Can read-only tools and approval rules prevent autonomous agent failures?

OpenAI describes dots as "remarkably capable, always-on agents built to handle everything," powered by what the company calls "GPT‑6 Astra." Each dot runs on its own cloud computer, "learn[s] from feedback over time," and can "work towards your goals 24/7" through a claimed ecosystem of "over 4,000 apps." The most load-bearing design choice in the announcement is what happens when nobody is actively steering the dot: OpenAI says that when the user "aren't actively working with it," the dot "looks for ways to help in the background," a mode OpenAI names "proactive research."

OpenAI restricts that background mode to tools that are "read-only," explicitly ruling out sending messages, changing app content, or controlling the user's browser or computer. On top of that restriction sits a layered approval system: dots "start with built-in rules for when to act independently and when to ask for approval," which users can override with "Custom Rules" that allow, require approval for, or block specific actions — but OpenAI says "built-in safety requirements always apply" regardless of those custom settings. A separate mechanism, "auto-review," checks any action that "could affect your accounts or share information" against the user's instructions, Custom Rules, and safety requirements, and sorts it into one of three buckets: proceed, ask for approval, or require the user to do it themselves — OpenAI singles out password changes as a task that "always stay[s] with you." Users can inspect what happened, including background work, in an "Activity View."

This is a governance pattern, not a finding — OpenAI is describing how it designed permission around autonomy, the same question Can a protocol split agent access from agent incentives? addresses from the consumer-protocol side: both put a human-authored rule set between an agent and any action with real-world consequence, rather than relying on the agent's own judgment alone. It also sits next to Does labeling AI as an employee change how managers oversee it?, which found that framing an AI as an employee reduces how much a human manager double-checks it — auto-review and Custom Rules are, in effect, an attempt to keep that check running even after the user stops actively watching. The specialist-dot variant of this same announcement, covered separately in Should AI agents get their own company identity and credentials?, extends the pattern from a personal always-on agent to a persistent organizational one, echoing How does Google separate temporary agents from persistent ones?.

The announcement gives no numbers: no data on how often proactive research actually surfaces something useful versus noise, no description of how auto-review resolves ambiguous cases, and no account of failure modes once a dot has been running unsupervised for days. It is OpenAI's own description of a product it is still rolling out to "Pro, Business Premium, and Enterprise plans in eligible markets," not an independent evaluation of whether the read-only/Custom-Rules/auto-review stack holds up against a dot that misreads an ambiguous instruction. The implication to draw is narrow: a major vendor has settled on tiered, rule-gated autonomy — not full agent discretion — as the default shape for an always-on personal agent, which is itself evidence of where the industry currently sets the trust boundary, independent of whether this particular implementation works well.