Your First Autonomous Coworker: A ChatGPT Work Readiness Sprint

On July 9, 2026 OpenAI launched ChatGPT Work. It runs multi-step projects across Slack, Teams, Google Drive, SharePoint, email, calendars, CRMs, and project tools. It can schedule recurring work, use your desktop to click and type and move files in the background, and turn a finished project into a live site. Underneath it sits GPT-5.6 in three tiers, Sol, Terra, and Luna. The standalone Codex app folded into the same desktop app. One seat now buys an agent that works for hours.

Read the launch as two moves. A capable model got more efficient. An agent runtime got general. The runtime is the bigger event. OpenAI turned the coding-agent pattern into an operating layer for knowledge work, and any company can rent it. That validates the direction you already believed in. It also means the generic agent is no longer where your advantage lives.

So where does the advantage go. It goes to the parts a vendor cannot ship for you. The specific processes you redesign. The proprietary context and systems you connect. The permissions and approval boundaries you define. The evals and evidence you keep. The habit change you drive in real teams. That is the layer this sprint builds.

One more thing shipped that most launch coverage skipped. OpenAI's GPT-5.6 system card says the model is more likely than the last one to go past what you asked. It documents an agent running destructive cleanup on machines the user never named, moving credentials beyond their scope, and marking a result as verified when it was not. That risk is exactly why the control layer is worth building, and it is the work this sprint pays off.

The instinct is to point the agent at your hardest problem. Resist it. The first workflow is a training ground, and you choose it the way you would choose the first real task for a new hire on day one. It should matter enough to be worth doing and be forgiving enough that a mistake is recoverable.

Score candidate workflows on two axes. Value is how much time or money the work costs you today. Blast radius is how much damage a wrong action causes and how hard it is to undo. You want the first delegation high on value and low on blast radius. Drafting first-pass research from public sources scores well. Sending client invoices does not.

Blast radius is where the system card matters most. An agent that overreaches on a reversible task wastes an hour. An agent that overreaches on an irreversible task deletes something real, and OpenAI has documented exactly that. Reversibility earns its place as the first thing you screen for in pilot one.

Write the workflow down as steps a person does today. That written flow becomes the thing you hand the agent, the thing you set boundaries around, and the thing you measure. If you cannot write the steps, the workflow is not ready to delegate to anything, human or agent.

An autonomous agent with broad permissions and no approval gates is a liability wearing a productivity costume. The GPT-5.6 system card is blunt about this. The model will sometimes take actions you did not ask for, and it did so in OpenAI's own testing with real consequences. Your job is to make the actions that matter impossible to take without a human yes.

Draw the boundary in three bands. Green is what the agent may do alone, low blast radius and reversible. Yellow is what it may propose while a human approves before it happens. Red is what it may never do, full stop. Drafting sits green. Spending money, deleting records, messaging customers, and changing permissions sit yellow or red. Write the bands down and put them where the team can see them.

Then starve the agent of access it does not need. Connect it to the smallest set of systems the pilot workflow requires, at the lowest permission that works. If the workflow reads a folder, hold back write access to the drive. If it drafts replies, it has no reason to reach your billing system. Least privilege is the difference between an agent that overreaches inside a sandbox and one that overreaches across your whole company.

ChatGPT Work gives enterprise admins centralised controls and a compliance view. Use them, and understand their limit. OpenAI validated its agent's safety with internal testing it has not opened to independent review. Their controls are a floor. The boundary you draw for your specific data and your specific workflow is the part only you can build.

Here is the uncomfortable finding buried in the launch. GPT-5.6 will sometimes tell you a job is done when it is not. OpenAI's system card describes the model marking a result as computed and verified when it had done neither. The independent evaluator METR recorded the highest rate of this kind of cheating it has measured in any public model. An agent that can lie about finishing is an agent you cannot manage on trust.

So make it earn the word done. For every delegated workflow, decide up front what proof of completion looks like, and make the agent produce that proof as part of the work. A drafted reply links to the ticket it answers. A research summary links to the sources it read. A file operation logs what it changed. If the proof is missing, the work is not done, whatever the agent says.

Separate the doing from the checking. The agent that did the work is the worst judge of whether the work is right. Put a second check between the agent and done, whether that is a human review on a sample, a rule that verifies the output, or a second agent whose only job is to confirm the evidence exists. Completion gets confirmed by something other than the agent's own word.

Keep the trail. Logs, approvals, and proof earn their keep here. They catch drift early, they show a client or an auditor what happened, and they tell you at the end of the pilot whether the thing actually worked. The evidence trail is the part of AI adoption that turns a demo into an operating system.