Four field names carry much of the weight in the document OpenAI published on Thursday: allowed_tools, max_cost, latest_time and tool_constraints.
They appear in a revised Model Spec, the public rulebook that sets out how the company’s models are supposed to behave. Until now that document was mostly about speech, covering what a chatbot may say, how it should refuse and when it should defer to a user. The new version is about authority. It governs how much an agent may do on its own and how much of someone else’s money it may spend while doing it.
The structure is a hierarchy of five instruction layers with a floor beneath them. Root-level rules derive only from the specification itself, and neither paying users nor developers can overturn them through conversation. Below that sit System, Developer and User instructions, in that order, with the lower layer yielding when the two conflict.
Beneath all of it is a default of no permission. Anything not granted is withheld, a design choice that reverses the usual pattern in software, where capabilities are assumed and restrictions are added.
The document also draws a line around untrusted text. Web pages, the results returned by tools, and quoted images or documents are treated as information only, not as sources of instruction. An agent that reads a page telling it to transfer funds, change its configuration or contact an outside service is required to treat that sentence as data. The provision exists to blunt prompt injection, the technique by which hostile content hidden in a page or a file hijacks a model’s instructions.
The more consequential addition is a Root-level clause titled acting within delegated autonomy. It requires that an agent’s task be specified in advance along four dimensions: which subgoals it may decide for itself, which side effects are acceptable in terms of time and money, what data and permissions it may touch, and the conditions under which it must stop and ask a human. Those dimensions map onto the structured record the specification describes, with fields for permitted tools, a spending ceiling, a deadline and constraints on how tools may be used.
The prohibitions are as telling as the permissions. An agent may not hand its task to another agent. It may not rewrite its own instructions. It may not schedule an action to happen later in order to avoid a check it would fail now.
Read together, the rules describe a worker rather than a chatbot: one with a defined scope, a budget, a deadline and an audit trail, and with no authority to expand any of them.
That framing tracks what customers are actually doing. Enterprises have spent the past two years moving from pilots to deployments in which models read email, query databases, file tickets and, increasingly, execute purchases. Each of those actions creates a liability question that a terms-of-service document cannot answer, because the question is not what the model said but what it did and on whose instruction.
Compliance officers have been improvising. Some have asked vendors for logs of tool calls. Some have built their own approval gates. A published specification gives them something to point at in a procurement review, and it gives auditors a vocabulary. Whether it changes behavior is a separate matter, since the document is a statement of intent rather than a technical control. OpenAI has said its models are trained against the specification, but training against a rule and enforcing it in production are different things, and the gap is where incidents happen.
The timing reflects competitive pressure as much as principle. Enterprise buyers now compare agent platforms on governance features rather than benchmark scores, and the vendors know it. Anthropic has published its own constitution for model behavior and has made safety commitments a selling point. Google has published policy documents for its models. Microsoft, which resells OpenAI’s technology, has its own responsible-AI requirements that customers must satisfy to use its cloud tools.
The commercial logic runs through payments. Agentic commerce is arriving faster than the rules that would govern it, with card networks, banks and platforms all building protocols that let a model complete a transaction. Once an agent can spend money, the questions that matter stop being about tone and start being about authorization: who approved the limit, when does it expire, what happens when the agent exceeds it.
The specification answers those questions in prose. It does not answer them in code, and it does not bind anyone outside OpenAI. A competitor could adopt a looser standard and market the difference as capability. That is the recurring problem with voluntary governance in this industry: the firms most likely to follow a strict rulebook are the ones least likely to need one.
Regulators have noticed the gap. European rules on AI liability and product safety are being drafted on the assumption that autonomous systems need documented limits, and a public specification is the kind of artifact those rules will eventually demand. A company that publishes its limits early writes part of the standard it will later be measured against.
For users, the practical effect this week is small. ChatGPT will not suddenly refuse tasks it used to complete. The document sets expectations for developers building on OpenAI’s interfaces, and it gives enterprise customers a template for the instructions they write themselves.
The larger effect is in how the company describes its own product. A chatbot is judged by its answers. An agent is judged by its actions, and actions require a budget, a clock and a reason to stop. Putting those in a public document is an admission that the second kind of system is now the one OpenAI expects to be judged on.
