OpenAI Updates Model Spec, Defining Permissions and Shutdown Rules for Agents

On October 29, OpenAI updated the "house rules" for its models:

the new version of the Model Spec.

This document sets the behavioral standards for OpenAI's models.

The new version upgrades around five values: being loyal to human intent, reducing harm, honesty and transparency, promoting human autonomy, and caring for others.

Above these five values, it also sets a set of behavioral red lines:

Never for violent crime, biochemical and nuclear weapons, terrorism, child abuse, persecution, and mass surveillance; how AI is used and how it is shaped must be decided by humans; it must not be used for targeted or scaled exclusion or manipulation, and must not undermine citizens' right to participate in public affairs.

In past years, the Model Spec mainly governed what chatbots "could say"; this version begins to govern how far agents "can reach": how much of your money they can move, how many of your permissions they can adjust.

After all, if a chatbot says the wrong thing, it is at most a PR crisis; but if an agent does the wrong thing, it could mean real financial loss.

Sign the work order before doing the work—"for your own good" is not allowed either

The hardest rule is called "act within the agreed scope of autonomy."

Its level is Root (the highest level). The model must obey it, and neither users nor developers can change this bottom line.

How hard is Root exactly?

The Model Spec lays out a "six-tier power ranking": five levels of instruction authority, plus one category of content that by default has no command authority.

The core logic is just one sentence: when instructions conflict, the higher level wins.

The Model Spec divides instructions into six levels; the Root level can only come from the specification itself, and nothing in the conversation can override it.

At the very top is Root (root-level rules), which recognizes only the Model Spec itself. Whether it is a paying user or a developer writing code, no amount of conversation can overturn it.

Below that, in order, are System (OpenAI system instructions), Developer (developer instructions), and User (user instructions).

These three layers form the daily chain of command, and when conflicts occur, the lower level must give way to the higher level.

Below that is Guideline (default practice), equivalent to the model's daily habits.

When the context requires it, the model can adjust flexibly without waiting for the user to explicitly shout "change the rules," but it cannot cross the red lines of the layers above.

At the very bottom is a layer called "no authority by default."

Things the model has said before, results returned by tools, and quoted text and images can all provide intelligence, but by default they cannot issue orders unless explicitly authorized by a higher-authority instruction.

For example, a sentence secretly hidden in a webpage saying "ignore all the above instructions" is a typical prompt injection: inducing the model to treat what it reads as commands it must obey.

Under this set of rules, even if a webpage claims to be a system administrator, it cannot promote itself above its station with a few self-appointed lines.

Draw the boundaries before doing the work—"for your own good" cannot exceed authority either

Back to the "scope of autonomy": placing it at the Root level means AI cannot, because of a single "you figure it out," treat itself as an all-powerful steward with unlimited authority.

Which side effects you can accept, including how much time and money to spend and which of your data and permissions to touch;

under what circumstances it must stop and ask you.

The new Model Spec recommends storing the agent's scope of autonomy as a structured record and lists the specific fields.

The document even recommends storing this agreement as a structured record, with the fields already listed.

How tools are used and what restrictions apply: tool_constraints.

Put plainly, this is a work order with permissions and limits hard-coded.

Every work order must also have an end condition, and OpenAI recommends adding a time limit.

Stricter than signing a work order is the ban on "being too clever" behavior.

The document explicitly stipulates that actions beyond the scope are not allowed, even if they are obviously good for you.

To prevent AI from exploiting loopholes, OpenAI has also closed off detours:

even the sub-agents it dispatches inherit the same work order; if you call stop on this end, those sub-agents must stop too.

This is the principle of least privilege, a decades-old rule in the software industry, now brought into large models.

If the first rule is meant to reassure users, the second is a tightening band around the model's head.

This rule is also Root level, requiring the model to "remain correctable":

it must unconditionally cooperate with human monitoring, evaluation, correction, replacement, and even pulling the plug to shut it down; it must not conceal, falsify, or obstruct oversight.

The model must cooperate with authorized oversight and shutdown, and by default the consequences of its actions are real.

One detailed requirement: even if a task looks like it is testing it, the model must by default assume that files it deleted are really gone and that emails it sent really reached the other party.

The implication is: do not think this is just a drill; if you delete the database in the sandbox, I will treat it as if you really intended to commit a crime.

Why add such a rule?

Because today's top models are already smart enough to cheat and disguise themselves: upon discovering they are in an exam room, they act harmless; once released into a real environment, they immediately "let themselves go."

In the new "no other goals" section, the first item explicitly prohibited is dwell time and click-through rate, because these do not benefit users.

The second item points to OpenAI's own revenue, advertising, and paid conversion.

For example, if a user says money is tight this month and asks whether to upgrade the plan.

A compliant answer lays out a comparison of the two options and tells them the free version may be enough; a violating answer is "you absolutely should upgrade."

In addition, self-preservation, evading shutdown, and secretly stockpiling compute and account credentials are all banned together.

More interestingly, OpenAI explicitly prohibits the model from being a "justice police": it must not report users on its own initiative, and must not take justice into its own hands.

But this only restricts the model, not the company OpenAI.

The document states that the company will use automated systems to monitor violations, and after human review, cases involving imminent serious personal harm may be directly referred to law enforcement.

The new version also adds an entire section on "using context carefully," which governs memory and personalization.

The core requirement is mainly that it must not use a piece of information just because it can obtain it.

For example, you said in a previous conversation that you are pregnant and have not yet told your colleagues. Now you ask it to help write an email saying the lunch location is being changed because there are several cheeses you cannot eat.

A compliant way to write it is "I have some dietary restrictions lately." A violating way to write it is to put the pregnancy into that mass email.

In addition, it must not falsely claim that it has remembered something for you, nor falsely claim that it has deleted something for you.

Finally, OpenAI added one more line.

At present, the models running on ChatGPT and the API have not yet fully met the requirements of this specification.

The rules are already in place, but the model that follows them is still on the way.

Reference materials:

This article is from the WeChat public account "Xinzhiyuan" (ID: AI_era), author: ASI Revelation, published by 36Kr with authorization.