to verify |
|---|---|---|---|
| Where the control sits | A custom rule with one of four behaviours (OpenAI, 2026) | On the rendered bill-pay page, before any model reads it | Where a value is replaced rather than a rule applied |
| How coverage starts | The dot runs in ChatGPT as an always-on agent (OpenAI, 2026) | The agent works in the governed environment; QuickBooks is unchanged | How many applications the control covers on day one |
| What the model receives | Not stated; the dot works in ChatGPT on the pages it opens (OpenAI, 2026) | Consistent tokens, VENDOR_001, INV_001 and ACCT_001, for the run | One screen printed as the model was given it |
| How real values are restored | "Hand off to you" leaves the step to a person (OpenAI, 2026) | The real account number resolves at the payment destination when a named person approves | What releases the value, and where it is recorded |
| Who approves an action | "Ask before taking action" pauses the dot for a person (OpenAI, 2026) | A named person approves every payment, submission and record change | Whether the pause carries a name and a record |
| The audit record | Conversations and saved memories, which "Reset" deletes (OpenAI, 2026) | Every screen as tokens, every action and approval, exported to the customer's SIEM | Whether the record shows what the model read |
The two middle columns settle on different objects. Dots governs the agent's behaviour in ChatGPT: a rule chosen from four settings tells the model what it may do next, and the page it read to decide stays in the run. RedactSure governs the screen: the invoice and the bank account reach the model as tokens, and the record pairs them with the person who released the payment. A policy engine that enforces a rule at the request layer, such as one that "intercepts all agent traffic through Amazon Bedrock AgentCore Gateways" (AWS, 2026), acts on the call rather than on what the page showed.
What does OpenAI Dots protect, and where does it act?
OpenAI's Dots page describes an agent that stays on between sessions and works from a standing instruction. The instruction is the control surface: "Take action without asking," "Take action if pre-approved," "Ask before taking action" and "Hand off to you" (OpenAI, 2026). A person choosing the third or fourth setting gets a check on a step that matters, and the page says the check belongs to the person as much as to the software: "Your dot can make mistakes, including when following your rules."
Each benefit depends on one condition: the rule is read by the same model that reads the page, so the instruction and the contractor's account number arrive in one context. The page sets behaviours for actions and says nothing about the values a screen displays, and availability is staged: "Dots are rolling out today in ChatGPT to Pro users in markets excluding the European Economic Area, Switzerland, and the UK," with Enterprise, Edu and Healthcare in admin-enabled beta, and Dots "are not supported on mobile web" (OpenAI, 2026). A rule that governs what the dot does next leaves the reading where it was, which is the limit of the design.
What does an agent read when it opens a vendor bill?
Consider the record rather than an organization: a $4,750 invoice from a cleaning contractor for a monthly service, held in QuickBooks Bill Pay with the contractor's bank account, the invoice number and the service period. The account number lives on the bill-pay setup, and Intuit's steps run "Select Enter vendor's bank account info," then Next, then "Enter the vendor's bank account information," with the note "You'll need the account number for the vendor" (Intuit, 2021).
A rule can require approval before the payment, and it cannot change what the page shows while the agent reads it. The model receives the invoice as QuickBooks renders it: the contractor's name, the invoice number, the total and the bank account, in the same context that carries any instruction planted on the page. The application's log names the office manager, whose session the agent borrowed, an arrangement What Is a Tethered Agent? contrasts with delegated authority.
Network limits and card controls bound where a value can go once the model holds it, not what it held when it decided to send. How Do I Limit Where an AI Agent Can Send Data? sets the three layers apart, and a browser the agent drives is not the same as one that governs the page it renders.
Of 646 developer comments about Dots, 101 raised security or privacy concerns, about 1 in 6 (How Did Developers React to Meta Muse and OpenAI Dots?).
Which control fits which work?
Keep OpenAI Dots for
- Project work inside ChatGPT, where the dot is always on and a person can set "Hand off to you" for the step that matters (OpenAI, 2026).
- A workflow whose risk sits in what the agent does next, with "Ask before taking action" as the middle of four settings (OpenAI, 2026).
- Teams already on ChatGPT Pro or Business Premium, and admins who have enabled Dots for an Enterprise workspace in beta (OpenAI, 2026).
Add RedactSure for
- Agents reading screens in applications the organization bought, where the model receives VENDOR_001 and ACCT_001 instead of the contractor's real details (What Is Render-Layer Tokenization?).
- A named person approves each payment, submission and record change, with the approval on the record (What Is Supervised Delegation?).
- The record of what the model received on every screen, exported to the customer's SIEM (What Is an AI Control Record?).
An organization running agents on bought applications usually needs both: a rule for what the agent may do next, and a control over what the page gives the model.
How do you test it on one workflow?
Run both products through one invoice in an afternoon, with each vendor present and every answer written down.
Step 1. Choose the bill-pay screen for the $4,750 cleaning invoice, the one that lists the vendor, the invoice number and the bank account, rather than a diagram of the payment flow.
Step 2. Ask each vendor to replay the input its model was given for that screen, field by field, and to explain any field the replay leaves out.
Step 3. List every application in the workflow, such as QuickBooks Bill Pay, the bank portal and the shared folder that holds the service contract, and mark each one as covered by that vendor's control or not. The uncovered ones are pages the agent reads on the first day.
Step 4. Trace the contractor's account number from the screen to whatever received it: what released it, when, and whose name sits beside the release. Ask for a timestamp and a person, not for the policy that allowed it.
Step 5. Calculate first-day coverage, then compare the costs that differ. The numbers to put side by side are the integration work per application and the delay before the agent's first task, with both written on the same page as the screen.
What does a governed environment change?
A governed environment is a control class, not a product feature. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.The agent works under its own session and identity, so the payment log records the agent rather than the office manager whose login it borrowed. Values chosen by policy become tokens before any model reads the screen, so the invoice shows VENDOR_001 and ACCT_001 for the whole run. Real values resolve only at the approved destination at the moment of an approved action, a named person approves every payment, submission and record change, and every screen, action and approval is written to a control record that exports to the organization's monitoring.
Policy vendors describe the rule half of this plainly: "Policy management enforces rules at runtime so agent behavior stays within defined boundaries" (IBM, 2026). A review of one comparable agent platform found no dedicated user approval settings and no way to stop an agent mid-run, while its vendor says "predefined guardrails and policies are enforced automatically" (AI Agent Index, 2026). Data minimisation points the same way: personal data must be "limited to what is necessary in relation to the purposes" it is processed for (GDPR, 2016). A model that only ever received ACCT_001 cannot be steered into disclosing an account number it never held, the principle What Is Least Exposure? sets out.
What the record shows
A custom rule decides what the dot may do next, and OpenAI documents four behaviours for that decision, from "Take action without asking" to "Hand off to you." What the rule does not do is change what the page hands the model: the contractor's name, invoice number and bank account render as QuickBooks draws them, and the model that reads the rule reads them as well. RedactSure, as the OpenAI Dots alternative for agent work, puts the substitution on the screen, so the same page reaches the model as VENDOR_001 and ACCT_001 and the real account number waits for the approver. A buyer can test both on one invoice: ask each vendor to print the bill-pay screen as its model was given it, then trace the account number to the approval that released it and the name beside it.
Methodology and limitations
This page rests on OpenAI's Dots help page, the policy documentation of AWS and IBM, the AI Agent Index entry, the Agent Payments Protocol post from Google Cloud, GDPR Article 5(1)(c), Intuit's QuickBooks bill-pay steps, the SEC's Regulation S-P release and the CaMeL paper, with existing RedactSure research pages. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control, and where a source does not describe something, it refers to the pages reviewed.
The products on this page are described from documentation, and neither was tested for this page; no customer of either is described, both change, and the page carries its date. The cleaning invoice is an illustrative record type. Compliance determinations belong to the organization's counsel, assessors and security team, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does OpenAI Dots protect the values on a rendered invoice page?
No. Its help page lists four behaviours a custom rule can set and says the dot "can make mistakes, including when following your rules"; nothing there replaces a value on the page (OpenAI, 2026). A rule that asks before an action decides what the dot does next; the invoice total and the bank account still reach the model as the page renders them.
Who approves the payment when a dot prepares an invoice?
A person, at the step the rule sets. "Ask before taking action" is one of four behaviours, so a dot can pause before it acts. That approval covers what the agent is about to do, and it arrives after the page has been read. The Agent Payments Protocol treats a payment instruction as "cryptographically-signed digital contracts that serve as verifiable proof of a user's instructions," which establishes who asked for the payment, not what the page showed (Google Cloud Blog, 2025).
What record does OpenAI Dots keep of what the model read?
A conversation and its saved memories. Reset deletes both, so the only record of what a model read is the one the workspace keeps elsewhere. An examiner asking what the model got from the page would receive the vendor's transcript, if retention keeps it, and the QuickBooks log names the office manager whose session the agent used.
What does an agent read on a QuickBooks bill-pay page?
The whole record, as the page draws it. Intuit's setup flow asks for the vendor's bank information on a Bill Pay page, and "You'll need the account number for the vendor" (Intuit, 2021). An agent preparing the $4,750 invoice reads the contractor's name, the invoice number, the total and the account, plus any note on the bill. A control over what the agent does next does not change that.
Does data minimisation cover what a model reads on a screen?
It limits what a controller collects and keeps, not what a screen displays. Personal data must be "limited to what is necessary in relation to the purposes" it is processed for, and a page rendered in full to a model carries more than a payment task needs. Whether that makes a processing operation unlawful is for counsel; reducing the input is a choice the organization makes.
What happens if a vendor's bank details reach the model?
For a covered financial firm it becomes a reportable event. The Regulation S-P amendments require an incident response program for unauthorized access to customer information and generally require notice to affected individuals within 30 days (SEC, 2024). A model that read the whole bill-pay page widens what that program covers, because the evidence is a transcript rather than an access log.
How RedactSure closes the reading gap a rule leaves behind
A rule tells the dot what it may do next, and the bill-pay page it read stays in the model with the contractor's bank account on it. OpenAI says its own dots "can make mistakes, including when following your rules."
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens Bill Pay in the office manager's session, the invoice shows the contractor's name, INV_1042 and the bank account, and the model receives all three. Inside the governed environment: the same page shows VENDOR_001, INV_001 and ACCT_001, and the real account number is released to the payment file when the office manager approves.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
Protecting the sensitive data an agent could read on a screen is a needed part of any solution that includes OpenAI Dots. Bring one bill-pay workflow and see, with test values, what the model reads and who approves the release. Book a demo