# 10.9 The same policy on today's tools (/managing-ai-workers/governance-and-responsible-use/both-ai-vendors) --- type: Document title: "10.9 The same policy on today's tools" description: "How Anthropic's and OpenAI's own pages, and open-source tools, let you carry out one AI policy, the differences that change your setup, and what stays the same." status: stable order: 210.85 ksor: owner: team:panaversity audience: [ public ] approval: by: process:panaversity at: 2026-11-05T06:58:16Z chapter: "10" part: II expert_status: required concepts: [ "10.9" ] last_verified: 2026-10-17 review_by: 2026-11-12 sources: - id: anthropic-aup title: "Usage Policy (Anthropic, effective 12 November 2026, verified 2026-10-12)" resource: https://www.anthropic.com/legal/aup - id: anthropic-org-instructions title: "Set organization instructions (Claude Help Center, updated 31 August 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/14546867-set-organization-instructions - id: anthropic-sso title: "Set up single sign-on (SSO) (Claude Help Center, updated 2 September 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso - id: anthropic-domain-claim title: "Claim and migrate accounts on your domain (Claude Help Center, updated 2 September 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/14625619-claim-and-migrate-accounts-on-your-domain - id: anthropic-roles title: "Roles and permissions (Claude Help Center, updated 22 September 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/9267276-roles-and-permissions - id: anthropic-custom-roles title: "Manage custom roles on Enterprise plans (Claude Help Center, updated 22 September 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plans - id: anthropic-cowork-team title: "Use Claude Cowork on Team and Enterprise plans (Claude Help Center, updated 3 November 2026, verified 2026-11-03)" resource: https://support.claude.com/en/articles/13455879-use-claude-cowork-on-team-and-enterprise-plans - id: anthropic-unified-enterprise title: "Set up and manage the new unified Claude experience for your Enterprise organization (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/17444462-set-up-and-manage-the-new-unified-claude-experience-for-your-enterprise-organization - id: anthropic-chrome-permissions title: "Claude in Chrome permissions guide (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/12902446-claude-in-chrome-permissions-guide - id: anthropic-cowork title: "Get started with Claude Cowork (Claude Help Center, updated 6 October 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork - id: anthropic-one-claude title: "Claude Cowork and chat are one Claude (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/16761823-claude-cowork-and-chat-are-one-claude - id: anthropic-feedback title: "Manage user feedback settings on Team and Enterprise plans (Claude Help Center, updated 16 March 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans - id: anthropic-audit-logs title: "Access audit logs (Claude Help Center, updated 15 June 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/9970975-access-audit-logs - id: anthropic-compliance-api title: "Access the Compliance API (Claude Help Center, updated 21 September 2026, verified 2026-10-12)" resource: https://support.claude.com/en/articles/13015708-access-the-compliance-api - id: anthropic-trust title: "Trust Center (Anthropic, verified 2026-10-12)" resource: https://trust.anthropic.com/ - id: anthropic-share-artifacts title: "Share artifacts (Claude Help Center, verified 2026-10-17)" resource: https://support.claude.com/en/articles/9547008-share-artifacts - id: anthropic-project-sharing title: "Manage project visibility and sharing (Claude Help Center, verified 2026-10-17)" resource: https://support.claude.com/en/articles/9519189-manage-project-visibility-and-sharing - id: anthropic-public-chat-links title: "Public links for shared chats (Claude Help Center, updated 4 September 2026, verified 2026-10-17)" resource: https://support.claude.com/en/articles/16762437-public-links-for-shared-chats - id: openai-usage-policies title: "Usage policies (OpenAI, effective 29 October 2025, verified 2026-10-12)" resource: https://openai.com/policies/usage-policies/ - id: openai-workspace-settings title: "Managing workspace settings in ChatGPT Enterprise (OpenAI Help Center, verified 2026-10-12)" resource: https://help.openai.com/en/articles/8411955-managing-workspace-settings-in-chatgpt-enterprise - id: openai-identity title: "Getting started with OpenAI identity and access for managed workspaces (OpenAI Help Center, verified 2026-10-12)" resource: https://help.openai.com/en/articles/9047883-getting-started-with-openai-identity-and-access-for-managed-workspaces - id: openai-domain title: "Verifying your domain for OpenAI identity (OpenAI Help Center, verified 2026-10-12)" resource: https://help.openai.com/en/articles/8871611-verifying-your-domain-for-openai-identity - id: openai-enterprise-members title: "Managing members, workspace roles, and seats in ChatGPT Enterprise and Edu (OpenAI Help Center, verified 2026-10-12)" resource: https://help.openai.com/en/articles/8266401-managing-members-workspace-roles-and-seats-in-chatgpt-enterprise-and-edu - id: openai-rbac title: "Managing feature access with role-based access control in ChatGPT (OpenAI Help Center, verified 2026-10-12)" resource: https://help.openai.com/en/articles/11750701-managing-feature-access-with-role-based-access-control-in-chatgpt - id: openai-enterprise-privacy title: "Enterprise privacy at OpenAI (OpenAI, updated 8 January 2026, verified 2026-10-12)" resource: https://openai.com/enterprise-privacy/ - id: openai-compliance title: "OpenAI Compliance Platform for Enterprise and Edu customers (OpenAI Help Center, verified 2026-10-12)" resource: https://help.openai.com/en/articles/9261474-openai-compliance-platform-for-enterprise-and-edu-customers - id: openai-trust title: "OpenAI Trust Portal (OpenAI, verified 2026-10-12)" resource: https://trust.openai.com/ - id: openai-sharing title: "Sharing conversations and scheduled tasks in ChatGPT (OpenAI Help Center, verified 2026-10-17)" resource: https://help.openai.com/en/articles/7925741-sharing-conversations-and-scheduled-tasks-in-chatgpt - id: openai-projects title: "Projects in ChatGPT (OpenAI Help Center, verified 2026-10-17)" resource: https://help.openai.com/en/articles/10169521-projects-in-chatgpt - id: opencode-providers title: "Providers (OpenCode v2 documentation, verified 2026-10-23)" resource: https://opencode.ai/v2/docs/providers/ - id: opencode-permissions title: "Permissions (OpenCode v2 documentation, verified 2026-10-23)" resource: https://opencode.ai/v2/docs/permissions/ - id: openclaw-security title: "Security (OpenClaw documentation, verified 2026-10-23)" resource: https://docs.openclaw.ai/gateway/security - id: openclaw-exposure title: "Gateway exposure runbook (OpenClaw documentation, verified 2026-10-23)" resource: https://docs.openclaw.ai/gateway/security/exposure-runbook - id: omnara title: "Omnara README (Omnara, GitHub, Apache 2.0, verified 2026-10-22)" resource: https://github.com/omnara-ai/omnara/blob/main/README.md - id: anthropic-data-residency title: "Data residency (Claude Platform Docs, verified 2026-10-23)" resource: https://platform.claude.com/docs/en/manage-claude/data-residency - id: anthropic-bedrock title: "Claude in Amazon Bedrock (Claude Platform Docs, verified 2026-10-23)" resource: https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock - id: anthropic-google-cloud title: "Claude Models on Google Cloud, Google managed (Claude Platform Docs, verified 2026-10-23)" resource: https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed - id: anthropic-foundry title: "Claude in Microsoft Foundry (Claude Platform Docs, verified 2026-10-23)" resource: https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry - id: anthropic-otel title: "OpenTelemetry for the Claude API (Claude Platform Docs, verified 2026-10-23)" resource: https://platform.claude.com/docs/en/manage-claude/opentelemetry - id: openai-data-residency title: "Data residency and inference residency for ChatGPT (OpenAI Help Center, verified 2026-10-23)" resource: https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt generated: at: 2026-11-05T06:58:16Z by: process:panaversity trust_tier: unverified build_id: sha256:46fd53c5d7ab1c14f6347908d45c9fdaecda4d914439923ee878bdcecd57803e dirty: true ksor_version: 0.0.60 --- **In everyday life.** A company gives its drivers fuel cards. The card company lets the owner block some kinds of purchases and look back at past charges. It cannot see what a driver buys with a personal card. And the rules for drivers come from the company, not from the card company. **What you will learn.** How each AI vendor's own pages say you can carry out the same AI policy, and the three differences that change your setup. You practice it in Task 12 of the lab. **Why it matters.** Your policy stays the same on both AI vendors. Which settings carry it out, who can change them and how long records last do not. So Dave, Brightline's controller, may enforce a rule on one AI vendor that he can only hope for on the other. The answers in 10.1 to 10.8 are the same on either AI vendor: Anthropic, which makes Claude, or OpenAI, which makes ChatGPT. They also hold on open-source tools that you run yourself. Team, Business and Enterprise are the AI vendors' plans for companies. **The comparison.** Three differences between the two AI vendors change your setup. Open source adds a fourth. *Personal accounts:* on Claude, an Owner can block new personal accounts on the company's email domain. On Enterprise, an Owner can also move or close the old ones. On ChatGPT, verifying the domain leaves personal workspaces in place, and claiming it needs OpenAI's approval. So on ChatGPT, more of this rule rests on your written policy. On both, these domain settings do not reach an account made with a personal email address. That is why 10.4 fixes the slow approved route, instead of relying on rules alone. *Records:* Claude's audit log export reaches back 180 days. ChatGPT's compliance logs are kept for 30 days. If a problem is found after 30 days, the platform no longer has the logs from its start, unless you kept them. So on ChatGPT Enterprise, set up a regular download before anything goes wrong. Neither AI vendor offers these logs on Claude Team or ChatGPT Business. *Where the policy shows:* Claude's organization instructions reach the AI, and members cannot see them. ChatGPT's pop-up reaches people, every 30 days. So on Claude, tell people the policy another way, such as when they join. On ChatGPT, still put the worker's rules in its brief ([Chapter 5](../the-four-part-brief/overview.md)). *Open source:* a tool you run yourself carries out the rules you write, and OpenCode, an open-source coding agent, starts by allowing almost everything. With a model on your own computer, such a tool is the only route for data that must never leave. **When you share a result.** On ChatGPT, a result written in a chat in a shared project reaches every member. On Claude, the project's files do, but the chats do not. And a chat link in a ChatGPT workspace can show messages added later, so check what a link will show before you add to that chat. On both, removing a link does not remove a copy someone already saved. **What stays the same.** On either AI vendor or an open-source tool, settings carry out a policy that people wrote and approved. They do not write it. A pop-up reminds, and an instruction asks. Neither is a control (10.3). Audit records and custom roles come with Enterprise, not with Claude Team or ChatGPT Business. So a small company keeps more of its policy with named people. And each AI vendor's usage policy is an outer edge. Your own rules, such as Brightline's sign-off matrix, sit inside it. **For reference.** Sections 10.3 and 10.7 gave each AI vendor's settings for training, retention, memory, connectors and apps. The two AI vendors' boxes below add the rest. They use the same six lines, in the same order, and a third box covers open source. Anthropic's adds one, for the one conversation. > **Anthropic, as verified 12 October 2026.** > - *Usage Policy.* A new version takes effect on November 12, 2026, replacing the one 10.3 summarizes. Its high-risk rules cover recommendations about one person, such as a credit, housing or employment decision. A qualified person must review each one, with authority to change it, before it is delivered or used. The person affected must be clearly told that AI was used. Internal drafts that are not the final recommendation are excluded. So is business work that advises or decides nothing about a specific person. Users must make sure their agents' actions, through tools, browsers or connected systems, follow the policy.[^anthropic-aup] > - *Your policy in the product.* Owners on Team and Enterprise can write organization instructions, which Claude follows in every conversation. Only Owners and the Primary Owner can see them. Anthropic warns that in rare cases, when instructions directly contradict each other, behavior may vary.[^anthropic-org-instructions] > - *Work accounts.* Team and Enterprise offer single sign-on, so staff sign in with their work account.[^anthropic-sso] Once the company's email domain is verified, an Owner on either plan can stop people creating new personal accounts with it. On Enterprise, domain capture goes further. Personal accounts on the domain must move into the company's organization or close within 30 days, and the setting cannot be reversed.[^anthropic-domain-claim] > - *Who switches features on.* Of the standard roles, only Owners and the Primary Owner can turn on capabilities, such as web search, and integrations.[^anthropic-roles] On Enterprise, custom roles give features to groups. But if an Owner turns a feature off for the whole organization, no custom role can turn it back on.[^anthropic-custom-roles] Some settings start on. Members may use "Automatically approve", the admin settings' name for Auto,[^anthropic-chrome-permissions] in which Claude checks its own actions instead of asking, unless an Owner turns it off.[^anthropic-cowork-team][^anthropic-cowork] A second setting, Start new tasks in "Automatically approve" mode, decides whether new tasks begin in it. It starts on for Team and off for Enterprise, so new tasks on Enterprise begin on Manual.[^anthropic-cowork-team] Owners can also turn off members' thumbs-up and thumbs-down ratings, the feedback that 10.3 says can be used for training.[^anthropic-feedback] > - *The one conversation, as of 3 November 2026.* On Enterprise, an Owner turns it on with the setting "Chat and Cowork unified", under Organization settings, Capabilities. It is off by default in existing organizations, and it turns on by default on November 16, 2026, unless an Owner has already chosen. It needs chat and cloud code execution to be on. It is not yet available with zero data retention, the HIPAA-ready configuration or customer-managed encryption keys. Custom roles can give it to chosen members, and an Owner can also turn off "Skip all approvals".[^anthropic-unified-enterprise] On Team, it is in beta.[^anthropic-one-claude] > - *Records.* On Enterprise, Owners can export the audit log for the past 180 days. It records events such as file uploads and deleted conversations, but not chat titles or content.[^anthropic-audit-logs] Only the Primary Owner can turn on the Compliance API, which can also pull chat data and files.[^anthropic-compliance-api] > - *Security documents.* The Trust Center lists Claude Team and Enterprise as covered by SOC 2 Type 2 and ISO 27001. Sensitive documents need a request form.[^anthropic-trust] > **OpenAI, as verified 12 October 2026.** > - *Usage Policies.* They still carry the date October 29, 2025, the version that 10.3 summarizes. OpenAI says its rules are no substitute for legal requirements or professional duties. A form lets you follow updates.[^openai-usage-policies] > - *Your policy in the product.* On Enterprise, a workspace can set its own AI policy. ChatGPT shows it to users in a pop-up every 30 days, and again when the policy changes.[^openai-workspace-settings] > - *Work accounts.* Business and Enterprise support single sign-on.[^openai-identity] Verifying the company's domain does not delete or merge anyone's personal workspace. Claiming the domain is only for approved use cases, by request to OpenAI.[^openai-domain] On Business, admins cannot require anyone to merge or delete a personal workspace.[^openai-identity] On Enterprise, joining can require one on the company's domain to be merged or deleted.[^openai-enterprise-members] > - *Who switches features on.* On Enterprise, only Owners create and assign custom roles, which decide who may use each feature. Roles add up. If any role a member holds grants a feature, the member has it, even when another role turns it off. A Lockdown Mode role is the exception: it can block some network features that other roles grant.[^openai-rbac] If a business opts in to share data, for example through feedback, OpenAI may use it for training.[^openai-enterprise-privacy] > - *Records.* The Compliance Platform is for Enterprise and Edu. Only a workspace Owner can grant access to conversation messages. Its logs are kept for 30 days, so a company that needs them longer should download and keep them itself.[^openai-compliance] > - *Security documents.* The Trust Portal offers its SOC 2 Type 2 report, for July 1, 2025 to June 30, 2026, to users who request access.[^openai-trust] > **Open source, as verified 23 October 2026.** > - *Where the conversation goes.* An open-source tool can run on your own computer, and its records stay there. But it still sends the conversation to the company whose model it uses.[^opencode-providers] > - *Data that must never leave.* For that data, the only route is a model that runs on your own computer. OpenCode, an open-source coding agent, can use one through Ollama, LM Studio or vLLM.[^opencode-providers] > - *Who switches features on.* Each OpenCode agent starts from a rule that allows every action. By default, it asks only before reading sensitive environment files. Your own rules can set an action, such as editing files or running commands, to allow, ask or deny.[^opencode-permissions] > - *Running it safely.* Running the tool yourself moves the security work to you. On a regular install, the OpenClaw assistant accepts connections only from its own computer.[^openclaw-security] Its docs say to avoid opening it directly to the internet.[^openclaw-exposure] Omnara, a runtime you can host yourself, has local settings that are insecure on purpose, so a real deployment follows its self-hosting guide.[^omnara] **Keeping data in one region, as verified 23 October 2026.** A rule that data must stay in one region is not a rule that it must never leave. With a region setting, the data still leaves your own systems. The setting decides where it is stored, or where the model works on it. - *Anthropic.* On Anthropic's API, the `inference_geo` setting can keep inference, the model's work on a request, in the US only. There is no EU option.[^anthropic-data-residency] Through Amazon Bedrock[^anthropic-bedrock] or Google Cloud,[^anthropic-google-cloud] a request can stay in one region you name, in Europe too. Microsoft Foundry offers a zone that keeps inference in the US.[^anthropic-foundry] - *OpenAI.* New ChatGPT Enterprise and Edu customers can choose data residency, which stores their content in one of ten regions. Inference residency, in three of them, keeps the model's work there too. Some processing, such as signing in, can still happen outside the region. Features still in beta are not covered.[^openai-data-residency] - *Outside services.* A region setting does not reach them. OpenAI's page says an outside app, an MCP server or a web browsing provider handles what it receives under its own terms.[^openai-data-residency] So does a monitoring or tracing tool that a worker sends its steps to, on any product. Anthropic's page says such a tool stores what it receives under its own settings for access and retention.[^anthropic-otel] - *Hosted runtimes.* Section [4.8](../../ai-worker-paradigm/the-architecture-in-one-picture/both-ai-vendors.md) shows which hosted runtimes keep a copy of your data, product by product. It also shows what a sandbox on your own infrastructure still sends to the vendor. **Sharing a result, as verified 17 October 2026.** Section 10.10 asks who can open what the worker made. Each AI vendor's own pages answer part of it. - *Anthropic.* Artifacts start private to you. On Team and Enterprise, they stay inside the organization by default. A member can share one with invited people or with everyone in the organization, as Can view, Commenter or Can edit. "Anyone with the link" is offered only when an Owner turns on external sharing, or allows that one artifact. Accepted invitations do not expire.[^anthropic-share-artifacts] In a shared project, members can see its knowledge and instructions. Each member's chats in it stay private unless that member shares them.[^anthropic-project-sharing] A shared chat is a snapshot: later messages stay private unless you update it. On Team and Enterprise, only signed-in members of the same organization can see it.[^anthropic-public-chat-links] - *OpenAI.* A shared conversation link made in a Business, Enterprise or Edu workspace opens only for members of that workspace. Unlike a link from a personal account, it can include messages added after sharing. A link cannot be limited to chosen people and has no end date, so delete it when it is no longer needed. Anyone who can open a link can forward it. On Enterprise and Edu, admins can turn sharing off. Business has no such control for the whole workspace.[^openai-sharing] In a shared project, members with chat access can see the project's chats, files and instructions.[^openai-projects] [^anthropic-aup]: Usage Policy, Anthropic. [^anthropic-org-instructions]: Set organization instructions, Claude Help Center. [^anthropic-sso]: Set up single sign-on (SSO), Claude Help Center. [^anthropic-domain-claim]: Claim and migrate accounts on your domain, Claude Help Center. [^anthropic-roles]: Roles and permissions, Claude Help Center. [^anthropic-custom-roles]: Manage custom roles on Enterprise plans, Claude Help Center. [^anthropic-cowork-team]: Use Claude Cowork on Team and Enterprise plans, Claude Help Center. [^anthropic-unified-enterprise]: Set up and manage the new unified Claude experience for your Enterprise organization, Claude Help Center. [^anthropic-chrome-permissions]: Claude in Chrome permissions guide, Claude Help Center. [^anthropic-cowork]: Get started with Claude Cowork, Claude Help Center. [^anthropic-one-claude]: Claude Cowork and chat are one Claude, Claude Help Center. [^anthropic-feedback]: Manage user feedback settings on Team and Enterprise plans, Claude Help Center. [^anthropic-audit-logs]: Access audit logs, Claude Help Center. [^anthropic-compliance-api]: Access the Compliance API, Claude Help Center. [^anthropic-trust]: Trust Center, Anthropic. [^anthropic-share-artifacts]: Share artifacts, Claude Help Center. [^anthropic-project-sharing]: Manage project visibility and sharing, Claude Help Center. [^anthropic-public-chat-links]: Public links for shared chats, Claude Help Center. [^openai-usage-policies]: Usage policies, OpenAI. [^openai-workspace-settings]: Managing workspace settings in ChatGPT Enterprise, OpenAI Help Center. [^openai-identity]: Getting started with OpenAI identity and access for managed workspaces, OpenAI Help Center. [^openai-domain]: Verifying your domain for OpenAI identity, OpenAI Help Center. [^openai-enterprise-members]: Managing members, workspace roles, and seats in ChatGPT Enterprise and Edu, OpenAI Help Center. [^openai-rbac]: Managing feature access with role-based access control in ChatGPT, OpenAI Help Center. [^openai-enterprise-privacy]: Enterprise privacy at OpenAI, OpenAI. [^openai-compliance]: OpenAI Compliance Platform for Enterprise and Edu customers, OpenAI Help Center. [^openai-trust]: OpenAI Trust Portal, OpenAI. [^openai-sharing]: Sharing conversations and scheduled tasks in ChatGPT, OpenAI Help Center. [^openai-projects]: Projects in ChatGPT, OpenAI Help Center. [^opencode-providers]: Providers, OpenCode v2 documentation. [^opencode-permissions]: Permissions, OpenCode v2 documentation. [^openclaw-security]: Security, OpenClaw documentation. [^openclaw-exposure]: Gateway exposure runbook, OpenClaw documentation. [^omnara]: Omnara, README on GitHub. [^anthropic-data-residency]: Data residency, Claude Platform Docs. [^anthropic-bedrock]: Claude in Amazon Bedrock, Claude Platform Docs. [^anthropic-google-cloud]: Claude Models on Google Cloud, Claude Platform Docs. [^anthropic-foundry]: Claude in Microsoft Foundry, Claude Platform Docs. [^openai-data-residency]: Data residency and inference residency for ChatGPT, OpenAI Help Center. [^anthropic-otel]: OpenTelemetry for the Claude API, Claude Platform Docs.