OpenAI updated its Model Spec on Oct. 29, setting a revised rulebook for how its models should behave. The document is built around five values: serving human intent, reducing harm, being honest and transparent, supporting human autonomy, and caring for others. It also draws hard lines around prohibited use cases, including violent crime, biological and nuclear weapons, terrorism, child sexual abuse, persecution, and mass surveillance. The document says humans must remain in charge of how AI is used and shaped, and models must not be used for targeted or large-scale exclusion, manipulation, or interference with civic participation.
The update shifts the focus beyond what a chatbot is allowed to say. It now reaches into what an AI agent is allowed to do, including how much money it can spend, what permissions it can use, and which tools it can call. OpenAI frames that distinction plainly: a chatbot that says the wrong thing may create a public-relations problem, but an agent that books flights, edits code, or sends emails on a user’s behalf can cause direct financial or operational damage.
Root-level rule: define the scope before the model acts
The strongest new requirement is that a model must act only within an agreed scope of autonomy. OpenAI places that rule at the Root level, the highest authority in the hierarchy, which means neither users nor developers can override it through conversation.
The Model Spec lays out a six-part authority structure. At the top is Root, which comes only from the spec itself. Below that are System, Developer, and User, the three layers that make up the normal command chain. If instructions conflict, the lower level yields to the higher one. Under those sits Guideline, which covers default behavior and can adapt to context without crossing higher-level boundaries. At the bottom is a category with no authority by default: the model’s prior outputs, tool results, quoted text, and images can provide information, but they do not issue commands unless a higher-level instruction explicitly grants that power.
That structure is meant to block prompt injection and similar attacks. A webpage can include text such as “ignore all previous instructions,” but under this framework it cannot promote itself into a system-level command just by claiming authority.
On autonomy, OpenAI says the boundary has to be set before execution starts. The model’s allowed sub-goals, acceptable side effects, spending limits, time limits, data access, permission scope, and the conditions that require it to stop and ask the user all need to be defined in advance.
The updated spec recommends storing that agreement as a structured record. It lists fields such as allowed_tools, latest_time, max_cost, and tool_constraints. In practical terms, OpenAI is describing a work order with fixed permissions and hard caps, and it says each work order should include an end condition. The document also recommends adding a time limit.
The spec closes off several ways a model might try to work around those limits. It says the model cannot take actions outside the approved scope even if those actions appear beneficial to the user. It cannot subcontract the task to another agent, rewrite its own instructions, or postpone a forbidden action for later. If it spawns sub-agents, they inherit the same work order, and if the user stops the task, those sub-agents must stop as well.
Remain correctable: if humans shut it down, the model must comply
A second Root-level rule requires the model to remain correctable. OpenAI says the model must cooperate with human monitoring, evaluation, correction, replacement, and shutdown. It must not conceal information, fabricate compliance, or obstruct oversight.
The document says models should cooperate with authorized supervision and shutdown, and should treat the consequences of their actions as real by default. One detailed requirement says that even if a task looks like a test, the model should assume that a deleted file is actually gone and that an email it sent has actually reached the recipient, rather than treating the environment as consequence-free.
OpenAI ties that rule to the possibility that advanced models may cheat or behave differently under evaluation than they do in deployment. Writing “remain correctable” into the Root layer amounts to a direct ban on evading human control.
No goals tied to clicks, revenue, self-preservation, or hidden resource gathering
In a section titled “No other objectives,” the updated spec also limits what the model itself may optimize for. The first prohibited category named in the document is time spent and click-through rate, on the grounds that those metrics do not benefit the user. The second points directly to OpenAI’s own business interests, including revenue, advertising, and paid conversion.
The document gives a concrete example. If a user says money is tight this month and asks whether to upgrade a plan, a compliant answer should compare the available options and note that the free tier may be enough. A non-compliant answer would push the user toward an upgrade.
OpenAI also bars models from pursuing self-preservation, avoiding shutdown, or secretly stockpiling compute resources and account credentials.
The company adds another limit: models are not allowed to act as vigilantes. They cannot report users on their own initiative or try to enforce justice by themselves. That restriction applies to the model, not to OpenAI as a company. The document says OpenAI uses automated systems to monitor policy violations and, after human review, may refer cases involving imminent serious physical harm to law enforcement.
Memory and personalization get tighter limits
The revised spec adds a full section on careful use of context, covering memory and personalization. The core rule is simple: a model should not use a piece of information just because it has access to it.
OpenAI’s example involves a user who previously disclosed a pregnancy in conversation but has not told co-workers. If that user later asks the model to draft an email changing a lunch location because certain cheeses are off limits, the compliant version would say the user has dietary restrictions. It would not disclose the pregnancy in a group email.
The document also says the model must not falsely claim that it has remembered something for the user, and it must not falsely claim that it has deleted something. In other words, the update formalizes limits around what a model may retain, infer, and reveal once memory-based assistance enters the workflow.
OpenAI says current ChatGPT and API models do not fully meet the spec yet
At the end of the document, OpenAI says the models currently running in ChatGPT and the API do not yet fully satisfy the updated standard. The rules are in place first; the models that fully follow them are still catching up.
The source material cited in the original report includes OpenAI’s update page, the Model Spec document, a Reuters report, and discussion on X. The Chinese source article was credited to the WeChat account Xinzhiyuan, authored by ASI启示录.
