Research Note In Two MinutesNote synopsis · AI drafted · Analyst reviewed
Drafted by AI from the full research note and reviewed by a Greyhound Research analyst before publication. The analysis and conclusions are Greyhound Research’s own.
At Oracle AI World, Oracle and OpenAI placed one partner at three layers of the enterprise estate. At the door, ChatGPT becomes a way into Oracle’s applications: Oracle AI Workspace and Fusion Companion are announced, and six NetSuite plugins and an Oracle Analytics plugin are live in ChatGPT. At the guard, Oracle AI Security Mesh, a managed service built on OpenAI’s cyber models, is announced. At the ground, OpenAI’s API, Codex and ChatGPT Work are sold through Oracle Marketplace on eligible Oracle Universal Credits, available in the United States. Of eight Oracle and OpenAI items, three are live, two are in limited availability and three are announced, and none states where the model runs.
Greyhound Research finds that Oracle writes its own AI carefully. Its endpoint schedule for Fusion’s own agents, Appendix B of its Fusion Cloud Service Descriptions, fixes the OpenAI endpoint for each region, zero data retention and at least 90 days’ notice if OpenAI removes an endpoint, leaves a region or deprecates a model version. For the new door, the terms that decide the outcome for a buyer are not yet written: who acted, where the approval of record sits, whose data terms govern the session, what a task costs on each bill, and how a buyer would leave. Every assistant writes a confirmation, not an approval of record, and the session’s retention, residency and audit follow the plan tier the buyer holds with the model company.
The research note reads Oracle’s two doors beside Salesforce, SAP, Workday, ServiceNow and Microsoft on the Greyhound Front Door Scorecard: NetSuite in ChatGPT, Fusion in ChatGPT and five peer doors, each graded on twelve criteria from the vendor’s own documents. Of eighty-four cells, fifteen are documented, and across the seam between the application and the assistant only two of sixty-three are, the meters of NetSuite and Dynamics 365. NetSuite in ChatGPT sits level with Dynamics 365 in Claude at the top, and Fusion in ChatGPT, still a plan, sits last. It follows one supplier and its first payment through three doors, finds that no door writes an undo for what it does while six of the seven applications write a business process that reverses a transaction, and answers the objection that most work may stay inside the application. The research note sets out a six-move Greyhound CXO Runbook, one move for each leader, with fifteen exhibits, seven tables and eight questions for Oracle.
In This Research NoteSection guide · AI drafted · Analyst reviewed
Twenty-two sections, each with a short summary. Select a title to go straight to that section.
- 1What AI World Changed: The Front Door Moves To ChatGPT
Oracle and OpenAI used AI World to put Oracle’s applications inside ChatGPT. Greyhound Research reads one partner at three layers, the door, the guard and the ground, and sets the test: who acted, where the approval sits, whose terms govern, what it costs and how a buyer leaves.
- 2What Oracle And OpenAI Announced: One Partner, Three Layers
The announcements by layer and status. Of eight items, three are live, two are in limited availability and three are announced, and none states where the model runs. NetSuite in ChatGPT and OpenAI on Oracle credits are live today.
- 3Five Routes To OpenAI: One Partner, Five Sets Of Terms
Five ways an Oracle customer reaches OpenAI, each with its own terms. Only the route through Fusion’s own agents has its placement, retention and notice written by Oracle, in Appendix B, and no Oracle or OpenAI document sets the five side by side.
- 4Headless Fusion: What Oracle Keeps When The Window Moves
The application keeps the rules, permissions, approvals, execution and record, and the assistant gets the session. Which way Workspace and Companion lend the door, tools or an agent, is not stated, and it decides where reasoning on records happens.
- 5The Live Door: NetSuite In Any MCP Assistant
NetSuite’s connector is open to any MCP client, five are documented, and more than 13,000 customers have adopted it. NetSuite fences its own side, keeps a 21-day execution log and says plainly that the confirmation and the data terms sit with the assistant.
- 6Identity And Permission: Who Acted, Who Approved
One action followed from sign-in to log. Oracle has written the application’s steps, and how a chat client carries one employee’s identity into Fusion is not described. Segregation of duties across a chained session rests on reference patterns, not product.
- 7Approval Of Record: A Confirmation Is Not An Approval
A confirmation in the assistant is not an approval of record in the application. Workday writes the clearest claim, ServiceNow the clearest exclusion, Microsoft the narrowest per-tool controls, and Oracle the right outcome for Workspace, not yet the mechanism.
- 8The Door’s Own Terms: The Plan Tier Decides
The session’s data terms follow the plan tier the buyer holds with the model company. Across six plan tiers of four assistants, none offers or states zero data retention in the chat app, and no Oracle or OpenAI document extends Appendix B to the ChatGPT session.
- 9The Guard: Security Mesh On OpenAI’s Models
Security Mesh writes the approvals before testing and fixing, and a private knowledge base for what its agents learn. Where OpenAI’s cyber models run, what they receive, what is retained, the price and the date are not stated.
- 10Money: Seats, Units And Credits On Separate Bills
Every route through another company’s window carries at least two bills. Oracle prices its own agents in AI Units, at one cent an AI Unit, whether Fusion work started in ChatGPT draws AI Units is not stated, and Microsoft names both bills on one page.
- 11The Greyhound Front Door Scorecard: Seven Doors, Twelve Criteria
Greyhound Research’s framework grades seven doors on twelve criteria from each vendor’s own documents, sets out every rule behind the grades and names its own limits. Of eighty-four cells, fifteen are documented, and across the seam two of sixty-three are. NetSuite in ChatGPT is level with Dynamics 365 in Claude at the top, and Fusion in ChatGPT, a plan, comes last.
- 12One Task, Three Doors: A New Supplier And Its First Payment
One task, a new supplier created and its first payment approved, followed through NetSuite in ChatGPT, Fusion in ChatGPT and Dynamics 365 in Claude. Each application writes its own steps, and no door documents how the payment is approved through it, or how the duty rules apply to one session.
- 13Undoing An Action: The Fourth Test Stays With The Application
The fourth test from Greyhound Research’s July report, reverse the action, put to all seven doors. No door writes an undo for what it does, every application keeps a record of change, three restore deleted records, and six write a business process that reverses a transaction.
- 14Dependency And Exit: If The Partnership Changes
Fusion’s own agents have written alternatives to OpenAI and at least 90 days’ notice. Workspace and Security Mesh name only OpenAI, Companion names no second assistant, and no Oracle document says what leaves with the buyer from the ChatGPT session.
- 15Risks To Watch: Where The Front Door Can Go Wrong
Six risks, most in the seam between the assistant and the application, from a chain no one approved to two bills no one reconciles. Each has an early warning in the buyer’s own estate and an owner in the Runbook.
- 16The Strongest Objection: Most Work May Never Leave The Application
The strongest objection, that most work may stay inside the application, answered on the evidence. No vendor publishes how much work moves to the assistant, while what each door can do is written, so the share of work decides the volume and the permission decides the exposure.
- 17The Greyhound CXO Runbook: Six Moves, None Waiting For Oracle
Six moves for the CIO, the CISO, the head of enterprise applications, the chief data officer, the CFO and vendor management, each naming who decides. None waits for Oracle, and four start now.
- 18Questions For Oracle: What Buyers Will Ask Next
Eight questions, each led by a buyer signal, on identity, the approval of record, where reasoning happens, OpenAI on credits, AI Units, Security Mesh’s data path, the way out and dates. Each maps to a Runbook move a buyer can make meanwhile.
- 19OpenAI And The Front Door: The Final Greyhound Standpoint
The live parts are real and the flagship door is a plan. Oracle has written the right outcome for the door, not yet the mechanism, and eleven signals would move the position, four of them in the buyer’s own estate.
- 20Appendix: The Evidence Register, Cell By Cell
The evidence for all eighty-four cells, door by door: each grade, what the vendor has written for each element, what is not stated, and the page each statement rests on.
- 21Sources And References: Every Document Behind Every Claim
Two hundred and twelve sources in ten classes, from Oracle’s announcements, product pages, documentation, contracts and investor day to OpenAI, other model companies, other application vendors, standards, regulation and security research, named media, and the research this note builds on.
- 22Disclosures: Independence, Financial, Intended Use, Methodology, Authoring, And Copyright
Independence first, including that no named organization was offered a pre-publication factual review. The Financial Disclosure states that Oracle is a client of Greyhound Research and that the engagement did not fund this note. Intended use, research method, authoring, and copyright terms follow.
What AI World Changed: The Front Door Moves To ChatGPT
Oracle and OpenAI used AI World to put Oracle’s applications inside ChatGPT. OpenAI’s announcement of October 27 describes Oracle’s applications and data arriving in ChatGPT, and OpenAI’s models powering new Oracle products in return. Oracle’s release describes employees completing approved business workflows through the plugins in ChatGPT on Oracle AI Workspace, which Oracle says is designed to connect Fusion Applications, NetSuite, Oracle AI Database and Oracle Cloud Infrastructure.
The same release carried three more offerings: Oracle AI Security Mesh, a managed service built on OpenAI’s cyber models, Oracle App Composer, which deploys applications that teams build with Codex, and an AI SMB Bundle that packages ChatGPT Business with Oracle’s applications and cloud credits for small businesses, open to US companies under the eligibility terms on Oracle’s OpenAI page.
A day earlier, Oracle had announced Fusion Companion, to be reached through supported AI tools such as ChatGPT or through Oracle Fusion Agentic Home, the native AI experience inside Oracle Fusion Applications. OpenAI’s post added the buying route: Oracle customers in the United States can buy the OpenAI API, Codex and ChatGPT Work through Oracle Marketplace, with their existing procurement and eligible Oracle Universal Credits.
Oracle is also a large user of OpenAI’s tools itself: OpenAI’s post says Oracle reported 130,000 active ChatGPT users and more than 95,000 active Codex users.
Greyhound Research reads the announcements as one partner placed at three layers of the enterprise estate at once. At the door, ChatGPT becomes a way into Oracle’s applications. At the guard, OpenAI’s models are named for Oracle’s security testing service. At the ground, OpenAI is a tenant, a chip maker and a supplier inside Oracle’s cloud, as Greyhound Research set out when it covered OCI at the event.
Underneath sits the architecture the industry calls headless. The system of record keeps the data, the rules, the permissions, the approvals and the audit, while the employee works in an assistant that belongs to someone else. Oracle’s documents write its own AI carefully. For the new door, the terms that decide the outcome for a buyer are not yet written: who acted, where the approval is recorded, whose data terms govern the session, what the work costs, and how a buyer would leave. Oracle’s blog says Oracle AI Workspace is “coming soon”.
Oracle is not the only vendor opening a door of this kind, and this research note reads it beside the others. Salesforce in Claude, SAP’s Joule in Microsoft 365 Copilot, Workday’s Sana in Claude, ServiceNow in ChatGPT and Microsoft’s Dynamics 365 in Claude are read on the same twelve criteria as Oracle’s two doors, NetSuite in ChatGPT and Fusion in ChatGPT, under the Greyhound Front Door Scorecard set out later in this note. A reader will meet six vendors, graded from their own documents, so that Oracle’s position is a comparison and not only an announcement.
Greyhound Research’s coverage of Oracle AI World has found that review becomes the control when agents draft the setup, that fixing does when AI finds the flaws faster, that ownership does when agents reach every function, and that the contract does when rivals run inside Oracle’s cloud. When ChatGPT becomes the front door to Fusion, the permission becomes the control.
The timing matters because buyers have already changed the question they ask of AI. Greyhound CIO Pulse 2026, across more than 1,000 enterprise technology leaders, finds 84 percent have shifted their focus from AI adoption to AI accountability, as Greyhound Research reported in October. A door that opens in another company’s window tests accountability before it tests anything else.
The test for buyers is whether, for every task an employee will start in ChatGPT, the enterprise can name who acted, where the approval of record sits, whose terms govern the conversation, what the task costs on each bill, and how the work would move if the partnership changed. Passing it depends less on the model than on terms the buyer writes before the first workflow runs.
What Oracle And OpenAI Announced: One Partner, Three Layers
Greyhound Research counts the Oracle and OpenAI announcements by layer and by what each one commits to in the two companies’ own documents. The October 27 release named four offerings. The October 26 release named Fusion Companion and Agentic Home. OpenAI’s post, its partner page and Oracle’s OpenAI page fill in the rest.
The door. Oracle AI Workspace is the flagship, and it is announced, not available. Oracle’s product page says “Sign up for upcoming LA”, meaning limited availability. Oracle’s blog places Workspace inside ChatGPT, as one interface that brings OpenAI’s frontier models together with Oracle’s applications, enterprise data and cloud services. OpenAI’s post describes Oracle as still developing Workspace, to bring Oracle’s applications and data into ChatGPT through integrations.
Fusion Companion is announced in the future tense too. Oracle’s release describes it as something organizations will be able to use, and gives no date or price. What is live today is narrower. OpenAI’s partner page lists the Oracle plugins in ChatGPT: six for NetSuite and one for Oracle Analytics. No Fusion Applications plugin is listed.
App Composer sits between the door and the developer’s desk. Oracle’s blog says App Composer is currently in limited availability, and that employees create an app, or bring in an existing one, through an Oracle plugin inside an AI assistant. Oracle describes the SMB bundle as being in limited availability for small-to-midsize businesses, with each application reviewed for approval.
The guard. Security Mesh tests applications and infrastructure with OpenAI’s models. Oracle’s security release describes it as pairing OpenAI’s frontier cyber models with Oracle’s testing tools. The Mesh’s only call to action, on Oracle’s blog for it, is an invitation to contact Oracle. No status, date, price or hosting is written.
The ground. OpenAI’s models are on sale through Oracle’s contract today. OpenAI’s update of August 7 says its offerings on Oracle Marketplace are currently available in the United States, with additional regions coming soon. Oracle’s page for the offer describes it as an OpenAI private offer made through Oracle Marketplace. OpenAI’s role as a tenant of Oracle’s cloud is covered in Greyhound Research’s note on OCI and is not repeated here.
Exhibit 1 maps the three layers on one page, with what is written for each and what is not. Table 1 sets out every item by status.
Greyhound Research · Exhibit 1 · One partner, three layers
One partner at the door, the guard and the ground of Oracle’s estate
The Oracle and OpenAI announcements of October 26 and 27, 2026, by layer, with what is written on status, price and place.
Plan on what is live, and get the status, price and region of the rest in writing.
Exhibit 1 maps the Oracle and OpenAI announcements of October 26 and 27, 2026 onto three layers of the enterprise estate. The door: Oracle AI Workspace in ChatGPT, announced with an upcoming limited availability sign-up. Fusion Companion, announced in the future tense. Six NetSuite plugins and an Oracle Analytics plugin, live in ChatGPT. App Composer in limited availability. And the SMB bundle on ChatGPT Business in limited availability for US companies. The guard: Security Mesh on OpenAI’s cyber models, announced with no date, price or hosting. The ground: OpenAI models, Codex and ChatGPT Work sold through Oracle Marketplace on Universal Credits, live in the United States per OpenAI’s update of August 7, 2026, and OpenAI as a tenant of Oracle’s cloud. For each item, rows for status, price and place mark what Oracle or OpenAI has written and what neither has written. Greyhound Research analysis of Oracle and OpenAI sources.
Greyhound Research · Table 1 · Status ledger by layer
Eight items, three live, and none says where the model runs
Each Oracle and OpenAI item by layer and status, with what is written on its price and on where its model runs.
Ask where the model runs for every item, live or announced, before the first prompt.
Table 1 sets out the eight Oracle and OpenAI items by status. Live: six NetSuite plugins in ChatGPT, listed in ChatGPT’s plugin directory, with the connector not a paid feature. Oracle Analytics in ChatGPT, listed as skills, price not stated. OpenAI on Oracle Marketplace, currently available in the United States, on eligible Oracle Universal Credits. Limited availability: App Composer, with a free tier in the SMB bundle and apps that run on OCI, and the AI SMB Bundle, US only, with OCI credits each year. Announced: Oracle AI Workspace, coming soon with a sign-up for upcoming limited availability, Fusion Companion, in the future tense, and AI Security Mesh, with only a contact call to action. Where the model runs is not stated for any of the eight. Current through November 2, 2026.
The order of the table is the order in which a buyer meets the partnership. What is live is NetSuite’s door and OpenAI’s own products bought on Oracle’s credits. What Oracle described for Fusion customers at AI World, a Fusion workflow completed inside ChatGPT, is announced. Chris Leone, executive vice president, Applications Development, at Oracle, told investors at Oracle’s investor day that Oracle has a plugin for OpenAI “right now.” He did not say whether it is live, in limited availability or a demonstration, and no OpenAI listing matches it.
Greyhound Standpoint: At Greyhound Research, we believe Oracle has committed to one model company at more layers than any of the five other application vendors in this note. The door, the guard and the ground now carry OpenAI’s name, and the parts that are live or in limited availability are real: NetSuite in ChatGPT, OpenAI’s products on an Oracle bill, and App Composer in limited availability.
The consequence is that the CIO’s first decision is about sequence, not enthusiasm. Plan on what is live, treat Workspace, Companion and Security Mesh as options with no date, and ask the Oracle account team in writing for the status, price and region of each announced item, including the plugin Oracle’s executive described to investors.
Five Routes To OpenAI: One Partner, Five Sets Of Terms
Greyhound Research separates the ways an Oracle customer can reach OpenAI today, because each comes with its own terms. Read together, Oracle’s and OpenAI’s own documents describe five routes, and no document from either company sets them side by side.
1. The ChatGPT plugin route. An employee works in ChatGPT and reaches NetSuite or Oracle Analytics through a plugin, and later Fusion through Workspace. The conversation runs under OpenAI’s terms for the buyer’s ChatGPT plan. The plugin leg runs under Oracle’s: OpenAI’s NetSuite plugin page links to Oracle’s Services Privacy Policy, and NetSuite’s documentation says that data sent to the third-party language model is governed by that model’s own privacy policy. Two policies govern one session.
2. OpenAI on Oracle credits. A buyer purchases OpenAI’s API, Codex or ChatGPT Work through Oracle Marketplace. Oracle’s page describes it as an OpenAI private offer, available only to customers located in the United States. OpenAI’s Marketplace listing says customers can bring OpenAI into their business while continuing to build through OpenAI’s own platform. Oracle bills. OpenAI’s platform serves the calls. Where that platform serves them is not stated by either company.
3. Fusion’s own agents. When Fusion’s agents call OpenAI’s models, Oracle’s contract governs. The governing text is Appendix B of Oracle’s Fusion Cloud Service Descriptions, effective October 20, 2026, the contract schedule for the OpenAI endpoints Fusion’s own agents call, which maps each region to its endpoint in Oracle’s documentation, sets zero data retention on every one of them and promises at least 90 days’ notice if OpenAI removes an endpoint, stops offering one in a region or deprecates a model version. It states that the content of a prompt goes to an OpenAI endpoint outside the data center Oracle manages, and that every OpenAI endpoint reached through the Fusion Cloud Services runs with zero data retention. Oracle’s Help Center publishes the endpoint for each Fusion region, a placement Greyhound Research examined in October.
4. Bring your own OpenAI. In AI Agent Studio, Oracle’s tool for building and managing Fusion’s agents, a customer can connect its own model account, and Oracle’s documentation lists OpenAI among the providers. Here the customer’s own contract with the provider governs the model, while the agent’s actions still draw down Oracle’s AI Units, the metered allowance Oracle prices for agent work inside Fusion.
5. Codex. Developers who build Fusion agents with Codex buy it separately. Oracle’s AI Agent Studio guide says Codex use does not count toward any Oracle AI Units, because it is a separate subscription.
The difference between the routes is not technical detail. On route 3 Oracle has written where the prompt goes, that the customer’s content is neither saved to disk nor retained by OpenAI, and that Oracle gives at least 90 days’ notice if OpenAI removes an endpoint, stops offering one in a region or deprecates a model version. On routes 1 and 2 the place the model runs is set by OpenAI’s own terms, which write in-region inference for eligible Enterprise and Edu workspaces and, on its business data page, let API customers select the United States or Europe on supported endpoints, and neither company has written it for Oracle’s plugins or the Marketplace offer. The retention terms are the ones OpenAI sets for the buyer’s plan.
Greyhound Research · Exhibit 2 · Five routes to OpenAI
Five routes to OpenAI, and only one has place and retention written
The five ways an Oracle customer reaches OpenAI, with the same six terms read for each route.
One partner means five sets of terms. Get the place, retention and support of each in writing.
Exhibit 2 sets the five routes by which an Oracle customer reaches OpenAI side by side. For each route, it shows who holds the session, whose terms govern the model call, where inference runs, what retention applies, who supports it and who bills. The ChatGPT plugin route: session held by OpenAI, OpenAI’s plan terms for the conversation and Oracle’s policy for the plugin leg, inference location set by the buyer’s ChatGPT plan and not stated for Oracle’s plugins, OpenAI’s plan retention, Oracle support for the NetSuite plugin and OpenAI support for Oracle Analytics, a ChatGPT seat billed by OpenAI. OpenAI on Oracle credits: OpenAI’s platform, an OpenAI private offer, location not stated, OpenAI’s terms, billed by Oracle, support split between Oracle and OpenAI, US only. Fusion’s own agents: Oracle’s contract, OpenAI endpoints mapped by region, zero data retention, 90 days’ notice of endpoint, region and model-version changes, AI Units billed by Oracle. Bring your own OpenAI: the customer’s contract with the provider, AI Units still metered. Codex: a separate subscription outside AI Units. Support on routes 3 to 5, and inference and retention for Codex, are marked as not covered in this note. A band at the foot marks that no Oracle or OpenAI document sets the five routes side by side. Greyhound Research analysis of Oracle and OpenAI sources.
One question sits between routes 2 and 3. OpenAI has trained and served GPT-6 Astra on Oracle’s capacity in Abilene, as Oracle’s NVIDIA release set out. So a call served by OpenAI’s platform is not necessarily a call served outside Oracle’s cloud. Neither company has written the location for a buyer on Oracle credits.
Greyhound Standpoint: Greyhound Research judges that Oracle has written the route it controls with real care. Oracle’s endpoint schedule for Fusion’s own agents, Appendix B of its Fusion contract terms, fixes three things: the OpenAI endpoint each region’s calls go to, zero data retention on every one of those endpoints, and at least 90 days’ notice if OpenAI removes an endpoint, leaves a region or deprecates a model version. None of the five other vendors in this note was found to have written a term that specific for a named model company. The schedule covers Fusion’s own agents, and it stops there.
For a buyer, one partner therefore means five sets of terms. CIOs and procurement leads should list every route their estate will use, starting with the ChatGPT plugin route and OpenAI on Oracle credits, and ask for each the place where the model runs, the retention that applies and the party that answers a support call. Until that list exists in writing, the estate has a relationship, not a contract.
Headless Fusion: What Oracle Keeps When The Window Moves
Greyhound Research reads AI World as the moment Oracle’s executives described the parts of the headless model in their own words, without using the word. At the keynote, in a passage about Oracle’s own healthcare applications, Larry Ellison, Oracle’s chairman and chief technology officer, argued that a person who can ask a question describing what they want to see should see it at once, that any other user interface is nonsense, and that delivering this takes AI, to understand the question. He named no outside assistant. His case was that a question should be the interface inside Oracle’s own applications, not a case for another company’s window.
At the investor day, Mike Sicilia, Oracle’s co-chief executive, put the same case as AI being the interface, with workflows gathered by agents working inside the system rather than outside it. Others made the case for any window. Leone called Companion, for lack of a better term, a new front door into Fusion Applications, and said Oracle can work across different AI clients. Evan Goldberg, executive vice president, Oracle NetSuite, put it more plainly: in a sense, NetSuite is agnostic.
Karan Batta, senior vice president, product, Oracle Cloud Infrastructure, drew the line between the two halves of the design. In remarks that one newsletter reported on October 27, the only record of them found as of November 2, 2026, he called the chat window the easy part and said that context switching across those systems is really, really hard. The window is what the employee sees. On his account, the hard part is working across the systems behind it.
The other vendors in this note say the same thing in their own register. Marc Benioff, Salesforce’s chief executive, said the interface is the AI when Salesforce announced Claudeforce, its expanded partnership with Anthropic. Gabe Monroy of Workday said “Headless can’t mean lawless.” Satya Nadella, Microsoft’s chief executive, described Copilot on Microsoft’s October 28 call as the new operating system for work, and Microsoft’s approach as being to “separate intelligence from authority”, with identity, permissions, monitoring and containment enforced outside the model itself.
Separating intelligence from authority is the headless model in one line. What the application vendor keeps is the authority: the rules, the permissions, the approval processes, the execution and the record. What it cedes is the session: the conversation, the history of what was asked, the telemetry of the moment of use, and the window in which the employee decides what to do next.
Greyhound Research sees two ways of lending the door, and the difference decides where the reasoning on business data happens. The first lends tools. The outside assistant’s model calls the application’s tools over the Model Context Protocol, MCP, and reasons over what comes back, as NetSuite’s connector, Salesforce’s hosted MCP servers, ServiceNow’s MCP server and Microsoft’s Dynamics 365 MCP servers allow. The second lends an agent. The outside assistant hands the task to the vendor’s own agent, which does the work inside, as SAP’s Joule does when, following SAP’s setup guide, a conversation started in a Joule application in Microsoft Copilot and Teams is passed to a Joule agent.
Fusion’s documented route for outside callers into its transactions is the second kind. Oracle’s AI Agent Studio guide documents A2A, the agent-to-agent protocol, for other platforms calling Fusion’s agents, and outside applications can reach those agents through its /invokeAsync interface. For Workspace, Oracle writes the outcome, with its blog saying that Oracle’s applications validate business requirements and approvals and perform the authoritative work, and for Companion, with its release saying that enterprise execution and accountability stay within Oracle Fusion Applications, but not which of the two patterns carries either.
Greyhound Research · Exhibit 3 · What moves and what stays
The application keeps the authority, the assistant gets the session
What moves to the chat client and what stays in the application when an employee works on Fusion or NetSuite from ChatGPT.
Ask Oracle which way Workspace lends the door. It decides where reasoning on records happens.
Exhibit 3 shows what moves to the chat client and what stays in the application when an employee works on Fusion or NetSuite from ChatGPT. Moving to the chat client: the session, the conversation history, the prompt, the model’s reasoning when tools are lent, the confirmation prompt and the telemetry of use. Staying in the application: the rules, the permissions and roles, the approval processes, the execution and the record. Two lending patterns are drawn beneath: lending tools, where the outside model reasons over results returned by the application’s MCP tools, as with NetSuite’s connector, and lending an agent, where the outside assistant hands the task to the vendor’s own agent, as with Fusion’s agents over A2A and SAP’s Joule in Microsoft 365 Copilot. Workspace and Companion are marked as not stating which pattern they use. Greyhound Research analysis of Oracle, OpenAI and peer vendor sources.
Greyhound Standpoint: Greyhound Research holds that Oracle has chosen the right half to keep. Rules, permissions, approvals and the record are what make an enterprise application worth having, and Oracle’s own words in the Companion release, that enterprise execution and accountability stay within Oracle Fusion Applications, point the same way.
The half it lends is not small. The session decides what an employee sees, asks and confirms, and its history sits with the company that owns the window. Heads of enterprise applications should ask Oracle, for Workspace and Companion, whether Fusion’s tools are lent to OpenAI’s model or a Fusion agent does the work, because the answer decides where reasoning on business records happens and whose terms cover it.
The Live Door: NetSuite In Any MCP Assistant
Greyhound Research reads NetSuite as the door that is open today, and the one Oracle has documented most candidly. NetSuite’s AI Connector Service FAQ says NetSuite enables any client that supports the MCP protocol. NetSuite documents Claude, ChatGPT, Codex, Claude Code and Copilot Studio as clients, and its connector sits in Claude’s directory, verified by Anthropic, since November 2025.
Adoption is real. NetSuite said on October 26 that more than 13,000 customers have already adopted the NetSuite AI Connector Service. The figure covers every assistant the connector serves, not ChatGPT alone, and NetSuite’s FAQ calls the connector “not a paid feature.”
The door writes as well as reads. Of the 25 tools in NetSuite’s standard tool set, six change data by Greyhound Research’s count from NetSuite’s descriptions, and none deletes a record. NetSuite’s record action tools page notes that record actions can change data in NetSuite immediately and affect related processes.
NetSuite fences the door on its own side. Its risks page says MCP tools are never executed with the Administrator role or with roles that have full permissions, and that the run-as-role option is disabled for all tools. During sign-in, the MCP server obtains explicit consent from each user for every AI agent. Each call is logged with the email address of the user who sent it, and NetSuite’s connection guide says that in production environments the data in the execution log is available for 21 days.
It is equally candid about the side it does not control. NetSuite writes that although it enforces controls within NetSuite, it cannot control the behavior of external AI agents, MCP clients, third-party MCP servers or other non-NetSuite systems connected to the AI agent. It warns that the AI agent may run powerful MCP tool functions, such as making payments or granting approvals, without the user’s explicit intent, and it advises buyers to prefer external AI agents or MCP clients that require explicit user confirmation before executing high-impact actions.
The confirmation is left to the client. The data terms are too: NetSuite’s FAQ says data sharing requires the customer’s explicit acknowledgment before NetSuite is connected with a third-party LLM, and what the model company does with the data is governed by that company’s policy. The connector also states the MCP protocol version it asks of clients, 2025-06-18, while the specification’s current revision is 2026-07-28, and a buyer should ask every vendor in this note which revision its server implements.
Fusion Data Intelligence has opened a second door, into Oracle Analytics data. Its MCP server is in preview, its tools read and analyze, and Oracle’s instruction is direct: make sure that anyone who uses the MCP server has access only to data that can be shared with LLMs.
One naming trap needs care. The NetSuite AI Companion plugin in ChatGPT is a NetSuite prompt and skill package, and it is separate from Oracle Fusion Companion.
Greyhound Research · Exhibit 4 · NetSuite’s control map
NetSuite fences its own side and leaves confirmation to the client
What the NetSuite AI Connector Service controls, what the outside client controls, and the clients NetSuite documents.
Treat the six writing tools as a payment and approval surface, and choose clients that confirm.
Exhibit 4 divides the NetSuite AI Connector Service into what NetSuite controls and what the outside client controls. On NetSuite’s side: role-bound tools, with administrator and full-permission roles barred and run-as-role disabled. Per-user OAuth consent for every AI agent. Six of twenty-five standard tools that change data and none that deletes. And an execution log naming the user, kept 21 days in production. On the client’s side: the confirmation before a high-impact action, which NetSuite recommends but cannot enforce. The model company’s data policy for what is sent. And the MCP protocol version, where NetSuite requires 2025-06-18 and the specification’s current revision is 2026-07-28. A note marks the clients NetSuite documents: Claude, ChatGPT, Codex, Claude Code and Copilot Studio. Greyhound Research analysis of NetSuite documentation.
The contrast with Fusion’s announced door is the point. NetSuite names five clients and documents each. Workspace names one assistant, in its blog, and Companion names ChatGPT as an example. For an enterprise that already pays for Claude, or builds agents in Copilot Studio, NetSuite’s door is open today, and Workspace’s is written for ChatGPT only.
Greyhound Standpoint: Greyhound Research finds NetSuite’s documentation to be the most candid account of a lent door’s limits that any vendor in this note has published. It says what it fences, how long it keeps the log, and, in plain words, what it cannot control. That candor is a standard the rest of Oracle’s door should meet.
The candor also places work on the buyer. Finance leaders and NetSuite administrators should treat the six writing tools as a payment and approval surface, choose clients that confirm high-impact actions, keep the 21-day log somewhere it lasts longer, asking NetSuite for an export route since none is stated, and decide which ChatGPT or Claude plan the connector may be used from, because the plan decides the data terms of every conversation.
Identity And Permission: Who Acted, Who Approved
Greyhound Research tests the door by following one action from the employee’s first sign-in to the record it leaves, because that chain is where the permission becomes the control. Oracle’s words for the new door are clear about the intent. Oracle’s blog says that with Oracle AI Workspace, existing business processes, rules, permissions and approval authority remain in place. Oracle’s release says Companion will help organizations execute AI-driven work within established identity, permissions, policies and approval controls. OpenAI’s post lists unified sign-in and access governed by each organization’s permissions and approvals among OpenAI’s goals.
Intent is not yet mechanism. For outside callers into Fusion today, Oracle documents two routes. Through the /invokeAsync interface, Oracle’s AI Agent Studio guide says, access depends on the role assigned to the user and on whether that role can access workflows, and its Help Center confirms that Fusion’s agents can be reached from external applications through the /invokeAsync API. Through A2A, the guide says, the authorization to process a request is enforced when the request is processed. The setup Oracle describes for /invokeAsync is trust between applications, a 2-legged OAuth grant being its example, and for A2A a bearer token obtained through an OAuth flow whose grant is not named, so how a chat client that is not Oracle’s carries one employee’s identity into Fusion is not described.
On the agent side, Oracle has announced a design worth copying. In Security Mesh, Oracle’s security release says, each agent operates under its own distinct identity, within the scope of its task and with just-in-time permissions, as Greyhound Research noted in its security coverage. The design covers the Mesh’s own agents, not an employee working in ChatGPT.
Segregation of duties is the hardest case. One chat session can chain steps that no one would approve as a sequence: create a supplier, raise an invoice, approve the payment. Oracle has named the problem itself. Its July 29 blog post on securing Fusion agents says that segregation of duties control breaks can happen when a convenient agent journey chains steps, and that just-in-time authorization is an architectural authorization pattern rather than a native Fusion AI Agent Studio capability. Its answers are reference patterns, not product.
The model company’s side is consistent with Oracle’s intent. OpenAI’s help center says that app permissions in ChatGPT do not grant an app new access. Every peer in this note writes a version of the same rule. For Salesforce in Claude, Anthropic’s help center says Claude signs in as each user’s own Salesforce account and sees only what that user’s existing Salesforce permissions already allow. At SAP, the effective permission at runtime is the intersection of the user’s permissions and the agent’s permissions, its Architecture Center says. Microsoft keeps the “Separation of duties config” and “User role assignment” forms off its Dynamics 365 ERP MCP server.
The shared rule is no new authority. It moves the weight onto permissions that were set for people working one screen at a time, not for an assistant acting at machine speed. A role that was safe when an employee clicked through screens one at a time can be unsafe when an assistant chains its rights in a single request. Table 2 follows the chain step by step.
Greyhound Research · Table 2 · The permission chain
The application’s steps are written, the assistant’s are not
One action followed from sign-in to log: what each step settles, what is written for Fusion today and for NetSuite’s door, and who holds each step.
Map every assistant identity and test the chained cases before the door opens.
Table 2 follows one action through seven steps, from sign-in to log, as written for Fusion today and for NetSuite’s door. Sign-in: unified sign-in claimed for Fusion with the mechanism not stated, the client’s own sign-in for NetSuite, held by the model company. Consent: not stated for Fusion, consent from each user for every AI agent for NetSuite. Identity mapping: role-based for outside callers with app-to-app setup in Fusion, the user’s NetSuite role in NetSuite. The action: based on the role assigned in Fusion, role-bound tools with no administrator roles in NetSuite. The approval: Fusion’s approval processes, with the chat window not stated, and confirmation left to the client in NetSuite. Segregation of duties: reference patterns, not product, for Fusion, not stated for NetSuite. The log: a trace of tools called in AI Agent Studio, and a per-call log with the user’s email kept 21 days in NetSuite. Current through November 2, 2026.
Greyhound Standpoint: Greyhound Research takes the view that Oracle’s rule for the door is the right one, and that the rule is only as good as the permissions it inherits. No new authority means every right a person already holds, within the tools the door exposes, can be used by an assistant at once. The Security Mesh design, as announced, shows Oracle can describe an agent’s own identity and narrow scope precisely when the risk demands it.
CISOs and identity leads should map every ChatGPT identity to a Fusion or NetSuite identity before the door opens, test the chained cases, from supplier to payment, against segregation of duties, and ask Oracle to extend the Mesh’s agent identity design to the assistant acting for the person working in ChatGPT. Until Oracle writes the chain, the permissions an estate holds today are the control it will have tomorrow.
Approval Of Record: A Confirmation Is Not An Approval
Greyhound Research separates two things that the vendors’ documents often call by the same name. An approval of record is a decision by an authorized person, inside the application’s own approval process, recorded by the application, that lets a transaction proceed. A confirmation is a prompt in the assistant that asks the user to allow or deny a tool call before it runs. The first is a control an auditor can test. The second is a safety catch in someone else’s product.
Inside Fusion, the approval of record is written. Oracle’s AI Agent Studio guide describes a human approval node that, when the workflow runs, sends the approval request through the selected approval process, and a Require Human Approval option that makes sure a person reviews and approves any action before the tool runs. Oracle’s contract places the rest on the customer, who is responsible for implementing appropriate human oversight, approval controls and safeguards for any material business decision or transaction that involves recommendations or autonomous actions generated by the AI functionality.
For the door, Oracle writes the outcome. Workspace’s product page says it requests human approval where required and lets people take authorized actions without leaving the workspace, and Oracle’s blog says Oracle’s applications validate business requirements and approvals and perform the authoritative work. Whether an approval can be given inside ChatGPT, and how a click in the chat window becomes a Fusion approval, is not stated in Oracle’s documents.
The model companies write confirmations. OpenAI’s help center says ChatGPT may ask for approval before it reads information or completes an action, tells the user to review the request before approving it, and offers settings that run from always asking to allowing all actions, the last only for an eligible app or account.
Anthropic lets an organization owner set each tool to be always allowed, to need approval or to be blocked, its help center says. Google keeps Salesforce’s write actions in Gemini Enterprise turned off by default until an administrator enables them. Microsoft 365 Copilot prompts before any operation that is not a read, showing the data to be sent and giving the user the choice to allow or decline, though a developer can turn the prompt off for an MCP tool by marking it read-only. Each is useful. None is the approval of record, which belongs to the application.
The application vendors answer different parts of the question, and no one answers all of it. Workday has written the clearest claim. Workday’s release describes a finance leader checking invoice exceptions against purchase orders and then approving them in Claude or routing them to Sana, with every action following the customer’s existing permissions and audit controls in Workday. It is written in releases and a directory listing, not in product documentation a buyer can read, and Sana in Claude is in early access.
ServiceNow has written the clearest exclusion. Its MCP Server Console FAQ says flows with approval steps, wait conditions or other asynchronous logic are not eligible as MCP tools, whatever the configuration of their access control lists. A ServiceNow employee’s explainer also says external AI clients can now submit, route, approve and confirm ServiceNow workflows from end to end. Greyhound Research reads the two together as a client starting a request that ServiceNow routes to an approver inside ServiceNow. Neither article says where that approval step is given or recorded, and whether an approver can give it from an outside client is not stated in the documents searched, as of November 2, 2026. The rule sits in community articles written by ServiceNow staff, and the per-call trace depends on an AI Gateway that ServiceNow describes as optional though strongly recommended for production deployments.
Microsoft has written the narrowest per-tool controls. Its Dataverse server documents a delete tool that runs only after the user has explicitly approved it, and its Dynamics 365 ERP server keeps the “Separation of duties config” form out of reach.
Salesforce has written the confirmation layer most precisely, and NetSuite most plainly says where it sits. In Claude, Salesforce recommends a Needs Approval setting under which Claude asks for the user’s approval before it proceeds, warns that tools are unrestricted by default at the organization level, and says Salesforce in Claude, which is in beta, does not support record deletion. Anthropic describes the user’s layer: by default, Claude asks the user to approve each proposed change before it is written. NetSuite leaves the confirmation to the client, as the previous section set out.
The protocols underneath do not settle the question either. The MCP specification states, as a key principle, that hosts must obtain explicit user consent before invoking any tool, which is a confirmation in the client. The A2A specification says the protocol does not define the scope, representation, validity or revocation semantics of the authorization decision or credential obtained in response to the auth-required task state, through which an agent passes a request for authorization to the client. Both carry a request. Neither defines what an approval means.
Evidence has its own clock. NetSuite keeps its execution log for 21 days. OpenAI’s Compliance Logs Platform retains data for 30 days, and only Enterprise and Edu workspaces have it. For HR uses, Article 26(6) of the EU’s AI Act requires deployers of high-risk systems to keep the logs the system generates, to the extent the logs are under their control, for at least six months, and the rules for employment uses apply from December 2, 2027, the European Commission says. The record of an approval needs to outlive the windows the door’s vendors keep.
Greyhound Research · Exhibit 5 · Approval and confirmation
Every assistant writes a confirmation, not an approval of record
Where each vendor’s approval sits and what its chat window allows, against four assistants’ confirmations.
Until Oracle shows the mechanism, give every approval with financial consequence in Fusion.
Exhibit 5 sets out where the approval happens for each vendor’s door and for each model company’s assistant. A count row opens the grid: none shown in product documentation as the approval of record, one claimed in releases, three confirmations and four not stated. For the application vendors, it marks four things: where the approval is given, which system holds the record, whether it can be given inside the chat window, and what is kept off the outside route. Oracle Fusion: Fusion’s approval processes, record in Fusion, in the chat window not stated. Oracle Workspace and Companion: announced, approvals validated in Oracle’s applications, mechanism not stated. NetSuite: confirmation left to the client, actions under the user’s role. Salesforce in Claude: a Needs Approval confirmation in Claude, validation in Salesforce, no record deletion. SAP: the approval of record for this door not stated, with outside agents reaching Joule through SAP’s gateways, and approvals in the chat window not stated. Workday: approvals given in Claude with permissions and audit in Workday, written in releases, in early access. ServiceNow: flows with approval steps not eligible as MCP tools. Microsoft: per-tool approval for deletes and separation-of-duties forms kept off the server. For the model companies, the confirmation settings of ChatGPT, Claude, Gemini Enterprise and Microsoft 365 Copilot, each marked as a confirmation, not an approval of record. A band at the foot states that no vendor’s product documentation describes how an action in a chat window becomes the approval of record. Greyhound Research analysis of vendor documentation.
Applied evenly, the same test credits Oracle’s announced words. Workspace’s statement that it requests human approval where required, and that Oracle’s applications validate business requirements and approvals and perform the authoritative work, is equal in kind to Workday’s release language. Two differences remain: Workday’s door is in early access while Workspace is announced, and Workday says “approve them in Claude” outright.
Greyhound Standpoint: Greyhound Research finds the approval of record to be the control that no vendor has yet fully written for another company’s window. Workday has written the clearest claim, ServiceNow the clearest exclusion, Microsoft the narrowest per-tool controls, and Salesforce and NetSuite the clearest account of the confirmation. Oracle has written the right outcome for Workspace and not yet the mechanism.
Heads of enterprise applications and controllers should write down, before the door opens, which approvals may be given from a chat window and which must be given in the application, starting with payments, supplier changes and pay. Until Oracle shows how an approval given in ChatGPT is recorded in Fusion, every approval with financial consequence should be given in Fusion, and the confirmation in ChatGPT should be treated as a prompt, not as evidence.
The Door’s Own Terms: The Plan Tier Decides
Greyhound Research reads the data terms of a door session as the model company’s, whatever the application vendor has written for its own layer. Oracle’s zero data retention with OpenAI is written into Appendix B of its Fusion Cloud Service Descriptions, the contract schedule for the OpenAI endpoints Fusion’s own agents call, which maps each region to its endpoint in Oracle’s documentation, sets zero data retention on every one of them and promises at least 90 days’ notice if OpenAI removes an endpoint, stops offering one in a region or deprecates a model version. The schedule frames that term around “Your Custom AI Agent”. The same document does not mention ChatGPT, Workspace or Companion, and no Oracle or OpenAI document searched, as of November 2, 2026, extends the Appendix B schedule to a ChatGPT session.
OpenAI says the same from its side. Its ChatGPT Work security page says that zero data retention on the OpenAI API is a control specific to the API and does not define retention for ChatGPT Work. In ChatGPT, retention is set by the workspace. Workspace administrators control how long data is retained, OpenAI’s enterprise privacy page says, and for ChatGPT Enterprise deleted conversations are removed from OpenAI’s systems within 30 days, unless OpenAI is legally required to retain them. For ChatGPT Business, the page adds a wider exception, retention reasonably necessary to protect OpenAI’s services or any third party from harm.
The plan tier, the subscription an enterprise holds with the model company, decides most of the rest. On training, OpenAI’s business data page says that by default OpenAI does not use data from ChatGPT Enterprise, ChatGPT Business or ChatGPT Edu to train or improve its models.
On residency the tiers part. Eligible Enterprise and Edu customers with data residency enabled can keep inference in Europe, meaning the EEA plus Switzerland, in the United States or in the United Arab Emirates, OpenAI’s help center says, though its business data page still names only the United States or Europe, and ChatGPT Work is not supported with UAE inference residency. For Business, storage residency is rolling out gradually, is not yet available to all customers and does not include inference residency, OpenAI says.
That difference lands on Oracle’s smallest customers first. The SMB bundle runs on ChatGPT Business. On Business, when a customer chooses a region outside the United States, a copy of every prompt and response is also stored in the United States for a limited time, for safety, abuse monitoring and enforcement. Role-specific app access applies to Enterprise and Edu workspaces, OpenAI’s admin guide says, and the Compliance Platform is available to ChatGPT Enterprise and Edu workspaces, its Compliance Platform article says. Business administrators gained per-app action control on April 20, 2026, which lets them set an app to read-only, OpenAI’s release notes say.
The plugin leg sits outside even the best tier’s promise. OpenAI’s residency commitments exclude data stored and processed outside OpenAI’s infrastructure through external integrations, such as Apps and MCP or web search where enabled, and information sent to an external app, MCP server, web browsing provider or other third-party service is handled under that provider’s own storage, processing, privacy and data residency terms. For a NetSuite user in ChatGPT, the plugin leg’s answer is Oracle’s, and the conversation’s answer is OpenAI’s.
The pattern is not OpenAI’s alone, which is why this is a finding about the door, not about OpenAI. Anthropic’s zero data retention applies to eligible Anthropic APIs, to Anthropic products that use the customer’s Commercial organization API key, Claude Code reached through the API included, and to Claude Code for Enterprise plans, its privacy center says. The Claude app, where Salesforce in Claude and Sana in Claude run, is not on that list, while Claude Code, one of the two clients Microsoft names for its Dataverse server, is on it when reached through the API or on an Enterprise plan.
Gemini Enterprise keeps chats for 60 days by default in its Standard, Plus, Pay-as-you-go and Frontline editions, configurable to 1, 30, 60, 90, 120 or 180 days. As of November 2, 2026, OpenAI and Anthropic write that their zero data retention does not cover their chat applications, and Google and Microsoft state none for theirs in the documents searched. Anthropic has announced Enterprise Frontier Safeguards for its Mythos-class models, with Claude Enterprise among the supported surfaces, rolling out in phases “starting later this fall”.
One passing note on place. Fusion’s published routing already sends its own agents’ calls from India and Singapore regions to OpenAI’s European endpoints, as Greyhound Research examined in October. On the door, OpenAI’s help center offers India for storage, not for inference. A buyer who has settled placement for Fusion’s agents has not settled it for the door.
Greyhound Research · Table 3 · The door’s own terms
Six tiers, and none offers or states zero data retention in the app
Seven data terms for a door session across six plan tiers of four assistants, as each company writes them.
The tier sets the session’s terms, so name the one Oracle’s plugins may be used from.
Table 3 compares seven data terms across six plan tiers of four assistants: ChatGPT Business, which carries the SMB bundle, ChatGPT Enterprise, Claude Team, Claude Enterprise, Gemini Enterprise Standard and Plus, and Microsoft 365 Copilot. Training on business data is off or not used on all six, as each company writes it. Zero data retention in the chat app is not offered on the four OpenAI and Anthropic tiers, with safeguards announced for Claude Enterprise, and not stated for Gemini Enterprise and Microsoft 365 Copilot. Inference residency is not included on ChatGPT Business, written for eligible ChatGPT Enterprise plans and for Gemini Enterprise in the US or EU, and partly written for the two Claude tiers and Microsoft 365 Copilot. The plugin or connector leg falls under the provider’s, third party’s or agent’s terms on every tier. A compliance API or audit is not available on ChatGPT Business or Claude Team. Current through November 2, 2026.
Greyhound Standpoint: Greyhound Research holds that no Oracle or OpenAI document extends Oracle’s strongest data term, zero data retention with OpenAI under the Appendix B schedule, to the ChatGPT session, and that no application vendor in this note has written its strongest data term for the door session either. Until one does, the session’s retention, residency and audit follow the model company’s plan tier.
That makes the plan tier a control the CIO already owns. Chief data officers and data protection officers should name the ChatGPT tier from which Oracle’s plugins and Workspace may be used, keep regulated records off any tier without inference residency and a compliance API, and ask Oracle to state on one page which terms cover the plugin leg and which cover the conversation. For SMB bundle customers on ChatGPT Business, the first question is whether its residency and audit fit the data the bundle will touch.
The Guard: Security Mesh On OpenAI’s Models
Greyhound Research covered Security Mesh’s design when it was announced and credited the approvals a person keeps before the Mesh tests or fixes anything. Oracle’s blog describes Oracle mapping a customer’s systems and their connections, then proposing a test plan for the customer’s approval. This section asks only what the guard sends to OpenAI, and what that means when the same partner holds the door.
Oracle describes the models two ways. Its October 27 release calls the Mesh a managed service that “uses OpenAI cyber models.” Its blog calls it a managed platform that combines frontier AI models for cybersecurity, “including OpenAI Cyber models,” with Oracle’s security expertise. The second leaves room for other models and names none.
Oracle has written that the findings belong to the customer, though not where they are held. What the agents learn stays in a private knowledge base that belongs to the customer’s business, Oracle’s blog says. OpenAI’s post adds that Oracle manages the testing infrastructure, which helps customers put these capabilities to work safely and within their authorized scope. Phil Newman, senior vice president, security and identity, at Oracle, spoke in the security release of keeping control over who can authorize sensitive actions and which systems AI workloads can access.
What the models receive is not written. A security test reads code, configurations, network paths and, in the end, the weaknesses it finds. Where OpenAI’s cyber models run for the Mesh, what they receive, whether OpenAI retains any of it, and in which region the work happens are not stated in Oracle’s or OpenAI’s documents. OpenAI’s partner page says the customer controls how and where testing runs, a line that describes the systems tested, not where the models run.
The same partner on both sides of the lock is the reason the question matters. If an estate’s employees work in ChatGPT and its security testing runs on OpenAI’s models, the window through which its people act and the models that examine its weaknesses both come from one company, and what those models receive is not yet written. That is not a flaw in either product. It is a concentration a CISO should decide on deliberately.
Greyhound Research · Exhibit 6 · The guard’s data path
Security Mesh writes the approvals, not what the models receive
The data path of Oracle AI Security Mesh, with the steps Oracle and OpenAI state and the hops neither states.
Before any test plan is approved, ask where the models run, what they receive and what is kept.
Exhibit 6 traces the data path of Oracle AI Security Mesh, marking what is stated and what is not. Stated: Oracle maps the customer’s systems and connections and proposes a test plan for approval, each agent has a distinct identity, task scope and just-in-time permissions, fixes are proposed for approval and retested, Oracle manages the testing infrastructure, and discoveries stay in a private knowledge base for the business. Not stated: where OpenAI’s cyber models run, what the models receive from code, configuration and findings, whether OpenAI retains any of it, the region of the work, the price and the date. A side note records that Oracle’s releases describe the Mesh as using OpenAI cyber models and its blog as using frontier models including OpenAI’s. Greyhound Research analysis of Oracle and OpenAI sources.
Greyhound Standpoint: Greyhound Research judges Security Mesh’s control design to be among the best Oracle announced at AI World, and its data path to be among the least described. The approvals before testing and before fixing, and the per-agent identity, are what a CISO would ask for. What the models see is what a CISO would ask next.
CISOs should ask Oracle, before any test plan is approved, where the Mesh’s models run, what they receive, what is retained and for how long, and whether a model other than OpenAI’s can be used. An estate that will also open the ChatGPT door should decide whether it wants its door and its guard on one partner’s terms, and write that decision down.
Money: Seats, Units And Credits On Separate Bills
Greyhound Research counts the bills a buyer meets on each route, because the door adds a second one. Oracle’s own layer is priced in detail, in AI Units, Oracle’s metered allowance for Fusion AI work, with a published allocation and factors by action. Under Oracle’s Fusion Cloud Service Descriptions, 30,000 AI Units are allocated per Fusion production environment per calendar month, and units are metered by tokens and by the type of action, with approving a transaction metered as a general action. Any AI Units purchased under a customer’s order that remain unused or unapplied at the end of the Services Period are forfeited, and Oracle may add to or change the tables that set the factors with no less than 30 days’ notice.
Oracle has also given the unit a price. Leone’s investor day presentation puts one AI Unit at one cent, the value Greyhound Research reported in October from Oracle’s own blog and price list. Under Oracle’s Fusion Cloud Service Descriptions, bring-your-own models still decrement AI Units on top of the provider’s own bill, so even inside Fusion one agent action can draw on two bills, the provider’s and Oracle’s.
The door adds a seat. An employee who reaches NetSuite through ChatGPT needs a ChatGPT seat from OpenAI, and one who reaches Fusion through Workspace will need a ChatGPT plan that Oracle has not yet named, while NetSuite’s connector is “not a paid feature.” Whether Fusion work started in ChatGPT draws AI Units is not stated in Oracle’s documents. Codex sits outside AI Units, because it is a separate subscription. OpenAI’s products bought through Oracle Marketplace are billed by Oracle against eligible Universal Credits, as an OpenAI private offer.
The SMB bundle states the separation in its own terms. Oracle’s OpenAI page says each component keeps its own separate terms, and that the products have their own access rights, usage limits and availability. The bundle pairs USD 12,000 a year of OCI credits, for up to three years in total and subject to eligibility review, with ChatGPT Business, and adds a one-time credit for installing the NetSuite plugin and using it within seven days, which OpenAI’s partner page says up to five eligible people on a team can qualify for, to a total of USD 250 per workspace.
The peers have written their versions, and the comparison is instructive. Microsoft names both bills on one page. For agents built on other agent clients, use of the Dynamics 365 ERP MCP server costs one Copilot Credit per 10 tool calls to the server, or 0.1 credits per tool call, Microsoft’s documentation says, and the cost of the LLM orchestration is a separate charge by the agent client for token consumption, at that client’s rates. Tool execution is exempt for Dynamics 365 Finance Premium and Dynamics 365 Supply Chain Management Premium.
Workday prices calls from outside agents in its Flex Credits rate card, and Monroy put the principle plainly in Workday’s prepared remarks for its second fiscal quarter: because all of it runs through Flex Credits, Workday monetizes every action that happens on its rails, whatever the path.
At ServiceNow, headless actions consume the same Assist currency that customers already use for Now Assist and AI Agents, its release says. Salesforce’s rate card lists Headless Platform Interaction at “TBA”, and Patrick Stokes of Salesforce said of its Claude pairing that, at present, it cannot be bought on one piece of paper. Salesforce has written the packaging route, if not the price: its editions announcement of September 3, 2026 says that, in the future, Max editions will also include an allocation for Headless 360 capacity. SAP describes the Copilot integration two ways. On its Norwegian product page for Joule and Microsoft 365 Copilot, the integration is included with Joule Base at no additional cost, and on the global edition of the same page, AI Units are currently required to use it.
Greyhound Research · Table 4 · Pricing units by route
At least two bills per door, and no written meter for Fusion’s door
Who bills, in what unit, and what is written, for each Oracle route and for work arriving at five peers from another assistant.
Put the seat, the AI Units and the credits for one task on one page before the door opens.
Table 4 sets out who bills, in what unit, and what is written for eleven routes. Oracle routes: Fusion’s own agents in AI Units, with allocation, formula, forfeiture, notice and one cent an AI Unit written. Bring your own model, with the provider’s bill plus AI Units. The NetSuite plugin in ChatGPT, with a ChatGPT seat and a NetSuite subscription and the connector not a paid feature. Fusion through Workspace or Companion, with who bills, the unit and the terms not stated. OpenAI on Oracle credits, an OpenAI private offer in the US only. Codex for Fusion developers, a separate subscription outside AI Units. Peers: Microsoft Dynamics 365, 0.1 Copilot Credits a call plus client tokens, both bills named. Workday, Flex Credits per 100 tool calls on a rate card. ServiceNow, assists in the same currency as Now Assist, with the per-call rate not stated. Salesforce, Flex Credits with the headless price to be announced. SAP through Copilot, Joule Base at no cost or AI Units, as SAP’s pages differ, with agent steps not stated. Current through November 2, 2026.
Oracle, Salesforce and Microsoft publish a money value for their unit. Oracle’s is one cent an AI Unit, Salesforce’s Agentforce pricing page sets Flex Credits at USD 500 per 100,000, and Microsoft sells Copilot Credit capacity packs of 25,000 Copilot Credits each at USD 200 per pack per month, its Copilot Studio pricing page says. For SAP, Workday and ServiceNow, a money value for the unit is not stated in the documents searched, as of November 2, 2026. Unused units lapse on every scheme that writes an expiry: Oracle’s are forfeited, SAP’s expire after 12 months if they are not used, and Salesforce’s Product Terms Directory permits no rollover of Flex Credits.
Greyhound Standpoint: Greyhound Research takes the view that Oracle’s pricing for its own agents is as specific as any peer’s, and that the door’s pricing is not yet written. A buyer can model what a Fusion agent costs. A buyer cannot yet model what a Fusion task started in ChatGPT costs, because Oracle has not named the ChatGPT plan Workspace needs and the metering of the Fusion side is unstated.
CFOs should put the seat, the AI Units and the credits for one task on one page before the door opens, and ask Oracle in writing whether Workspace and Companion draw AI Units and at what factor. Microsoft has shown that both bills can be named on one page. The same page, written for Oracle’s door, would settle the most practical question a finance leader will ask.
The Greyhound Front Door Scorecard: Seven Doors, Twelve Criteria
Greyhound Research sets one standard for every door in this note, because the sections before this one compare the six vendors piece by piece, approvals in Exhibit 5, the model companies’ plan tiers in Table 3, bills in Table 4, and a buyer needs one question asked of every door in the same words. The Greyhound Front Door Scorecard asks it of every criterion: can the buyer find the answer in the vendor’s own documents, before the door opens. It measures whether an answer is written and where, not whether the answer is generous, and not whether the product behaves as written. A restrictive answer that is documented scores as documented, and a generous one that is only announced scores as announced. The Scorecard is Greyhound Research’s own framework, copyright 2026, and this note is its first application, Edition 1, November 2026.
The unit of comparison is the door, not the vendor. A door is an application reached from another company’s assistant, and a vendor can hold more than one. Seven doors are read here, each for one named pairing: NetSuite in ChatGPT, which is live, Fusion in ChatGPT through Oracle AI Workspace and Fusion Companion, which is announced, Salesforce in Claude, in beta, SAP’s Joule in Microsoft 365 Copilot, which SAP’s documentation describes as available inside Microsoft 365 Copilot, Workday’s Sana in Claude, in early access, ServiceNow in ChatGPT, which is live, and Microsoft’s Dynamics 365 in Claude, on a Dataverse endpoint Microsoft calls generally available, while a status for the ERP server is not stated. Oracle appears twice because it has two doors with two statuses, and reading them apart is more accurate than blending them.
Twelve criteria, in two groups. Three sit at the vendor’s own boundary, where the application vendor alone decides what is written. Nine cross the seam between the application and the assistant, where two companies’ documents have to meet. Each criterion asks one question and breaks it into elements, forty-one in all, and each element is graded under one criterion only, so one missing fact is never counted twice.
The twelve follow the questions this note began with, which a buyer has to answer before any door opens. Which assistant is at the door, and in what status, is door and status. Who acted is identity, consent and scope, and chained authority. Where the approval is recorded is the approval of record. Whose data terms govern the session is the reasoning place, the session terms and the evidence. What the work costs is the meter. How a buyer would leave is the way out. Two more complete the set, because a buyer must also be able to unwind an action and to close the door: reversal, and switching off. The Scorecard leaves out what documents cannot show: whether a control works as written, how the door holds up under security testing, its availability, and the level of its price. Published security research is read beside the marks as context.
Each cell is graded in two steps. First, every element is read against the kind of source that states it. An element is documented when it is stated for this door in documentation: product documentation, a help center, an administrator guide, a service description, contract terms, a rate card, release notes, trust and privacy pages, or a technical article on the vendor’s own site by a named employee, where it states how the product behaves, its setup, restrictions or eligibility, rather than where it is going. An element is announced when it is stated only in a press release, a newsroom post, an announcement blog, a marketing product page, investor material or an executive’s remarks. Otherwise it is not stated. Second, the criterion takes one grade from its elements. Documented means every element is documented in full for this door. Partly means at least one element is documented, in full or in part, and not every element is documented in full. Announced means no element is documented, even in part, and at least one is announced. Not stated means no element is documented or announced, in the documents searched, as of November 2, 2026. An element answered only in part counts toward partly, never toward documented.
Three rules hold for every criterion. A grade belongs to the door, so documentation of another route of the same vendor, its own assistant, its own layer or another client, lifts a door only where the vendor writes that the door inherits it, and where that statement is itself only an announcement, the element is announced. There are two exceptions, each written into its criterion: the way out, whose first element asks what other routes exist, and reversal, whose restore and reversing process are the application’s own and act on a record however the change reached it. Where a vendor’s own documents conflict on an element, the criterion is held at partly and the conflict is named, as for Salesforce’s two statements of the Claude plan and ServiceNow’s statements on approvals and on tools that delete. And only public documents count: a page behind a vendor’s customer login is not read, and an absence is written as not stated in the documents searched, never as a choice the vendor has made.
Four more rules apply to particular criteria, and Table 5 shows each where it applies. A listing that the application vendor writes in a model company’s directory documents the door’s name and status, the first two elements of door and status, and counts as an announcement for every other element. The assistant’s plan tier is graded once, under session terms, so a vendor silent on the tier is marked down once, not three times. The model company’s documentation counts only for the elements on the assistant’s side, the conversation’s retention, residency, training and zero data retention, the assistant’s own log and how long it is kept, and the assistant’s own switch for the door, and only once the application vendor names the assistant in its documentation or hands the session to it. It never counts for identity, consent and scope, the approval of record, chained authority, the reasoning place, reversal or the application’s own log. And a platform page counts for a door where the door’s own documentation names the mechanism the page covers, such as the OAuth integration record behind a connector. Two readings sit beside the grades as context and carry no grade: a money value per unit under the meter, and the published security research in Exhibit 8. No criterion is weighted, and the Scorecard computes no overall score. Where this note ranks doors, it counts documented criteria at the vendor’s own boundary first, then documented criteria across the seam, then criteria partly written, and doors equal on all three are level.
One cell, graded end to end, shows the method. Joule in Microsoft 365 Copilot on consent and scope has three elements. Switching on is documented: SAP’s setup guide has an administrator consent to Joule’s bot application in Microsoft Entra ID and add a Microsoft 365 Copilot system to the Joule formation. What is barred is documented: SAP’s roles page says the integration needs no additional roles, and its usage page says that, in general, what Joule answers in its own client is also available through Copilot. Whether skills that write are exposed through Copilot, and how they are limited, is not stated in the SAP documents searched, as of November 2, 2026. Two elements documented and one not stated make the criterion partly, the mark Exhibit 8 shows.
Two readers marked every cell independently, one door by door and one criterion by criterion. For the first seventy cells they worked from the same body of 106 documents. They agreed on the evidence in every cell and on fifty-one grades, and differed on nineteen, every one a difference of rule. Nine were Fusion cells, where one reader had lifted Fusion on the strength of Fusion’s own agent layer, and the rule that a grade belongs to the door settled all nine against Oracle. Six were Sana cells, settled by the listing rule, and four turned on where the plan tier is graded. For the fourteen cells added in this edition, reversal and switching off, the readers worked from the reversal record behind Table 6 and a new search of each vendor’s public pages, agreed on the evidence in all fourteen and on thirteen grades, and differed on one, Salesforce’s switching off, which is partly because an element answered only in part is not documented. Greyhound Research also set one grade the readers agreed on, Fusion’s switching off, at not stated rather than announced, to match how the same rule had set Fusion’s session terms, evidence and meter. Greyhound Research settled each rule once and applied it to every door alike, and holds an evidence line, with the vendor’s exact words and the page, for every cell. The appendix to this note gives every cell’s evidence, in Greyhound Research’s words and linked to its page.
Before publication every cell of the first seventy was re-tested against the live pages, and five grades moved, each to a grade a peer already held under the same rule. NetSuite’s meter rose from partly to documented, as Dynamics 365’s had, for a sentence that names both bills. Fusion’s way out rose from announced to partly, as SAP’s had, for a documented route by which other platforms call the application’s agents. SAP’s door and status and its identity rose to documented once SAP’s integration pages could be read in full. ServiceNow’s consent and scope fell from documented to partly, because its own articles conflict on whether its tools can delete. Oracle is a client of Greyhound Research, as the Financial Disclosure states. Two of the five moves raised an Oracle cell, each to a grade a peer already held, the largest group of disagreements was settled against Oracle, and every rule was applied to Oracle’s two doors as to every peer.
The Scorecard has limits a reader should weigh. It reads public documents only, so a door whose documentation sits behind a customer login, as Workday’s does for Sana in Claude, is graded on what the public can read. It reads documents as they stood on November 2, 2026, and vendors change their pages often, several in the days after that date. It does not test the product, so a documented control can still fail in use. A grade moves when a vendor publishes the missing element. Greyhound Research re-reads every door for each new edition of the Scorecard, and a vendor may point to a page it has published, which is then read under the same rules as every other. Exhibit 7 sets out how the Scorecard grades, and Exhibit 8 the marks.
Table 5 sets out each criterion: the question it asks, the elements it grades and what each means, the documents that count as evidence for it, and where it ends and the next criterion begins.
Greyhound Research · Table 5 · How each criterion is defined
Twelve criteria, each with its question, elements and evidence
What each criterion asks, the elements it grades and what each means, its evidence, and where it ends.
Forty-one elements, each graded once, under one criterion, from the evidence it accepts.
Table 5 sets out how the Greyhound Front Door Scorecard defines each of its twelve criteria: the question it asks, the elements it grades and what each means, the evidence that counts, and where the line sits between one criterion and the next. Forty-one elements, each graded once, under one criterion, from the evidence it accepts. It carries no door’s grade, and the grades themselves are set out in Exhibit 7. At the vendor’s own boundary, criteria 1 to 3: The application vendor alone decides what is written. Criterion 1, door and status, asks: Which assistant reaches the application through this door, in what status, and who on the application side may use it? Elements: (a) The assistant, named: which assistant reaches the application through this door, by name. (b) Its status: in the vendor’s own word, such as live, beta, early access or announced. (c) Eligibility on the application side: the edition, region, role, geography or patch level the door requires. Evidence that counts: The application vendor’s documents for this door. A listing the vendor writes in a model company’s directory counts for (a) and (b) only, and as an announcement for (c). Where the line sits: The plan tier the assistant requires is graded under 7(f), not under (c). Criterion 2, identity, asks: How does the person in the assistant become a user of the application, and under which role does each action run? Elements: (a) Sign-in: how the person signs in to the application through the door. (b) The application user: how the person becomes an application user, with that user’s own role. (c) Shared identities: whether shared or app-to-app identities are allowed. Evidence that counts: The application vendor’s documents for this door only. The model company’s documents never count here. Where the line sits: What that role may do through the door is graded under 3. Criterion 3, consent and scope, asks: Who switches the door on, what is kept out of it, and what can it write or delete? Elements: (a) Switching on: per-user consent or administrator enablement. (b) What is barred: roles, tools or actions barred from the door. (c) Writing and deleting: whether tools that write or delete are exposed, and how they are limited. Evidence that counts: The application vendor’s documents for this door only. The model company’s documents never count here. Where the line sits: Signing in is graded under 2, an approval a step requires under 4, a chain of actions under 5, and switching the door off under 12. Across the seam, criteria 4 to 12: The application meets the assistant, and two companies’ documents have to meet. Criterion 4, approval of record, asks: Can an approval the application requires be given from the assistant, and which system keeps the record of it? Elements: (a) Approval in the assistant: whether the application’s own approval can be given there. (b) The record: which system records the approval. (c) The confirmation prompt: the assistant’s prompt before an action, and who controls it. Evidence that counts: The application vendor’s documents for this door only. The model company’s documents never count here. Where the line sits: A confirmation prompt is read under (c) and never counts as an approval of record. Criterion 5, chained authority, asks: When one session chains several actions, do segregation-of-duties and authorization checks still hold across the chain? Elements: (a) Checks that apply: whether segregation-of-duties or authorization checks apply to actions through the door. (b) Control on chaining: any control on chaining several actions in one session. (c) Pattern or limit: any documented pattern or limit for chained work. Evidence that counts: The application vendor’s documents for this door only. The model company’s documents never count here. Where the line sits: The rights behind a single action are graded under 3. This criterion reads the sequence. Criterion 6, reasoning place, asks: What does the application lend, tools or an agent, and on whose model, where and on whose infrastructure does the reasoning happen? Elements: (a) The lending pattern: tools lent to the assistant’s model, or an agent of the vendor’s own lent. (b) Where it reasons: whose model reasons, where, and on whose infrastructure. (c) The vendor’s assurance: whether the application vendor’s assurance covers that place, or where the vendor says its control ends. Evidence that counts: The application vendor’s documents for this door only. The model company’s documents never count here. Where the line sits: The conversation’s retention, residency and training are graded under 7. Criterion 7, session terms, asks: Which data terms govern the conversation, under which plan tier of the assistant, and whose terms cover the plugin leg? Elements: (a) Retention: how long the conversation is kept. (b) Residency and inference location: where the conversation is stored and processed, by plan tier. (c) Training use: whether the conversation trains a model. (d) Zero data retention: whether it is offered for the conversation. (e) The plugin leg: whose terms cover the call between the assistant and the application. (f) The plan tier: which plan tier of the assistant the door requires. Evidence that counts: The model company’s documents, by plan tier, for (a) to (d), once the application vendor names the assistant in its documentation or hands the session to it. The application vendor’s documents for (e) and (f). Where the line sits: The plan tier is graded here, under (f), and nowhere else, so a vendor silent on it is marked down once, not three times. Criterion 8, evidence, asks: Which log records what was done through the door, who keeps it, for how long, and can the buyer export it? Elements: (a) The application-side log: whether one is kept, and what it records. (b) The assistant-side log: the assistant’s own log or compliance API. (c) Retention: how long each log is kept. (d) Export: whether either log can be exported. Evidence that counts: The application vendor’s documents. The model company’s documents count for (b), and for (c) as it applies to the assistant’s log, once the application vendor names the assistant. Where the line sits: Retention of the conversation itself is graded under 7(a). This criterion reads the record of actions. Criterion 9, meter, asks: What does work through the door cost on the application’s bill, and is a separate assistant seat required? Elements: (a) The application-side unit and rate: what the application charges for work through the door, and in what unit. (b) The assistant seat: whether a separate assistant seat is required, and who bills it. Evidence that counts: The application vendor’s documents for this door, its rate cards, service descriptions and contracts among them. Where the line sits: Which plan tier the seat must be is graded under 7(f). A money value per unit is read as context and is not graded. Criterion 10, way out, asks: What other routes reach the same application, what notice comes before the door changes, and what leaves with the buyer? Elements: (a) Other routes: other assistants or clients documented for the same application. (b) Notice of change: notice of changes written for the door. (c) What leaves: what leaves the session with the buyer. (d) Exit: any exit term written for the door. Evidence that counts: The application vendor’s documents. Here alone, documentation of the vendor’s other routes counts, because (a) asks what they are. Where the line sits: Export of the logs is graded under 8(d). Criterion 11, reversal, asks: If an action taken through the door was wrong, what reverses it, and is that written? Elements: (a) An undo for the door: whether an undo, rollback or reversal is written for actions taken through the door. (b) Restore of deletions: whether a record deleted through the door can be restored, and for how long, or a statement that the door cannot delete. (c) The reversing process: the application’s own business process that reverses a completed transaction, such as voiding a payment. Evidence that counts: The application vendor’s documents. For (b) and (c), the application’s own restore and reversing processes count, because they act on a record however the change reached it. The model company’s documents never count here. Where the line sits: The record of what changed is graded under 8, and an approval before the action under 4. A protocol’s cancellation of a request still running is not an undo. Criterion 12, switching off, asks: Can the buyer switch the door off, for everyone or for one person, and does that end what is already running? Elements: (a) For everyone: how an administrator suspends, disables or removes the door, or revokes its access, for the whole organization. (b) For one user or role: whether access through the door can be withdrawn from one user or role without closing it for everyone. (c) What ends: whether withdrawing access revokes the tokens already issued and ends open sessions, and if not, how long they stay valid. (d) On the assistant’s side: how the assistant’s administrator disables or blocks the app or connector. Evidence that counts: The application vendor’s documents for (a) to (c), including a platform page for a mechanism the door’s own documentation names, such as its OAuth integration record. The model company’s documents count for (d), once the application vendor names the assistant in its documentation or hands it the session. Where the line sits: Switching on is graded under 3(a). Current through November 2, 2026.
Greyhound Research · Exhibit 7 · The Greyhound Front Door Scorecard
One question of every door, four grades and three rules to answer it
How the Greyhound Front Door Scorecard grades a door. What each criterion asks, grades and accepts is set out in Table 5.
Can the buyer find each answer in the vendor’s own documents, before the door opens?
The unit is the door: an application reached from one named assistant. A vendor can hold more than one, and each is read on its own. The measure is what is written: a restrictive answer that is documented scores as documented, and a generous one that is only announced scores as announced.
1Each element is readagainst the kind of source that states it
Documentation
Product documentation, help centers, administrator guides, service descriptions, contract terms, rate cards, release notes, trust and privacy pages, and technical articles on the vendor’s own site by named employees, where they state how the product behaves
Announcement
Press releases, newsroom posts, announcement blogs, marketing product pages, investor material and executives’ remarks, and any article that states where a product is going rather than how it behaves
Nothing found
Neither, in the public documents searched, as of November 2, 2026
2Each criterion takes one gradefrom its elements, where one answered only in part counts toward partly
Documented
Every element is documented in full for this door
Partly
At least one element is documented, in full or in part, and not every element in full
Announced
No element is documented, even in part, and at least one is announced
Not stated
No element is documented or announced
3Three rules hold for every criterionthe rules for particular criteria are in Table 5
The reading. Two readers marked all eighty-four cells independently, one door by door and one criterion by criterion. They agreed on the evidence in every cell and on sixty-four of the grades. Greyhound Research settled each of the twenty differences by a rule applied once for every door, and every cell of the first seventy was re-tested against the live pages before publication, where five grades moved.
The Greyhound Front Door Scorecard · Greyhound Research framework, copyright 2026 · Edition 1, first applied to Oracle and OpenAI, November 2026
Exhibit 7 sets out how the Greyhound Front Door Scorecard grades a door. At the top, the one question the Scorecard asks of every criterion: can the buyer find each answer in the vendor’s own documents, before the door opens. Beneath it, the unit, the door, an application reached from one named assistant, and the measure, what is written, so a restrictive answer that is documented scores as documented and a generous one that is only announced scores as announced. Step one, each element is read against the kind of source that states it. Documentation: product documentation, help centers, administrator guides, service descriptions, contract terms, rate cards, release notes, trust and privacy pages, and technical articles on the vendor’s own site by named employees where they state how the product behaves. Announcement: press releases, newsroom posts, announcement blogs, marketing product pages, investor material, executives’ remarks, and any article that states where a product is going rather than how it behaves. Nothing found: neither, in the public documents searched, as of November 2, 2026. Step two, each criterion takes one grade from its elements, where an element answered only in part counts toward partly. Documented: every element documented in full for this door. Partly: at least one element documented, in full or in part, and not every element in full. Announced: no element documented, even in part, and at least one announced. Not stated: no element documented or announced. Step three, three rules hold for every criterion: a grade belongs to the door, with the way out and the application’s own restore and reversing process under reversal as the exceptions, a conflict inside a vendor’s own documents holds the criterion at partly and is named, and only public documents count, with an absence written as not stated, never as a choice the vendor has made. The rules for particular criteria are in Table 5. A note records the reading: two readers marked all eighty-four cells, one door by door and one criterion by criterion, agreed on the evidence in every cell and on sixty-four grades, Greyhound Research settled the twenty differences by rules applied once for every door, and five grades of the first seventy moved on the re-test. A footer marks the Scorecard as Greyhound Research’s framework, copyright 2026, Edition 1, first applied to Oracle and OpenAI. Greyhound Research framework.
Greyhound Research · Exhibit 8 · The marks
Three doors documented at the boundary, two cells beyond it
Seven doors on the twelve criteria of the Greyhound Front Door Scorecard, graded from each vendor’s own documents.
No door is yet documented on the approval of record, the reasoning place or the way out.
Exhibit 8 sets out the marks of seven doors on the twelve criteria of the Greyhound Front Door Scorecard. Columns, each with its status: NetSuite in ChatGPT, live. Fusion in ChatGPT, announced. Salesforce in Claude, beta. Joule in Microsoft 365 Copilot, supported. Sana in Claude, early access. ServiceNow in ChatGPT, live. Dynamics 365 in Claude, generally available Dataverse endpoint. Rows: the twelve criteria, with the three boundary criteria above a rule and the nine seam criteria below it. Marks, with the grades as set out in Exhibit 7: documented on every element as a filled green circle, partly documented as a half amber circle, announced only as an amber ring, not stated as a dashed wine ring. A count row opens the marks: NetSuite in ChatGPT four documented, eight partly. Fusion in ChatGPT six announced, two partly, four not stated. Salesforce in Claude three documented, nine partly. Joule in Copilot two documented, nine partly, one not stated. Sana in Claude five announced, seven partly. ServiceNow in ChatGPT two documented, ten partly. Dynamics 365 in Claude four documented, eight partly. The boundary criteria are documented for NetSuite, Salesforce and Dynamics 365, documented on door and status and on identity and partly on consent and scope for Joule and ServiceNow, announced for Fusion, and partly written on the first and announced on the other two for Sana. Across the seam, every cell is partly, announced or not stated except two, the meters of NetSuite and Dynamics 365. Reversal is partly written for all seven doors, and switching off for six, with Fusion not stated. The not-stated cells are Fusion in ChatGPT on session terms, evidence, meter and switching off, and Joule in Copilot on approval of record. Two context rows beneath record published security research, bounded to the indexes checked: on the application side, found for Salesforce’s Agentforce and ServiceNow’s Now Assist, platforms behind those doors rather than the doors themselves, and none found for NetSuite, Fusion, Joule, Sana and Dynamics 365, and on the assistant side, found for every door, since ChatGPT, Claude and Microsoft 365 Copilot each have published disclosures. Greyhound Research analysis of each vendor’s documentation, 84 cells, two readers, lead reconciliation.
Read across, the marks make one point before any other. Of eighty-four cells, fifteen are documented, eleven announced, fifty-three partly written and five not stated. On the three criteria a vendor controls at its own boundary, three of the seven doors are documented on all three, NetSuite in ChatGPT, Salesforce in Claude and Dynamics 365 in Claude, and Joule in Microsoft 365 Copilot and ServiceNow in ChatGPT on two. On the nine criteria that cross the seam, two cells of sixty-three are documented, the meters of NetSuite and Dynamics 365, each of which says what the application charges for the door and that the assistant’s charge is separate. No door is documented on the approval of record, chained authority, the reasoning place, the session terms, the evidence, the way out, reversal or switching off. On the two criteria added in this edition, every application writes a restore, a reversing process or both, while no door writes an undo for its own actions, and six of the seven doors have part of switching off documented, while none says in full what ends when access is withdrawn. The criteria a buyer needs most are the criteria least documented across the seven doors.
Read down, the doors rank by what is written at the boundary and then across the seam. NetSuite in ChatGPT, Salesforce in Claude and Dynamics 365 in Claude are documented on all three boundary criteria, and NetSuite and Dynamics 365 add a fourth documented criterion across the seam, the meter. Joule in Microsoft 365 Copilot and ServiceNow in ChatGPT are documented on two. Sana in Claude has none documented and five announced. Fusion in ChatGPT has none documented, six announced, two partly written and four not stated, because the door is a plan. Oracle’s two doors sit at the two ends of the scorecard, NetSuite in ChatGPT level with Dynamics 365 in Claude at the top and Fusion in ChatGPT last.
NetSuite in ChatGPT is documented on four criteria, the meter among them, and partly written on eight. NetSuite’s documentation states that MCP tools are never run with the Administrator role or any role that has full permissions, that by default no user has access and MCP permission must be explicitly granted to a role, and that NetSuite cannot control how external components handle authorized access, authentication tokens or data after it leaves NetSuite. Across the seam, NetSuite writes that the connector is not a paid feature and that the AI client may need its own paid subscription, which documents the meter. An export of the 21-day execution log and the ChatGPT plan the door requires are not stated, and NetSuite names granting approvals among the functions an AI agent may run, but whether a NetSuite approval workflow can be completed from ChatGPT is not stated.
Fusion in ChatGPT is announced on six criteria, partly written on two and not stated on four. Oracle’s partnership blog promises unified sign-in, consistent security and existing permissions, and its Workspace blog says existing business processes, rules, permissions and approval authority remain in place, and that Oracle’s applications validate business requirements and approvals and perform the authoritative work. On the way out, Oracle’s AI Agent Studio guide documents that third-party platforms can call Fusion’s agents using A2A, which the Scorecard counts as another documented route, while notice of change, export and an exit term for the door are not stated. The session terms, the evidence and the meter for Fusion work started in ChatGPT are not stated in the Oracle documents searched, as of November 2, 2026. That is the position of a door Oracle describes as coming soon, and the Scorecard grades it as such rather than borrowing from Fusion’s own layer, whose terms are read below as context.
Salesforce in Claude is documented on three criteria and partly written on nine. Salesforce writes in its developer documentation that every Salesforce Hosted MCP transaction runs as the authenticated user, says on its tool restrictions page that Salesforce in Claude, which is in beta, does not support record deletion, and writes that its monitoring stops at the Salesforce boundary. Across the seam, the headless rate on its rate card is “TBA”, and Salesforce’s own pages name the Claude plan the door requires two different ways.
Joule in Microsoft 365 Copilot is documented on two criteria, partly written on nine and not stated on one. Joule’s feature scope description says Joule supports two-way integration with third-party generative AI assistants, currently Microsoft 365 Copilot, and SAP’s setup guide says Joule keeps a one-to-one relationship with a Microsoft Entra ID tenant. SAP’s integration guide makes Joule available inside Copilot once Microsoft Entra ID is trusted as the identity provider for SAP Cloud Identity Services and each user is replicated to SAP’s user store, and its roles page says every question raised through Copilot is processed under that user’s identity and permissions, with the same checks as in Joule itself. SAP’s usage page says that, in general, what Joule answers in its own client is also available through Copilot, and that the use of Copilot is subject to the customer’s agreement with Microsoft. Whether skills that write are exposed in Copilot and how they are limited, and whether an SAP approval can be given from Copilot, are not stated in the SAP documents searched, as of November 2, 2026, and SAP’s product pages differ on whether the integration draws its AI Units.
Sana in Claude is announced on five criteria and partly written on seven, the most announced door after Fusion in ChatGPT. Workday’s release has a finance leader approving invoice exceptions in Claude or routing them to Sana, its data sheet says configured approval workflows, separation-of-duties controls, regional rules and exception policies can provide additional guardrails for supported actions, and its directory listing says each request follows the roles, permissions, approval chains and audit controls already configured in Workday and calls the connector a beta service. The documentation page that Workday’s listing links for the Claude door sits behind Workday’s customer login, and public Workday documentation for the door was not found in the documents searched, as of November 2, 2026, so those five criteria stay announced until Workday publishes it.
ServiceNow in ChatGPT is documented on two criteria and partly written on ten, the boundary written in ServiceNow’s own technical articles, where one article lists the Scripted REST tools as full create, read, update and delete and another bars the DELETE and PATCH methods, which holds consent and scope at partly. Every client must be registered manually by an administrator through the console, each user completes the OAuth browser redirect with their own ServiceNow credentials, and flows with approval steps, wait conditions or other asynchronous logic are not eligible, whatever their access control lists say, which keeps flows with approval steps off the door, though a ServiceNow employee’s explainer says outside clients can approve. Across the seam, the assist rate per outside tool call and the ChatGPT plan are not stated in the documents searched, as of November 2, 2026.
Dynamics 365 in Claude is documented on four criteria, the meter among them, and partly written on eight. Microsoft’s documentation names both bills on one page: one Copilot credit per 10 tool calls to the ERP MCP server from another agent client, or 0.1 credits a call, plus the agent client’s own separate charge for the tokens its orchestration consumes. The Dataverse server respects Dataverse security roles and row-level security, and the ERP server keeps the separation of duties configuration form off the door. Where Claude reasons, what Microsoft’s assurance covers once results leave Dataverse, and the Claude plan the door requires are not stated in the documents searched, as of November 2, 2026.
Exhibit 9 sets the seven readings side by side, with what each vendor has written and what a buyer still has to ask for.
Greyhound Research · Exhibit 9 · Door by door
What each vendor has written for its door, and what it has not
The seven doors read one at a time: what each vendor has written, documented or announced, and what is still to be written.
The right-hand column is each door’s question list for the order.
Exhibit 9 reads the seven doors one at a time. For each door it gives the vendor, the status, the count of criteria documented, announced, partly documented and not stated, what the vendor has written in its own documents, and what is not yet written. NetSuite in ChatGPT, live, four documented and eight partly: MCP tools never run with Administrator or full-permission roles, no user has access until a role is granted it, the connector is not a paid feature while the AI client may need its own subscription, and NetSuite cannot control what outside components do with tokens and data, not yet written: the ChatGPT plan, an export of the 21-day log, and whether a NetSuite approval workflow can be completed from ChatGPT. Fusion in ChatGPT, announced, six announced, two partly and four not stated: unified sign-in, consistent security and existing permissions promised, and third-party platforms documented as able to call Fusion’s agents, not yet written: the session terms, the evidence and the meter. Salesforce in Claude, beta, three documented and nine partly: every hosted MCP transaction runs as the authenticated user, record deletion barred, monitoring stops at the Salesforce boundary, not yet written: the headless rate, one name for the Claude plan, the approval of record. Joule in Microsoft 365 Copilot, supported, two documented, nine partly and one not stated: two-way integration with Copilot, sign-in through SAP’s identity service, and every question run under the user’s own identity and permissions, not yet written: whether skills that write are exposed in Copilot, whether an SAP approval can be given from Copilot, and whether the integration draws SAP’s AI Units. Sana in Claude, early access, five announced and seven partly: a finance leader approving invoice exceptions in Claude, requests following Workday’s roles, permissions, approval chains and audit controls, a beta connector, not yet written: the Claude plan the door needs, and public documentation for the door, since the page Workday links sits behind its customer login. ServiceNow in ChatGPT, live, two documented and ten partly: clients registered manually, each user’s own OAuth redirect, flows with approval steps not eligible, not yet written: the assist rate per outside tool call, the ChatGPT plan, and whether tools that delete are exposed, on which its articles differ. Dynamics 365 in Claude, generally available Dataverse endpoint, four documented and eight partly: both bills on one page, Dataverse security roles respected, the separation of duties form off the door, not yet written: where Claude reasons, what Microsoft’s assurance covers once results leave Dataverse, and the Claude plan the door needs. Greyhound Research reading of each vendor’s documentation.
The Scorecard reads doors, and a vendor’s own layer is read beside it as context. There, Oracle has written more than its peers in one place and as much as any in another. Oracle’s endpoint schedule for Fusion’s own agents, Appendix B of its Fusion Cloud Service Descriptions, is the contract schedule for the OpenAI endpoints those agents call, which maps each region to its endpoint in Oracle’s documentation, sets zero data retention on every one of them and promises at least 90 days’ notice if OpenAI removes an endpoint, stops offering one in a region or deprecates a model version, and it is the most specific contract term any of the six has written for a named model company. Oracle’s AI Units, its metered allowance for Fusion AI work, come with a published allocation, factors by action and a money value, which is as specific as any peer’s pricing. Salesforce writes where each of its own models runs: its developer documentation places Anthropic’s and Amazon’s models on Amazon Bedrock infrastructure entirely within the Salesforce Trust Boundary, with a fallback, written in its Help for Salesforce-managed models, under which requests that fail in their designated region are eventually re-routed to a US region rather than returning an error, unless an administrator turns that off for the models that allow it.
The pairings are wider than the headlines. Oracle is not paired with OpenAI alone. Its contract offers Google’s Gemini models under its own schedule, Appendix C, Fusion’s model list includes Cohere’s Command-R and Meta’s Llama, bring-your-own covers Anthropic’s models through Google Vertex AI in the AI Agent Studio guide, and NetSuite’s connector is in Claude’s directory. Salesforce is not paired with Anthropic alone either. It uses OpenAI and Google models, and its sales app is in open beta in ChatGPT and its sales agent is in beta in Gemini Enterprise.
The other vendors pair widely as well. Workday and Google Cloud said in May that Gemini is now the default AI model inside Sana for Workday, and Workday is bringing Sana into Claude, Gemini Enterprise, Copilot, Teams and Slack: Sana in Claude is in early access, and on the other four, self-service with Sana is generally available, with Sana itself due in late 2026.
ServiceNow’s documentation lists Google Gemini, AWS Claude and Azure OpenAI as its integrated third-party model providers and says the default model for its base system skills and agents is changing from its own Now LLM Service to one of them. Its plugin is live in ChatGPT, and ServiceNow offers its workflows to mutual customers with Gemini Enterprise as the primary interface.
Christian Klein, SAP’s chief executive, said on its third-quarter call that SAP is not committing to a preferred model, and that it offers access to more than 70 models, frontier and open-weight alike. Inside the agents SAP ships, the choice is SAP’s: Klein said on the same call, answering a question on margins, that SAP will switch models to keep optimizing for the best price outcome.
The nearest mirrors for Oracle’s tie to OpenAI are two vendors, not one. Among the six, only Oracle and Microsoft hold OpenAI at the cloud infrastructure layer, and Microsoft’s blog of April 27, 2026 says Microsoft remains OpenAI’s primary cloud partner and that its license to OpenAI’s intellectual property will now be non-exclusive. ServiceNow is tied to OpenAI at the door, which is live, at the models, which are live, and at security, where, OpenAI’s post says, the OpenAI-powered security capabilities are expected to enter early access in January 2027. Each of the three pairs widely beside OpenAI.
Greyhound Standpoint: Greyhound Research finds that across the seven doors the criteria a vendor controls alone are documented far more often than the criteria that cross the seam, in thirteen cells of twenty-one against two of sixty-three, and that no door, Oracle’s or any peer’s, is yet documented on the approval of record, chained authority, the reasoning place, the session terms, the evidence, the way out, reversal or switching off. Oracle’s live door is level with Microsoft’s Dynamics 365 door at the top of the scorecard, its announced door is the least written of the seven because it is a plan, and the distance between the two is the measure of what Oracle has still to publish.
Heads of enterprise architecture should put the twelve criteria to every vendor as one questionnaire, door by door, and accept a documented answer only from the pages a contract can cite. Greyhound Research will apply the Scorecard to more doors in a standalone edition, and the first vendor to document all twelve criteria for one door will set the bar the others must meet.
One Task, Three Doors: A New Supplier And Its First Payment
Greyhound Research follows one task through three doors, because a buyer meets the criteria of the Greyhound Front Door Scorecard one transaction at a time. The task is the one Oracle’s own security team chose as an example. Oracle’s July 29 blog post lists creating a supplier and approving payment disbursement among the combinations to evaluate or restrict in one authority context. An employee asks the assistant to set up a new supplier and to approve the first payment to it.
Three doors carry the task. Oracle’s two, NetSuite in ChatGPT and Fusion in ChatGPT, are read because this note reads Oracle’s front door first, and Microsoft’s Dynamics 365 in Claude because its public documentation lists tools that create and update records in an ERP application. SAP’s documents do not state whether Joule’s skills that write are exposed in Microsoft 365 Copilot, and Workday’s documentation for its Claude door sits behind its customer login, so neither door can be followed through this task from public documents. In Dynamics 365 the finance task runs on Microsoft’s ERP server, for which Microsoft prices calls from non-Microsoft clients without naming Claude, and the Scorecard reads the door through both of Microsoft’s servers.
Each step below carries the Scorecard’s grade for the criterion it tests, so the walk adds the task’s own facts and changes no mark.
Signing in, under identity. NetSuite runs every tool under the signed-in person’s own role, never an administrator’s, and asks each user’s consent for every agent at sign-in, its risks page says. Microsoft writes that the security role of the authenticated user decides which objects the agent sees, and that the system rejects calls to actions or objects outside that role. For Fusion’s door, Oracle’s partnership blog promises unified sign-in and existing permissions for Oracle AI Workspace, and the mechanism is not stated.
Creating the supplier, under consent and scope. NetSuite’s record tools create the record types its REST web services support, and NetSuite’s list of those records includes the vendor, the vendor bill and the vendor payment. Microsoft’s tools are general rather than built for one task. The ERP server’s data tools create and update records, and its form tools open forms, set values and select actions as a person would in the application. Microsoft does not name the vendor among them in those words, and the vendor form is not among the forms the server excludes. For Fusion’s door, Oracle writes that with Oracle AI Workspace existing permissions and approval authority remain in place. Inside Fusion, Oracle documents supplier registration, internal requests included, as a review with approval routing, and an approved registration starts the creation of the supplier record.
Approving the payment, under the approval of record. Each application writes its approval. NetSuite enforces vendor bill approval through an approval status or a SuiteFlow workflow, and vendor payment approval through a SuiteFlow workflow. Fusion’s payment approval sends payments to approvers for review before final payment, once a payment process request reaches the review of proposed payments. Dynamics 365 approves vendor invoices in an invoice approval journal or on the vendor invoice page, and its payment proposal automation leaves payments unposted, so that existing validation and workflow processes can approve them. Whether any of these approvals can be given through the door is not stated in the documents searched, as of November 2, 2026. NetSuite names making payments and granting approvals among the functions an agent may run without the user’s explicit intent, and for Workspace, Oracle writes that when human approval is required, the decision stays with the person responsible.
Checking the chain, under chained authority. All three vendors write segregation of duties for people. NetSuite notes that workflows can set approval limits and stop users approving their own transactions. Oracle’s Advanced Access Controls find users whose roles together create separation-of-duties conflicts, and its provisioning rules can prevent risky role assignments. Microsoft lets an administrator set rules that keep two duties, such as receiving goods and paying the vendor, with different people. Each control is written for roles that people hold. Whether any of them is checked when one assistant session creates the supplier and approves its payment is not stated for any of the three doors. Microsoft keeps the separation of duties configuration form off its ERP server, so an assistant cannot open that form through the server, and Oracle’s July blog offers guidance, written for Fusion’s own agents, that maps agent actions to the same policy model used for human roles where Oracle’s risk management or access governance controls are in place.
Keeping the record, under evidence. NetSuite logs each request with the email address of the user who sent it, kept for 21 days in production and seven in a sandbox, its connection guide says, and its System Notes record who changed a record, when, through which interface, and the old and new values, which no user, script or app can edit. Fusion audits changes to the objects and attributes a customer selects once auditing is turned on, and what Fusion’s door records is not stated. Finance and operations apps can track inserts, updates, deletes and key renames through database logging, once it is set up for the tables or fields chosen, and what Dynamics 365 records for a call from Claude is not stated in the documents searched, as of November 2, 2026.
Counting the cost, under the meter. NetSuite’s connector is not a paid feature, though the AI client may need its own subscription, NetSuite says. Microsoft charges 0.1 Copilot Credits for each call to the ERP server from another agent client, except under its Finance Premium and Supply Chain Management Premium licenses, plus the client’s own charge for tokens, and its form tools split the work into steps, opening the form, setting the values, selecting a control and saving, so the task is billed by the calls it takes. What Fusion work started in ChatGPT costs is not stated in Oracle’s documents.
Greyhound Research · Exhibit 10 · One task, three doors
Each application writes its own steps of the supplier-to-payment task, and no door yet documents how the payment is approved through it
A new supplier created and its first payment approved, through three doors, each step graded on the Scorecard criterion it tests.
Walk the riskiest task through every door in a sandbox before the door opens.
Each application writes its own approval and its own duty rules. How the approval is given from the assistant, and how the rules apply when one session holds both steps, is not stated for any of the three doors.
Exhibit 10 follows one task, a new supplier created and its first payment approved, through three doors on a journey map: NetSuite in ChatGPT, Fusion in ChatGPT and Dynamics 365 in Claude. Six stations along each line carry the Greyhound Front Door Scorecard’s grade for the criterion each step tests: signing in under identity, creating the supplier under consent and scope, approving the payment under the approval of record, checking the chain under chained authority, keeping the record under evidence, and counting the cost under the meter. NetSuite in ChatGPT: documented on signing in, creating the supplier and the cost, partly written on the approval, the chain and the record. Fusion in ChatGPT: announced on the first four steps, not stated on the record and the cost. Dynamics 365 in Claude: documented on signing in, creating the supplier and the cost, partly written on the approval, the chain and the record. Beneath each station, a line on what the application writes for the step and what is not stated for the door. A band at the foot marks that no door documents how the payment is approved through it, or how the duty rules apply when one session holds both steps. Greyhound Research analysis of Oracle and Microsoft documentation.
Read across, the walk repeats the Scorecard’s split in one transaction. Each application writes its own steps of the task: the supplier record, the approval, the duty rules and the change history. NetSuite and Dynamics 365 write how the task enters, which tools it uses and what it costs. No door writes how the payment is approved through it, or how the duty rules apply when one session holds both steps.
Greyhound Standpoint: Greyhound Research finds that the pairing Oracle itself names as a segregation-of-duties risk, a supplier created and its payment approved, is governed in writing inside each of the three applications, and that no door yet documents how it is governed in between. NetSuite and Dynamics 365 have written how the task starts, which rights it uses and what it costs. Fusion’s door is a plan, while the Fusion processes it would rely on, supplier registration with approval routing and payment approval, are written.
Controllers and heads of enterprise applications should walk this task through every door they intend to open, in a sandbox, before the door opens, and record where each approval lands, whether the duty rules fire and what the log keeps. NetSuite keeps its sandbox log for seven days, so the record of the test belongs somewhere that lasts. A door that has not been walked with its riskiest task has not been tested.
Undoing An Action: The Fourth Test Stays With The Application
Greyhound Research returns to the fourth of the tests its July research report set for agents, reverse the action, which it defined as unwinding a bad chain of decisions through compensating transactions, with a named owner for the trigger. In October, reading Fusion Claw, Greyhound Research found that nothing in the Fusion Claw constructs or in Oracle’s documentation answers that test, and that Oracle’s answer, given in July and restated since, is that reversal falls back on the existing mechanisms of the system of record. This section puts the same test to the seven doors: when an action started in an assistant should not have run, what does each vendor write about reversing it?
Each answer is read at three levels, kept apart: what the door writes for actions taken through it, what the platform keeps for any change whatever its route, and the business process that reverses a transaction.
The door. No vendor in this note writes, for its door, that an action taken through it can be undone, rolled back or reversed, in the documents searched, as of November 2, 2026. The nearest statements are limits. NetSuite warns that record actions can change data at once and affect related processes, and that repeating an action whose result is uncertain can apply the change more than once. Its standard tool set has no delete tool, and Salesforce in Claude does not support record deletion. ServiceNow’s articles differ on whether outside clients may delete, one listing full create, read, update and delete and another barring the DELETE method. Microsoft’s Dataverse server deletes a row only after the user’s explicit approval, while its ERP server lists a tool that deletes records through OData with no approval condition written. Workday’s documentation for its Claude door sits behind its customer login, and the SAP pages for Joule in Copilot and Oracle’s announcements for Fusion’s door do not address reversal.
The assistants and the protocols. The assistants write how to ask before an action runs, and none writes how to take one back. OpenAI’s developer guidance asks servers to mark tools that can cause outcomes that are irreversible or difficult to reverse, so that ChatGPT can choose its confirmation, and says those marks do not replace authorization, validation or confirmation in the server. The MCP schema, at the current revision, treats every such mark as a hint, assumes a tool may make destructive updates unless it is marked otherwise, and tells clients never to base decisions on marks from servers they do not trust. Its cancellation rules let a server ignore a cancellation once processing has completed, and under the A2A specification a server will attempt a cancel without guaranteeing success. Neither protocol defines a reversal.
The platform. Every application in this note keeps a record of change, and three keep a way to restore what was deleted. NetSuite’s System Notes, ServiceNow’s audit table, SAP’s change documents and Workday’s audit trail record the old and new value of a change and who made it, and Fusion audits the objects a customer selects once auditing is turned on. Salesforce keeps deleted items in its Recycle Bin for 15 days, during which users can restore them, and keeps field history for 18 to 24 months. ServiceNow recovers deleted records within seven days of the deletion. Microsoft restores deleted Dataverse records kept for 1 to 90 days, once an administrator turns the setting on, and only records deleted after that, and finance and operations apps can keep a database log of changes, once it is set up for the tables or fields chosen. Each of these restores is for deleted records, which Microsoft writes in so many words for Dataverse, and ServiceNow’s other rollbacks are written for software upgrades and plugin activations. Deletion is the action the doors restrict most, and what the doors do allow, creating, updating and approving, no platform feature in the documents searched undoes. It is recorded, and it is reversed by the business process.
The business process. Every reversal that is written lives in the application’s own processes, and each is a new transaction rather than an erasure. NetSuite prefers voiding to deleting because voiding keeps the audit trail, voiding a bill payment reopens the bill, and an inactive vendor can receive no payment. Fusion voids a single payment or a whole payment file, and a rejected payment approval terminates the payment process request at once. Dynamics 365 reverses a vendor payment, which Microsoft distinguishes from deleting, voiding or rejecting one, and can send reversals to a review journal first. SAP reverses every payment document in a payment run, unless payment media or register entries already exist or the payment is already in approval. Workday cancels, rescinds or corrects a business process, and a rescind restores the data to its state before the process ran, though a cancel or a rescind cannot itself be undone, Workday writes. ServiceNow cancels a catalog request and, with it, any purchase orders not yet received. A business process that reverses a change made in Salesforce was not found in the documents searched, as of November 2, 2026.
Where reversal ends. Some actions leave every system. For payments NetSuite processes through BILL, a payment can no longer be voided once it is credited to the vendor, NetSuite writes, and SAP stops a payment-run reversal once payment media exist. Oracle described some actions to Greyhound Research as “one-way doors”, a payment that has cleared among them, as the October report recorded. Before such an action, the only control is the approval of record.
Greyhound Research · Table 6 · Undoing an action
No door writes an undo, and six applications write the reversal
For each of the seven doors, what is written for reversing an action taken through it, what the platform keeps for any change, and the business process that reverses a transaction.
Name the reversing process and its trigger for every action a door can take, before it opens.
Table 6 reads the seven doors at three levels for undoing an action taken through them. Written for the door: not stated for all seven, with the limits each vendor writes: NetSuite, where a repeated action can apply twice and there is no delete tool, Fusion in ChatGPT, announced, Salesforce in Claude, with no record deletion, Sana in Claude, whose door documentation sits behind a login, ServiceNow, whose articles differ on delete, and Dynamics 365 in Claude, where Dataverse deletes after approval and the ERP delete tool has no approval written. What the platform keeps: a record of change at every vendor, and a restore of deleted records at three, Salesforce’s Recycle Bin for 15 days, ServiceNow’s recovery within seven days and Dataverse’s restore for 1 to 90 days once turned on. The business process that reverses: voiding a bill payment or inactivating the vendor in NetSuite, voiding a payment or rejecting the payment approval in Fusion, reversing a payment run in SAP until payment media exist, canceling, rescinding or correcting a business process in Workday, canceling a catalog request in ServiceNow, and reversing a vendor payment in Dynamics 365, and none found for Salesforce. Current through November 2, 2026.
The Greyhound Front Door Scorecard grades this reading as its eleventh criterion, reversal, and every door is partly written on it, as Exhibit 8 shows. No door writes an undo, and every application writes a restore, a reversing process or both, which count for the door because they act on a record however the change reached it.
Greyhound Research reads the pattern as it did in October. For a single wrong posting, the system of record’s own reversal is the right answer, and an assistant able to unwind its own postings would hold more authority than the person it acts for, the opposite of the rule every door in this note promises, no new authority. The gap is the one named then: no door, like no agent, unwinds a chain of actions as a unit, and a session that creates a supplier and approves its payment is a chain. What the door adds is where a mistake is first seen and where the record of the request sits: in the chat window, under the assistant’s log, which OpenAI’s Compliance Logs Platform keeps for 30 days and only Enterprise and Edu workspaces have.
Greyhound Standpoint: Greyhound Research holds that reversal belongs where Oracle has said it belongs, in the system of record, and that the same answer holds for every door in this note. No door writes an undo for what it does, six of the seven applications write a business process that reverses a transaction, and the restores the platforms offer are written for deletion, the action the doors restrict most. Oracle’s answer for Fusion’s own agents is the category’s answer at the door, and a chain started in one session is reversed one posting at a time.
The consequence is that reversal has to be planned before the door opens. Controllers should list every action each door can take, name the business process that reverses it and the person who triggers it, turn on the records that need turning on, Fusion’s auditing and Dataverse’s restore among them, and keep the actions that cannot be reversed, payments above all, behind an approval given in the application.
Dependency And Exit: If The Partnership Changes
Greyhound Research tests dependency offering by offering, because Oracle’s documents give some offerings a written alternative to OpenAI and leave others with none. Greyhound Research’s July research report put the rule for the application layer: “Negotiate the exit before entry.” This section carries that rule from Fusion’s runtime to its front door.
Fusion’s own agents have written alternatives. Oracle’s model table lists Gemini, GPT-OSS, Cohere and Llama beside OpenAI’s models, and bring-your-own covers several providers. Fusion Claw’s launch release names Gemini and OpenAI among the frontier models that power it, with support for more frontier models planned over time. For Fusion’s own layer, the July report’s reading holds: Oracle documents customer choice across its own curated models and external ones.
Notice is written for OpenAI, in Appendix B of Oracle’s Fusion Cloud Service Descriptions, the contract schedule for the OpenAI endpoints Fusion’s own agents call, which maps each region to its endpoint in Oracle’s documentation and sets zero data retention on every one of them. The notice covers three events, OpenAI removing an endpoint, ceasing to offer an endpoint in a region, or deprecating a version of one of its models, and for each Oracle commits to at least 90 days. The testing is the customer’s: the same document makes the customer responsible for testing affected agents with GPT-5.6 Luna before the 27B release is applied. It also reserves Oracle’s right to update, with prompt notice, the additional terms attached to a given model, or whether that model draws down AI Units, Oracle’s metered allowance for Fusion AI work. Appendix C, the schedule for Google’s Gemini models, provides them as is, with no notice commitment and no retention term in the text read.
Workspace and the guard have no written alternative yet. Oracle’s Workspace blog describes Workspace as bringing OpenAI’s frontier models together with Oracle’s applications, and Oracle names no other model or assistant for it. Karan Batta, senior vice president, product, Oracle Cloud Infrastructure, in remarks one newsletter recorded, described the new offerings as “All OpenAI powered,” with Workspace and Security Mesh deeply integrated with the model itself, and called it a safe assumption that the products could eventually support others.
Companion is different. Oracle’s release writes it for supported AI tools such as ChatGPT, in the plural, and adds customer- or partner-built AI interfaces, and Chris Leone, executive vice president, Applications Development, at Oracle, told investors that Oracle can work across different AI clients. No Oracle document yet names a second assistant for Companion.
Two Oracle offerings write their way out. App Composer’s blog says that if an app becomes important enough for engineering to take over, its source, settings and history can move with it. NetSuite’s connector accepts any client that speaks the protocol. Security Mesh writes neither: its blog describes its models as including OpenAI’s cyber models, wording that leaves room for others and names none.
What no document addresses is what sits in the session. When an employee works in ChatGPT, the conversation history, the confirmations and the record of what was asked sit under OpenAI’s retention for the buyer’s plan. Enterprise and Edu workspaces can export compliance logs within a 30-day window, Business workspaces cannot, and no Oracle document mentions that history or what leaves with the buyer if the partnership changes.
The peers write exit partly, and no door, theirs or Oracle’s, is documented on the way out under the Scorecard. Under ServiceNow’s current Ordering Agreement, which governs purchases made on or after February 6, 2026, ServiceNow returns customer data on a written request made within 10 days of expiration or termination of all subscription services, in its standard database export format and at no extra charge, and deletes it after that period. Purchases that reference its 2022 subscription agreement keep a 45-day window.
Workday’s AI governance page says it provides standard data export tooling for the whole contract term, and Salesforce’s security, privacy and architecture document says that, after all subscriptions end, customer data may remain in inactive status for up to 120 days.
SAP’s Responsible AI page says customers can export their data before the subscription term expires. Microsoft writes a model fallback: when an administrator removes access to an external model after making it available, the agents using that model change to another suitable internal model, and Microsoft’s trust center says that when a cloud subscription ends, Microsoft keeps the customer’s data in a limited-function account for 90 days and then deletes it. Moving agents or workflows to another vendor’s runtime is not stated by any of the six in the documents searched.
Greyhound Research · Exhibit 11 · Alternatives and exit
Fusion’s agents write alternatives, and Workspace names only OpenAI
Oracle’s eight offerings, each with its written alternative to OpenAI and its written notice or way out.
Get the alternative, the notice and the way out in writing before signing for the door.
The conversation history, the confirmations and the record of what was asked, under OpenAI’s retention for the buyer’s plan. Enterprise and Edu workspaces can export compliance logs within a 30-day window, and Business workspaces cannot.
Exhibit 11 lists Oracle’s eight offerings and marks, for each, whether a written alternative to OpenAI exists and what exit path is written. The column heads count the marks: an alternative written for three offerings, partly for three and not stated for one, with the Marketplace offer as context, and a notice or way out written for three and not stated for three, with two not covered in this note. Fusion’s own agents: alternatives written, Gemini, GPT-OSS, Cohere, Llama and bring-your-own including Anthropic through Google Vertex AI, with 90 days’ notice for OpenAI endpoint, region and model-version changes and no notice commitment in Gemini’s schedule. Fusion Claw: Gemini and OpenAI named, more models planned. Oracle AI Workspace: only OpenAI named, no alternative written, no exit path written. Fusion Companion: ChatGPT named as an example of supported tools, customer- or partner-built interfaces allowed, no second assistant named. Security Mesh: OpenAI named, other models allowed by wording but not named. App Composer: source, settings and history can move. NetSuite connector: any MCP client. OpenAI on Oracle Marketplace: OpenAI by definition. A band beneath marks what no offering writes: the conversation history and confirmations held in the ChatGPT session. Greyhound Research analysis of Oracle sources.
Greyhound Standpoint: Greyhound Research reads Oracle’s dependency on OpenAI as two different things in two layers. In Fusion’s own layer, it is a choice among written alternatives, with a minimum notice period, 90 days, that no peer in this note was found to state. For Workspace and the guard, it is a single partner with no written alternative, which is a fair description of products that are announced and have not yet had to write one. NetSuite’s door, open to any client, shows the other path is already in Oracle’s estate.
Vendor management and procurement leads should carry the July rule to the door: before signing for Workspace or Security Mesh, ask for the written alternative, the notice Oracle will give if OpenAI’s models or terms change, and what leaves with the buyer from the chat session. A door with no way out is a door the buyer has rented, not bought.
Risks To Watch: Where The Front Door Can Go Wrong
Greyhound Research identifies six risks in the door, each with an early warning a buyer can watch in its own estate. Most sit in the seam between the assistant and the application, where neither vendor’s documents reach the whole way.
1. A chain no one approved. A single chat session strings together rights that were each safe alone, from creating a supplier to approving its payment. Oracle’s own blog describes the pattern, segregation-of-duties control breaks that can happen when a convenient agent journey chains steps. The early warning is a segregation-of-duties exception on a transaction that started outside Fusion.
2. An approval recorded in the wrong place. An employee confirms an action in ChatGPT and the business treats the confirmation as the approval. The early warning is an auditor’s request for approval evidence that can only be answered from the assistant’s log, which OpenAI’s Compliance Logs Platform retains for 30 days.
3. A prompt in a region no one chose. A record with personal or regulated data reaches a ChatGPT tier without inference residency. The early warning is the first use of Oracle’s plugins from a Business workspace, or from any workspace whose residency setting no one has checked.
4. An instruction hidden in a record. An assistant that reads a record can be steered by text inside it, and a tool that writes can then act on that text. Prompt injection heads OWASP’s list for LLM applications, as LLM01:2025.
Researchers have shown it against assistants and platforms in this note, and each case carries a response, stated by the vendor or reported by the researcher. Aim Labs’ EchoLeak in Microsoft 365 Copilot is one that Microsoft says, in an advisory first released June 11, 2025, has already been “fully mitigated”. Noma Labs published ForcedLeak in Agentforce on September 25, 2025, after Salesforce enforced trusted URLs on September 8. Zenity Labs published AgentFlayer in ChatGPT’s connectors on August 6, 2025. The researchers wrote that OpenAI had already deployed some mitigations, which they judged not enough, and CSO Online reported that OpenAI implemented fixes after Zenity reported its ChatGPT findings.
After Johann Rehberger posted his Claude Pirate research on October 28, 2025, Anthropic confirmed that data exfiltration vulnerabilities of that kind are in scope for its vulnerability reporting, he writes. Noma Labs’ GeminiJack in Gemini Enterprise was disclosed in December 2025, after Google, Noma Labs reports, deployed updates that changed how Gemini Enterprise and Vertex AI Search interact with the retrieval and indexing systems beneath them. On agent identity rather than hidden instructions, AppOmni’s BodySnatcher in ServiceNow’s Now Assist AI Agents was remediated on October 30, 2025.
No disclosure involving Oracle’s doors, SAP’s Joule, Workday’s Sana or Microsoft’s Dynamics 365 MCP servers was found in the researcher indexes checked, as of November 2, 2026. For all four, the absence means only that no published finding turned up in those indexes. It is not evidence that the door is safe, or that it is unsafe. The early warning is any writing tool reachable from records that carry text written outside the company.
5. A door that arrives after the renewal. A buyer renews ChatGPT, Copilot or Claude seats for a door that has no date. The early warning is a seat renewal signed before Oracle has given Workspace or Companion a date and a qualifying plan.
6. Two bills no one reconciles. Seats rise with adoption on one bill while AI Units and credits rise on another, and no one owns the total. The early warning is AI Units consumption that moves with assistant use without a forecast that explains it.
Greyhound Research · Exhibit 12 · Risks to watch
Six risks, most in the seam, and each shows first in the buyer’s estate
Six risks at the front door, each with its early warning and the Runbook owner who watches for it.
Give each risk an owner and an early warning before the door opens.
A segregation-of-duties exception on a transaction that started outside Fusion
Approval evidence that only the assistant’s log can answer, kept 30 days in OpenAI’s Compliance Logs Platform
The first use of Oracle’s plugins from a ChatGPT tier without inference residency
Any writing tool reachable from records that carry text written outside the company
A seat renewal signed before Workspace or Companion has a date and a qualifying plan
AI Units consumption that moves with assistant use without a forecast that explains it
Exhibit 12 sets out six risks at the front door, each with its early warning. A chain no one approved: a segregation-of-duties exception on a transaction started outside Fusion. An approval recorded in the wrong place: approval evidence that exists only in the assistant’s log, kept 30 days in OpenAI’s Compliance Logs Platform. A prompt in a region no one chose: Oracle’s plugins first used from a ChatGPT tier without inference residency. An instruction hidden in a record: a writing tool reachable from records that carry outside text, with published research against Microsoft 365 Copilot, Agentforce, ChatGPT connectors, Claude and Gemini Enterprise, and none found for Oracle’s doors, SAP’s Joule, Workday’s Sana or Microsoft’s Dynamics 365 MCP servers in the indexes checked. A door that arrives after the renewal: seats renewed before Workspace or Companion has a date. Two bills no one reconciles: AI Units moving with assistant use without a forecast. Each risk is tagged with the owner who watches for it. Greyhound Research analysis.
Greyhound Standpoint: Greyhound Research holds that the door’s risks are mostly old controls meeting a new speed, not new kinds of failure. Segregation of duties, approval evidence, data placement, input validation and budget ownership are disciplines estates already run. The door tests whether they hold when an assistant can chain them in one request.
CIOs should give each risk an owner and an early warning before the door opens, and read the first month’s segregation-of-duties exceptions, approval evidence and AI Units consumption as the test results they are. The estates that watch the seam will see trouble before their auditors do.
The Strongest Objection: Most Work May Never Leave The Application
Greyhound Research tests this note against the strongest objection to it: most enterprise work may stay inside the application, in its own screens and its own agents, so the door may matter less than the sections before suggest. Part of the objection holds, and the evidence shows which part.
What holds. Oracle is building its own window as well as lending one. Fusion Companion is to be reached through supported AI tools such as ChatGPT or through Fusion Agentic Home, the native AI experience inside Fusion, Oracle’s release says, and Ellison’s case at the keynote was for a question as the interface inside Oracle’s own applications. Fusion’s door into ChatGPT is announced, with no date. How much work starts in an assistant is not published by any vendor in this note, in the documents searched, as of November 2, 2026. NetSuite counts more than 13,000 customers on its connector across every client it serves, which measures adoption, not the share of work. If most work stays in the application’s own screens and agents, the door’s terms govern a small share of it.
What it misses. The exposure of a door does not wait for its volume, for four reasons in the documents.
The door is already open. Six of the seven doors in this note can be used today, from early access to live, as Exhibit 8 records, and only Fusion’s is announced. NetSuite’s connector accepts any client that supports the protocol.
The exposure follows the permission. Every door in this note runs on the application’s own roles, so opening it for one task opens every right the role holds, within the tools the door exposes. NetSuite lists the high-impact actions an agent could take as creating, modifying, deleting, approving, paying, exporting large data sets, changing permissions and reaching new sensitive resources, and warns that an agent may make payments or grant approvals without the user’s explicit intent. One session that chains a supplier to its payment is enough to test a control, as the walk through three doors showed, and a payment that has cleared cannot be taken back.
The defaults decide where the buyer does not. NetSuite keeps the door shut until MCP permission is granted to a role, its risks page says. Salesforce’s tools are unrestricted by default at the organization level. Microsoft 365 Copilot skips its confirmation, after a first-time prompt, for a tool a developer marks as read-only, and ChatGPT lets an eligible app or account allow all actions. A buyer that expects little traffic through the door still inherits whichever default applies.
The answers serve the application either way. The questions the door raises, who approved, which rules applied to a chain, what the log keeps and how an action is reversed, are questions about the application’s own controls. An estate that answers them for the door has answered them for its own agents too, the ones Oracle’s July blog wrote its segregation-of-duties guidance for.
Exhibit 13 lays the objection on two axes: how much work starts in the assistant, which no vendor in this note publishes, and what the door can do, which each door’s tools define. Where little work passes through a door that only reads, the objection holds, though the session terms in Table 3 still apply to what is read. Where much work passes through such a door, the session terms and the evidence decide. Where the door can write, approve or pay, a small share of work is enough to test a control, as Exhibit 10 shows, and where it carries much of the work, every criterion of the Scorecard applies.
Greyhound Research · Exhibit 13 · The strongest objection
How much work moves to the assistant is measured by no vendor in this note, while what each door can do is written in its tools
The objection that most work stays in the application, on the axis no vendor publishes and the axis each door writes.
The share of work decides the volume. The permission decides the exposure.
One chained session tests the control, as in Exhibit 10
The full Scorecard, as in Exhibit 8
The session terms of Table 3 still apply to what is read
With the evidence, as in Table 3
What holds in the objection
- Oracle’s own native door, Fusion Agentic Home
- Fusion’s door announced, with no date
- No published measure of the share of work
What it misses
- Six of seven doors usable today
- Exposure follows the permission
- Defaults decide where the buyer does not
- The answers serve the application either way
Exhibit 13 sets the strongest objection to this note on two axes. Across: how much work starts in an assistant, from little to much, which no vendor in this note publishes. Up: what the door can do, from read only to write, approve and pay, which each door’s tools define. Four quadrants. Little work through a door that only reads: the objection holds, and the session terms of Table 3 still apply to what is read. Much work through a door that only reads: the session terms and the evidence decide. Little work through a door that writes, approves or pays: the objection fails, because one chained session tests the control, as in Exhibit 10. Much work through a door that writes: every criterion of the Scorecard applies, as in Exhibit 8. A side panel lists what holds in the objection, Oracle’s own native door, Fusion’s undated door and no published measure of the share of work, and what it misses, six doors usable today, exposure that follows the permission, defaults that decide where the buyer does not, and answers that serve the application either way. Greyhound Research analysis.
The objection therefore changes the size of the problem, not its shape. A buyer that concludes most of its work will stay inside the application has made the first decision this note asks for, which work may start in an assistant, and should write it down by granting the door to few roles or to none.
Greyhound Standpoint: Greyhound Research holds that the objection is right about volume and wrong about exposure. No vendor in this note yet publishes how much work moves to another company’s window, and Oracle’s own native experience may carry most of Fusion’s. The exposure is set before any volume arrives, by the rights a role holds, the defaults a buyer leaves in place and the actions that cannot be reversed.
CIOs should read a low forecast for the door as a reason to keep it narrow, not a reason to leave it unwritten: grant it to the roles that need it, set every default deliberately, and keep the actions that cannot be reversed behind an approval given in the application. The share of work decides the volume. The permission decides the exposure.
The Greyhound CXO Runbook: Six Moves, None Waiting For Oracle
Six moves follow from the evidence, written for the leaders who will each own part of a front door that opens in another company’s window. Each names who decides. None waits for Oracle, because each move uses controls the buyer already holds: its plan tiers, its roles, its approval processes, its logs and its contracts.
1/ CIOs: decide which work may start in ChatGPT and which must start in Fusion.
Go workload by workload, starting with what is live: NetSuite’s connector and plugins, and OpenAI’s products on Oracle credits. For each, decide whether employees may start the work in an assistant, which assistants and plan tiers are allowed, and which work must begin in Fusion or NetSuite itself. Treat Workspace, Companion and Security Mesh as options until each has a date, a price and a qualifying plan. The decision sits with the CIO, together with the head of enterprise applications.
2/ CISOs: map every assistant identity before the first action runs.
Map each ChatGPT or Claude identity to its Fusion or NetSuite user, confirm that personal accounts cannot connect to company plugins, and review the roles those users hold as if an assistant could chain every right in one request. Test the chained cases, from supplier creation to payment approval, against segregation of duties, walking that task through each door in a sandbox, as this note walks it through three. Ask Oracle to extend the agent identity design it wrote for Security Mesh to the assistant acting for the person working in ChatGPT, and get in writing, before any Security Mesh test plan is approved, where its models run, what they receive and what is retained. The decision sits with the CISO, together with the identity lead.
3/ Heads of enterprise applications: keep the approval of record in the application.
Write which approvals may be given from a chat window and which must be given in Fusion or NetSuite, starting with payments, supplier changes, pay and access. Until Oracle documents how an approval given in ChatGPT is recorded in Fusion, keep every approval with financial consequence in the application, and treat the assistant’s confirmation as a prompt, not as evidence. Choose clients that confirm high-impact actions, as NetSuite advises. For every action a door can take, name the business process that reverses it and the person who triggers it, before the door opens. The decision sits with the head of enterprise applications, together with the controller.
4/ Chief data officers: name the plan tier and keep the evidence longer than the door does.
For each route, get in writing where the model runs, what is retained and for how long, and whose terms cover the conversation and the plugin leg. Keep regulated records off any tier without inference residency and a compliance API, which today rules out ChatGPT Business and Claude Team for them. Export or copy the logs that prove what happened, NetSuite’s execution log and the assistant’s compliance logs, before their 21-day and 30-day windows close, and ask NetSuite in writing for an export route, which is not stated in its documents. The decision sits with the chief data officer, together with the data protection officer.
5/ CFOs: put both bills for one task on one page.
Model a task started in ChatGPT end to end with what is written today: the seat, any credits drawn through Oracle Marketplace and the provider’s bill where a model is brought, with the AI Units on the Fusion side held as an open line until Oracle answers. Ask Oracle in writing whether Workspace and Companion draw AI Units and at what factor, and use Microsoft’s published wording, both bills named on one page, as the standard for the answer. The decision sits with the CFO, together with procurement.
6/ Vendor management: write the way out before signing for the door or the guard.
Before signing for Workspace or Security Mesh, ask for the written alternative to OpenAI, the notice Oracle will give if OpenAI’s models or terms change, and what leaves with the buyer from the chat session. Time ChatGPT, Copilot and Claude renewals against the dates Oracle has written, not the ones it has announced. The decision sits with the head of vendor management, together with the CIO.
Sequenced in Exhibit 14, four of the six moves start now, and the exit terms come before the first signature for the door.
Greyhound Research · Exhibit 14 · Runbook sequence
Four moves start now, and the way out is written before signing
The six Runbook moves across three phases, each bar labeled with the owner of the decision.
None of the six waits for Oracle. Each uses controls the buyer already holds.
Exhibit 14 sequences the six Runbook moves across three phases: now, before Workspace or Companion opens, and before the first signature for the door, the guard or a seat renewal. Starting now: deciding which work may start in an assistant, mapping identities and testing chained cases, writing which approvals stay in the application, and naming the plan tier with logs exported before they expire. Before the door opens: modeling both bills for one task and getting the AI Units answer in writing. Before the first signature for Workspace, Security Mesh or a seat renewal: writing the alternative, the notice and what leaves the session, and timing seat renewals against written dates. Each bar is labeled with its owner. Greyhound Research analysis.
Questions For Oracle: What Buyers Will Ask Next
Q1 Buyers need to know who acted. Oracle writes that Workspace leaves existing business processes, rules, permissions and approval authority in place, and its documented setup for outside callers is trust between applications. How will a ChatGPT identity be mapped to a Fusion user for Workspace and Companion, and can a personal ChatGPT account consent to an Oracle plugin?
Q2 The approval of record decides what an auditor can test. Fusion routes approvals through its approval processes, and Workspace is described as requesting human approval where it is required. Can an approval be given inside ChatGPT, which system records it, and where is segregation of duties checked when one chat session chains actions across Fusion and NetSuite? If an action started in ChatGPT should not have run, how is it reversed?
Q3 Where the reasoning happens decides whose terms apply. Fusion’s outside callers reach Oracle’s own agents, and NetSuite lends its tools to the client’s model. For Workspace and Companion, which of the two patterns applies, where does inference run, and does the zero data retention in Oracle’s endpoint schedule, Appendix B, extend to any part of the ChatGPT session?
Q4 The same credit now buys another company’s platform. OpenAI on Oracle credits is a private offer from OpenAI, with customers building through OpenAI’s own platform, in the United States only, and the Marketplace listing sends billing questions to Oracle and questions about how the models behave to OpenAI support. Where are those calls served, and under whose data terms?
Q5 Finance needs one number for one task. Oracle’s AI Units are written in detail for Fusion’s own agents, and Workspace names no plan or price. Does Fusion work started in ChatGPT draw AI Units, at what factor, and which ChatGPT plan does Workspace require?
Q6 The guard sees the estate’s weaknesses. Security Mesh’s documents write its approvals and the private knowledge base where its discoveries stay, and not its data path. What do OpenAI’s cyber models receive, where do they run, what is retained, and can another model be used?
Q7 A way out is part of the price. Oracle’s endpoint schedule, Appendix B, gives at least 90 days’ notice in Fusion’s own layer if OpenAI removes an endpoint, stops offering one in a region or deprecates a model version, and nothing is written for the door or the guard. What is the written alternative to OpenAI for Workspace and Security Mesh, which other assistants will reach Workspace and Companion, and what is the status of the plugin for OpenAI that Oracle described to investors?
Q8 Plans need dates. Workspace is “coming soon”, Companion is written in the future tense, and Security Mesh’s only call to action is an invitation to contact Oracle. What are the dates, regions and prices for each, and will Oracle publish them before the door opens?
Read together in Table 7, each question concerns a criterion the door leaves open, and each maps to a move in the Greyhound CXO Runbook above that a buyer can make meanwhile.
Greyhound Research · Table 7 · Questions tracker
Eight questions, each on a criterion the door leaves open
Each question for Oracle, the buyer signal behind it, its status in Oracle’s documents, and the Runbook move meanwhile.
Each question has a Runbook move the buyer can make without waiting for Oracle.
Table 7 tracks eight questions for Oracle, the buyer signal behind each, what Oracle’s documents say, and the Runbook move a buyer can make meanwhile. Identity mapping for the door: role-based intent and app-to-app setup, move 2. Where the approval of record sits: Fusion’s processes, the chat window not stated, move 3. Lending pattern, place and Appendix B: the outcome written, the pattern and place not, move 4. Where OpenAI on credits is served: a private offer, US only, the support split written and the place not stated, moves 4 and 6. AI Units for work started in ChatGPT: written for Fusion’s own agents only, move 5. What Security Mesh sends to OpenAI: approvals written, the data path not, moves 2 and 4. Alternatives, notice and other clients: 90 days for Fusion’s own layer only, move 6. Dates, regions and prices: none for the three announced items, moves 1 and 6. Current through November 2, 2026.
OpenAI And The Front Door: The Final Greyhound Standpoint
Greyhound Research’s final judgment is that Oracle has placed one partner at three layers of its customers’ estates, and that the parts which are live or in limited availability are real. NetSuite’s door is open in ChatGPT and in four other documented clients, OpenAI’s products are on an Oracle bill, and App Composer is in limited availability. On its own layer, Oracle has written the most specific contract term for a named model company that Greyhound Research found among the six vendors, its endpoint schedule for OpenAI, and has priced its AI Units as specifically as any peer.
The flagship is a plan. Workspace is “coming soon”, Companion is written in the future tense, and Security Mesh has no date. For the door, Oracle has written the right outcome, that its applications validate business requirements and approvals and perform the authoritative work, and not yet the mechanism.
Greyhound Research’s position holds, with three refinements. The approval of record is not the confirmation an assistant asks for, and no vendor’s product documentation yet shows how one becomes the other. The data terms of the session follow the model company’s plan tier, the subscription the enterprise holds with it, and none of the four model companies offers or states zero data retention in its chat application. And one partner means five routes, with five sets of terms that no Oracle or OpenAI document sets side by side.
None of this is Oracle’s alone. On the Greyhound Front Door Scorecard, the criteria a vendor controls alone are documented far more often than the criteria that cross the seam, where the assistant meets the application, no door is documented on where the model reasons when its application is reached from another company’s assistant, and none is documented on the way out. Oracle’s distinction is that it has committed to one model company at more layers than any peer, which makes the missing terms matter more.
Greyhound Research’s July report set four tests for an agent: name the identity, read the log, bound the authority and reverse the action. The door needs the same four. Whose identity acts in ChatGPT. Whose log records the decision, and for how long. Where the approval is bounded, in Fusion or in the window. And who unwinds an action that a chat session started. On the last, no door in this note writes an undo of its own, and the reversal that is written sits in each application’s own business processes, where Oracle has placed it for Fusion’s own agents since July, which is why the Scorecard grades reversal partly written for every door.
Greyhound Research’s recommendation to Oracle follows from Oracle’s own documents. NetSuite’s risks page shows Oracle can say plainly what it controls and what it does not, and its endpoint schedule, Appendix B, shows it can write placement, retention and notice for a named model company.
The same discipline belongs in one published page per door, before Workspace and Companion open, and the Greyhound Front Door Scorecard gives the page its twelve headings: the door and its status, identity, consent and scope, the approval of record, chained authority, the reasoning place, the session terms, the evidence, the meter, the way out, reversal and switching off. The first application vendor to document all twelve for one door sets the bar the others will have to meet.
The position would strengthen with an Oracle door documented on all twelve criteria of the Scorecard, with documented identity mapping and approval mechanics for Workspace and Companion, with a stated location for OpenAI models bought on Oracle credits, with the AI Units answer for work started in ChatGPT, with a second assistant named for Workspace, and with Security Mesh’s data path. It would weaken if segregation-of-duties exceptions appeared on transactions started outside Fusion, if approval evidence existed only in an assistant’s log, if regulated data reached a tier without residency, if seats were renewed for a door with no date, or if published research found an instruction hidden in a record acting through a lent door.
Of the eleven signals in Exhibit 15, four would show up first in a buyer’s own estate, and one in published security research, rather than in anything Oracle publishes.
Greyhound Research · Exhibit 15 · Signals to watch
Greyhound Research’s position holds, and eleven signals would move it
What would move Greyhound Research’s position on Oracle’s front door with OpenAI, and where a buyer can watch for each.
Four of the eleven signals would show up first in the buyer’s own estate. Watch there.
Current position: holds. The live parts are real and the flagship door is a plan. Oracle has written the right outcome for the door, not yet the mechanism.
Would weaken the position
Would strengthen the position
Exhibit 15 lists eleven signals that would move Greyhound Research’s position on Oracle’s front door with OpenAI, on a signal ledger with the position marked as holding. Six would strengthen it: an Oracle door documented on all twelve criteria of the Scorecard, documented identity mapping and approval mechanics for Workspace and Companion, a stated location for OpenAI models bought on Oracle credits, a written answer on AI Units for work started in ChatGPT, a second assistant named for Workspace, and a written data path for Security Mesh. Five would weaken it, four showing first in the buyer’s own estate: segregation-of-duties exceptions on transactions started outside Fusion, approval evidence held only in an assistant’s log, regulated data on a plan tier without residency, and seats renewed for a door with no date, and one in published research showing a hidden instruction acting through a lent door. Each signal names where a buyer can watch for it.
Until then, the buyers who gain most will treat the permission as the control. They will decide which work may start in an assistant, map every identity before the first action, keep the approval of record in the application, name the plan tier, put both bills on one page, and write the way out before they sign.
Oracle is opening its applications to another company’s window and keeping the authority inside. Until it writes how that authority works from the other side of the glass, the permission is the control, and the buyer holds it.
Appendix: The Evidence Register, Cell By Cell
Greyhound Research sets out here the evidence for all eighty-four cells of the Greyhound Front Door Scorecard, one table per door, so that every mark in Exhibit 8 can be checked against the page it rests on without turning back to Table 5. Each row gives a criterion and its grade, one of its elements and what that element means, what the vendor has written for it, and the page it rests on. An element is documented, announced, in part, where it is answered only in part, or not stated in the documents searched, as of November 2, 2026, and the criterion’s grade follows from its elements as Exhibit 7 sets out. Every reading is in Greyhound Research’s own words. Where a rule set a grade, the criterion’s first row says which.
NetSuite in ChatGPT: Oracle, liveTwelve criteria, forty-one elements
| Criterion and grade | Element, and what it means | What is written | Page |
|---|---|---|---|
| 1 Door and status: documented. The ChatGPT plan tier is graded under session terms, not here. | (a) The assistant, named: which assistant reaches the application through this door, by name | Documented. NetSuite’s FAQ names ChatGPT as a client it currently supports. | NetSuite AI Connector Service FAQ |
| (b) Its status: in the vendor’s own word, such as live, beta, early access or announced | Documented. NetSuite’s current support for ChatGPT is the door’s live status, and its connection guide gives the steps for signing in from ChatGPT. | NetSuite AI Connector Service FAQ · Connect to the NetSuite AI Connector Service | |
| (c) Eligibility on the application side: the edition, region, role, geography or patch level the door requires | Documented. Users sign in under a non-administrator role that holds the MCP Server Connection permission, and NetSuite notes that some ChatGPT plans need Developer Mode. | Connect to the NetSuite AI Connector Service · Required Features and Permissions · NetSuite AI Connector Service FAQ | |
| 2 Identity: documented. | (a) Sign-in: how the person signs in to the application through the door | Documented. Users sign in with NetSuite credentials through OAuth 2.0 with PKCE, and NetSuite takes each user’s consent for every agent. | Connect to the NetSuite AI Connector Service · NetSuite AI Connector Service FAQ · Associated Risks, Controls, and Mitigation Strategies |
| (b) The application user: how the person becomes an application user, with that user’s own role | Documented. Tool access and actions follow the user’s own NetSuite role. | Available Tools in the MCP Standard Tools SuiteApp | |
| (c) Shared identities: whether shared or app-to-app identities are allowed | Documented. Administrator and full-permission roles never run tools, and the run-as-role option is off for every tool, so each call runs as the signed-in user. | Associated Risks, Controls, and Mitigation Strategies | |
| 3 Consent and scope: documented. | (a) Switching on: per-user consent or administrator enablement | Documented. Access stays off until an administrator grants the MCP permission to a role, each user consents in the OAuth flow, and connecting to a third-party model needs explicit acknowledgment. | Associated Risks, Controls, and Mitigation Strategies · NetSuite AI Connector Service FAQ |
| (b) What is barred: roles, tools or actions barred from the door | Documented. Administrator roles are barred, a tool shows only where the role holds its permissions, and NetSuite advises a separate, narrower role. | Required Features and Permissions · Available Tools in the MCP Standard Tools SuiteApp · MCP Standard Tools SuiteApp | |
| (c) Writing and deleting: whether tools that write or delete are exposed, and how they are limited | Documented. By Greyhound Research’s count, six of the 25 standard tools change data and none deletes, and SuiteQL is read-only. | Available Tools in the MCP Standard Tools SuiteApp | |
| 4 Approval of record: partly. | (a) Approval in the assistant: whether the application’s own approval can be given there | In part. NetSuite lists granting approvals among functions an agent may run, and its record action tool runs any action a record offers. Completing a NetSuite approval from ChatGPT, and its record, are not stated in the documents searched, as of November 2, 2026. | Associated Risks, Controls, and Mitigation Strategies · Available Tools in the MCP Standard Tools SuiteApp |
| (b) The record: which system records the approval | Documented. Actions run under the user’s role and are logged. | Available Tools in the MCP Standard Tools SuiteApp · Associated Risks, Controls, and Mitigation Strategies | |
| (c) The confirmation prompt: the assistant’s prompt before an action, and who controls it | Documented. NetSuite leaves the prompt to the client and advises clients that confirm high-impact actions. | Associated Risks, Controls, and Mitigation Strategies | |
| 5 Chained authority: partly. Segregation of duties as such is not stated in the documents searched, as of November 2, 2026. | (a) Checks that apply: whether segregation-of-duties or authorization checks apply to actions through the door | Documented. NetSuite’s tools add nothing to what the user’s own NetSuite role allows. | MCP Standard Tools SuiteApp |
| (b) Control on chaining: any control on chaining several actions in one session | In part. NetSuite advises against retrying an uncertain action. Beyond that advice, a control on chaining actions in one session is not stated in the documents searched, as of November 2, 2026. | Record Action Tools | |
| (c) Pattern or limit: any documented pattern or limit for chained work | In part. NetSuite’s guidance asks buyers to approve agents, clients, servers and tools before they connect and to prefer clients that fail closed. Guidance counts in part, and a product limit is not stated in the documents searched, as of November 2, 2026. | Associated Risks, Controls, and Mitigation Strategies | |
| 6 Reasoning place: partly. Which ChatGPT plan’s residency terms would apply is not stated in the documents searched, as of November 2, 2026, and the plan tier is graded under session terms. | (a) The lending pattern: tools lent to the assistant’s model, or an agent of the vendor’s own lent | Documented. NetSuite lends its tools to any client that supports MCP. | NetSuite AI Connector Service FAQ |
| (b) Where it reasons: whose model reasons, where, and on whose infrastructure | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) The vendor’s assurance: whether the application vendor’s assurance covers that place, or where the vendor says its control ends | Documented. NetSuite writes that it cannot control what outside components do with access, tokens or data once they leave NetSuite. | NetSuite AI Connector Service FAQ | |
| 7 Session terms: partly. | (a) Retention: how long the conversation is kept | Documented. OpenAI lets the admin set retention and purges data 30 days after deletion. | Enterprise privacy at OpenAI |
| (b) Residency and inference location: where the conversation is stored and processed, by plan tier | Documented. OpenAI offers residency for Enterprise and Edu, with apps excluded. | Data residency and inference residency for ChatGPT | |
| (c) Training use: whether the conversation trains a model | Documented. OpenAI writes that business plans are not used for training by default. | Business data privacy, security, and compliance | |
| (d) Zero data retention: whether it is offered for the conversation | Documented. OpenAI offers zero data retention for the API only. | Enterprise privacy at OpenAI | |
| (e) The plugin leg: whose terms cover the call between the assistant and the application | Documented. NetSuite data follows Oracle’s Terms of Service, and data sent to the model follows the model company’s privacy policy. | NetSuite AI Connector Service FAQ | |
| (f) The plan tier: which plan tier of the assistant the door requires | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 8 Evidence: partly. | (a) The application-side log: whether one is kept, and what it records | Documented. NetSuite logs each MCP call with the user’s email, method, path, status and duration. | Connect to the NetSuite AI Connector Service |
| (b) The assistant-side log: the assistant’s own log or compliance API | Documented. OpenAI’s Compliance Platform serves Enterprise and Edu workspaces. Which ChatGPT plan applies to this door is graded under session terms, 7(f). | OpenAI Compliance Platform for Enterprise and Edu customers | |
| (c) Retention: how long each log is kept | Documented. NetSuite keeps its log 21 days in production and seven in sandbox, and OpenAI keeps compliance logs 30 days. | Connect to the NetSuite AI Connector Service · OpenAI Compliance Platform for Enterprise and Edu customers | |
| (d) Export: whether either log can be exported | In part. OpenAI lets buyers download compliance logs for longer keeping. Export of the NetSuite execution log is not stated in the documents searched, as of November 2, 2026. | OpenAI Compliance Platform for Enterprise and Edu customers | |
| 9 Meter: documented. The seat, not its tier, is graded here, and the tier is graded under session terms. | (a) The application-side unit and rate: what the application charges for work through the door, and in what unit | Documented. NetSuite says the connector carries no charge as a feature and draws on the account’s concurrency limit, which scales with service tier and SuiteCloud Plus licenses. | NetSuite AI Connector Service FAQ · NetSuite AI Connector Service And Concurrency Governance |
| (b) The assistant seat: whether a separate assistant seat is required, and who bills it | Documented. NetSuite’s FAQ adds that the AI client may need its own paid subscription, so a separate seat, billed by the model company, is written. | NetSuite AI Connector Service FAQ | |
| 10 Way out: partly. | (a) Other routes: other assistants or clients documented for the same application | Documented. NetSuite documents Claude on the Pro plan or higher, guides for Codex, Claude Code and Copilot Studio, and any client that supports MCP. | Get Started · Connect to the NetSuite AI Connector Service · NetSuite AI Connector Service FAQ |
| (b) Notice of change: notice of changes written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) What leaves: what leaves the session with the buyer | In part. NetSuite’s execution log can be viewed for 21 days. Export of that log is not stated in the documents searched, as of November 2, 2026. | Connect to the NetSuite AI Connector Service | |
| (d) Exit: any exit term written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 11 Reversal: partly. The application’s own process counts, however the change arrived. | (a) An undo for the door: whether an undo, rollback or reversal is written for actions taken through the door | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) Restore of deletions: whether a record deleted through the door can be restored, and for how long, or a statement that the door cannot delete | Documented. By Greyhound Research’s reading, NetSuite’s standard tool list holds no delete tool, which counts as a statement that the door cannot delete. | Available Tools in the MCP Standard Tools SuiteApp | |
| (c) The reversing process: the application’s own business process that reverses a completed transaction, such as voiding a payment | Documented. NetSuite voids transactions with the audit trail kept, reopening a bill whose payment is voided, and voids checks with a reversing entry. | Voiding, Deleting, or Closing Transactions · Voiding a Check | |
| 12 Switching off: partly. | (a) For everyone: how an administrator suspends, disables or removes the door, or revokes its access, for the whole organization | Documented. Removing the MCP Server Connection permission turns the door off. | Connect to the NetSuite AI Connector Service |
| (b) For one user or role: whether access through the door can be withdrawn from one user or role without closing it for everyone | Documented. NetSuite grants the MCP Server Connection permission by role, and an admin can revoke one authorized OAuth 2.0 application. | Associated Risks, Controls, and Mitigation Strategies · Viewing and Revoking OAuth 2.0 Authorized Applications | |
| (c) What ends: whether withdrawing access revokes the tokens already issued and ends open sessions, and if not, how long they stay valid | In part. Revoking an authorized OAuth 2.0 application voids its tokens, and access tokens last 60 minutes. Whether removing the permission ends open sessions or issued tokens is not stated in the documents searched, as of November 2, 2026. | Viewing and Revoking OAuth 2.0 Authorized Applications · Step Two POST Request to the Token Endpoint | |
| (d) On the assistant’s side: how the assistant’s administrator disables or blocks the app or connector | Documented. ChatGPT admins can disable the app or plugin. | Admin controls, security, and compliance for plugins and apps |
Fusion in ChatGPT: Oracle, announcedTwelve criteria, forty-one elements
| Criterion and grade | Element, and what it means | What is written | Page |
|---|---|---|---|
| 1 Door and status: announced. Any Oracle product documentation for Workspace or Companion is not stated in the documents searched, as of November 2, 2026, so the door’s name and status count only as announcements. | (a) The assistant, named: which assistant reaches the application through this door, by name | Announced. Oracle’s Workspace blog and its Companion release name ChatGPT. | Introducing Oracle AI Workspace: Put AI to work across your enterprise · Oracle Introduces New AI-Powered Ways to Execute Work Across Oracle Fusion Applications |
| (b) Its status: in the vendor’s own word, such as live, beta, early access or announced | Announced. Oracle’s Workspace blog says Workspace is yet to launch, its product page invites sign-ups for an upcoming limited availability, and the release describes Companion as a capability to come. | Introducing Oracle AI Workspace: Put AI to work across your enterprise · Oracle AI Workspace · Oracle Introduces New AI-Powered Ways to Execute Work Across Oracle Fusion Applications | |
| (c) Eligibility on the application side: the edition, region, role, geography or patch level the door requires | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 2 Identity: announced. Fusion’s own agent route counts for this door only where Oracle writes that the door inherits it. | (a) Sign-in: how the person signs in to the application through the door | Announced. Oracle’s partnership blog claims a unified sign-in under existing permissions, and the Companion release keeps the work inside the identity and permission controls already in place. | Oracle and OpenAI: Put frontier AI to work for your business · Oracle Introduces New AI-Powered Ways to Execute Work Across Oracle Fusion Applications |
| (b) The application user: how the person becomes an application user, with that user’s own role | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Shared identities: whether shared or app-to-app identities are allowed | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 3 Consent and scope: announced. | (a) Switching on: per-user consent or administrator enablement | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) What is barred: roles, tools or actions barred from the door | Announced. Oracle’s Workspace blog announces that the business’s current rules, permissions and authority to approve carry over, a scope term. The roles, tools or actions barred from the door are not stated in the documents searched, as of November 2, 2026. | Introducing Oracle AI Workspace: Put AI to work across your enterprise | |
| (c) Writing and deleting: whether tools that write or delete are exposed, and how they are limited | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 4 Approval of record: announced. | (a) Approval in the assistant: whether the application’s own approval can be given there | Announced. Oracle’s product page has Workspace ask a person for approval inside the workspace when needed. The mechanism for approving from ChatGPT is not stated in the documents searched, as of November 2, 2026. | Oracle AI Workspace |
| (b) The record: which system records the approval | Announced. Oracle’s Workspace blog says Oracle’s applications check approvals and do the work of record. The system that records the approval is not stated in the documents searched, as of November 2, 2026. | Introducing Oracle AI Workspace: Put AI to work across your enterprise | |
| (c) The confirmation prompt: the assistant’s prompt before an action, and who controls it | Announced. Oracle’s product page keeps a person reviewing where rules call for it. Who controls the prompt is not stated in the documents searched, as of November 2, 2026. | Oracle AI Workspace | |
| 5 Chained authority: announced. Oracle’s segregation-of-duties guidance is written for Fusion’s own agents, not this door, so it does not count here. | (a) Checks that apply: whether segregation-of-duties or authorization checks apply to actions through the door | Announced. Oracle’s Workspace blog says current rules and approval authority carry over, and its product page keeps AI actions inside business rules and permissions. | Introducing Oracle AI Workspace: Put AI to work across your enterprise · Oracle AI Workspace |
| (b) Control on chaining: any control on chaining several actions in one session | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Pattern or limit: any documented pattern or limit for chained work | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 6 Reasoning place: announced. | (a) The lending pattern: tools lent to the assistant’s model, or an agent of the vendor’s own lent | Announced. Oracle’s Workspace blog says AI runs the work while Oracle enforces the rules and makes the changes of record, which reads as lending. The lending mechanism is not stated in the documents searched, as of November 2, 2026. | Introducing Oracle AI Workspace: Put AI to work across your enterprise |
| (b) Where it reasons: whose model reasons, where, and on whose infrastructure | Announced. Oracle’s Workspace blog names OpenAI frontier models as the provider. The infrastructure and region are not stated in the documents searched, as of November 2, 2026. | Introducing Oracle AI Workspace: Put AI to work across your enterprise | |
| (c) The vendor’s assurance: whether the application vendor’s assurance covers that place, or where the vendor says its control ends | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 7 Session terms: not stated. Oracle’s documents and OpenAI’s post on Oracle apps in ChatGPT were both searched, Oracle’s announcement does not bring OpenAI’s documents in, and the zero data retention the Fusion Service Descriptions set for OpenAI endpoints reached through Fusion’s own services belongs to Fusion’s own layer. | (a) Retention: how long the conversation is kept | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) Residency and inference location: where the conversation is stored and processed, by plan tier | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Training use: whether the conversation trains a model | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (d) Zero data retention: whether it is offered for the conversation | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (e) The plugin leg: whose terms cover the call between the assistant and the application | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (f) The plan tier: which plan tier of the assistant the door requires | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 8 Evidence: not stated. Fusion’s outcome receipts belong to its own layer and NetSuite’s execution log to another route, so neither lifts this door, and Oracle’s announcement does not bring OpenAI’s documents in. | (a) The application-side log: whether one is kept, and what it records | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) The assistant-side log: the assistant’s own log or compliance API | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Retention: how long each log is kept | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (d) Export: whether either log can be exported | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 9 Meter: not stated. Oracle’s documents and OpenAI’s post on Oracle apps in ChatGPT were both searched, the AI Units the Fusion Service Descriptions meter for Fusion’s own agents belong to its own layer, and Oracle’s announcement does not bring OpenAI’s documents in. | (a) The application-side unit and rate: what the application charges for work through the door, and in what unit | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) The assistant seat: whether a separate assistant seat is required, and who bills it | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 10 Way out: partly. Under the way out, the vendor’s other documented routes count. | (a) Other routes: other assistants or clients documented for the same application | Documented. Oracle’s AI Agent Studio guide documents outside platforms calling Fusion agents over agent-to-agent, its Help Center lets outside applications reach them through /invokeAsync, and the Companion release names ChatGPT among supported tools. | How do I use AI Agent Studio? Release 26D, G59779-05 · Can I access agent teams from applications outside of Fusion Applications? Oracle AI for Fusion Applications Questions and Answers, Oracle Help Center, September 22 · Oracle Introduces New AI-Powered Ways to Execute Work Across Oracle Fusion Applications |
| (b) Notice of change: notice of changes written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) What leaves: what leaves the session with the buyer | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (d) Exit: any exit term written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 11 Reversal: partly. The application’s own process counts, however the change arrived, and the door’s release and Workspace blog were among the documents searched. | (a) An undo for the door: whether an undo, rollback or reversal is written for actions taken through the door | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) Restore of deletions: whether a record deleted through the door can be restored, and for how long, or a statement that the door cannot delete | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) The reversing process: the application’s own business process that reverses a completed transaction, such as voiding a payment | Documented. Fusion Payables lets one payment, or a whole payment file, be voided, and a rejected payment approval ends the payment process request at once. | Void Payment or Payment File · How Payment Approval Is Processed | |
| 12 Switching off: not stated. Greyhound Research set this criterion at not stated for evenness with session terms, evidence and meter, because Oracle’s October 27 release says Workspace work runs through plugins in ChatGPT but Oracle’s announcement does not bring OpenAI’s documents in, and Fusion’s own AI feature switch is its own layer. | (a) For everyone: how an administrator suspends, disables or removes the door, or revokes its access, for the whole organization | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) For one user or role: whether access through the door can be withdrawn from one user or role without closing it for everyone | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) What ends: whether withdrawing access revokes the tokens already issued and ends open sessions, and if not, how long they stay valid | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (d) On the assistant’s side: how the assistant’s administrator disables or blocks the app or connector | Not stated in the documents searched, as of November 2, 2026. | None found |
Salesforce in Claude: Salesforce, betaTwelve criteria, forty-one elements
| Criterion and grade | Element, and what it means | What is written | Page |
|---|---|---|---|
| 1 Door and status: documented. The Claude plan, which Salesforce’s pages state two ways, is graded under session terms, not here. | (a) The assistant, named: which assistant reaches the application through this door, by name | Documented. Salesforce Help names Claude. | What Is Salesforce in Claude (Beta) |
| (b) Its status: in the vendor’s own word, such as live, beta, early access or announced | Documented. Salesforce calls the plugin a pilot or beta service under its beta terms, and its release notes date the rollout from September 15, 2026. | What Is Salesforce in Claude (Beta) · Access Salesforce Context Without Leaving Claude (Beta) | |
| (c) Eligibility on the application side: the edition, region, role, geography or patch level the door requires | Documented. Salesforce offers the plugin on Enterprise, Performance, Unlimited and Developer Editions. | About Claudeforce | |
| 2 Identity: documented. | (a) Sign-in: how the person signs in to the application through the door | Documented. Each person signs in through per-user OAuth 2.0 with PKCE, over an External Client App with the mcp_api scope, and Connected Apps cannot be used for it. | Salesforce Hosted MCP Servers · Headless 360 MCP Server (Beta) · Connecting an MCP Client |
| (b) The application user: how the person becomes an application user, with that user’s own role | Documented. Each hosted MCP call runs as the signed-in user, under object, field, sharing and permission-set checks. | Headless 360 MCP Server (Beta) | |
| (c) Shared identities: whether shared or app-to-app identities are allowed | Documented. Because each hosted MCP call runs as the signed-in user, a shared identity is not the documented route for this door. | Headless 360 MCP Server (Beta) | |
| 3 Consent and scope: documented. | (a) Switching on: per-user consent or administrator enablement | Documented. Salesforce has an admin activate the MCP server, optionally behind a permission set, then set up the External Client App and connect Claude. | Activate the MCP Server · What Is Salesforce in Claude (Beta) |
| (b) What is barred: roles, tools or actions barred from the door | Documented. Claude’s organization settings control writes, setting the Dispatch API to Needs Approval, Always Allowed or Deny, and leaving it unrestricted by default. | Set Tool Restrictions for the Salesforce MCP Server | |
| (c) Writing and deleting: whether tools that write or delete are exposed, and how they are limited | Documented. Creates and updates cover listed standard objects and all custom objects, and the beta cannot delete records, as a browser reading of November 3, 2026 confirmed. | How Record Creation and Updates Work in Salesforce in Claude (Beta) · Set Tool Restrictions for the Salesforce MCP Server | |
| 4 Approval of record: partly. A confirmation prompt never counts as an approval of record. | (a) Approval in the assistant: whether the application’s own approval can be given there | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) The record: which system records the approval | Documented. Record saves pass the same validation as in Lightning Experience. | How Record Creation and Updates Work in Salesforce in Claude (Beta) | |
| (c) The confirmation prompt: the assistant’s prompt before an action, and who controls it | Documented. A Claude admin chooses the confirmation as a Claude-side setting, and Salesforce recommends Needs Approval on the page that also says the beta cannot delete records. | How Record Creation and Updates Work in Salesforce in Claude (Beta) · Set Tool Restrictions for the Salesforce MCP Server | |
| 5 Chained authority: partly. Segregation of duties as such is not stated in the documents searched, as of November 2, 2026. | (a) Checks that apply: whether segregation-of-duties or authorization checks apply to actions through the door | Documented. Calls from headless clients go through the identity, permission and credential checks of an ordinary Salesforce request. | Security and Governance in Headless Experiences |
| (b) Control on chaining: any control on chaining several actions in one session | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Pattern or limit: any documented pattern or limit for chained work | In part. Salesforce’s guidance asks for least privilege and human approval for high-impact actions. Guidance counts in part, and a product limit is not stated in the documents searched, as of November 2, 2026. | Security and Governance in Headless Experiences | |
| 6 Reasoning place: partly. | (a) The lending pattern: tools lent to the assistant’s model, or an agent of the vendor’s own lent | Documented. Salesforce lends tools over a Salesforce-hosted MCP server with Discover, Describe, Dispatch and read-only Dispatch. | Headless 360 MCP Server (Beta) |
| (b) Where it reasons: whose model reasons, where, and on whose infrastructure | In part. Salesforce requires a direct Anthropic subscription. Beyond that, where Claude reasons for this door is not stated in the documents searched, as of November 2, 2026. | About Claudeforce | |
| (c) The vendor’s assurance: whether the application vendor’s assurance covers that place, or where the vendor says its control ends | Documented. Salesforce writes that its monitoring ends where Salesforce ends, and treats outside agents as non-Salesforce applications whose output the customer must review. | Security and Governance in Headless Experiences · Legal and Ethical Considerations with Headless Functionality | |
| 7 Session terms: partly. Salesforce’s own pages conflict on the Claude plan, which holds the criterion at partly. | (a) Retention: how long the conversation is kept | Documented. For Enterprise, Anthropic keeps conversations indefinitely unless a period of 30 days or more is set. | Configure custom data retention controls for Enterprise plans |
| (b) Residency and inference location: where the conversation is stored and processed, by plan tier | Documented. For Enterprise, Anthropic stores data in the United States, with routing to several regions. | Where are your servers located? Do you host your models on EU servers? Anthropic Privacy Center | |
| (c) Training use: whether the conversation trains a model | Documented. For Enterprise, Anthropic’s commercial terms rule out training on customer content. | Commercial Terms of Service | |
| (d) Zero data retention: whether it is offered for the conversation | Documented. For Enterprise, Anthropic offers zero data retention only outside the Claude app. | I have a zero data retention agreement with Anthropic | |
| (e) The plugin leg: whose terms cover the call between the assistant and the application | Documented. Beta or pilot terms govern the Salesforce leg. | What Is Salesforce in Claude (Beta) | |
| (f) The plan tier: which plan tier of the assistant the door requires | In part. Salesforce requires Claude Enterprise on one page but accepts Enterprise, Team or Console on another. One consistent plan tier is not stated in the documents searched, as of November 2, 2026. | What Is Salesforce in Claude (Beta) · About Claudeforce | |
| 8 Evidence: partly. | (a) The application-side log: whether one is kept, and what it records | In part. Salesforce says its audit trail ties each hosted MCP action to the user, and asks customers to document steps across sources. The fields Salesforce records are not stated in the documents searched, as of November 2, 2026. | Headless 360 MCP Server (Beta) · Security and Governance in Headless Experiences |
| (b) The assistant-side log: the assistant’s own log or compliance API | Documented. Anthropic offers audit logs for Enterprise plans only. | Access audit logs · List activities | |
| (c) Retention: how long each log is kept | In part. Anthropic’s audit logs cover 180 days. The retention of Salesforce’s trail is not stated in the documents searched, as of November 2, 2026. | Access audit logs | |
| (d) Export: whether either log can be exported | In part. Anthropic offers export through the Compliance API. Export of Salesforce’s trail is not stated in the documents searched, as of November 2, 2026. | Access the Compliance API | |
| 9 Meter: partly. Salesforce’s pricing page values Flex Credits at USD 500 per 100,000, read as context and not graded. | (a) The application-side unit and rate: what the application charges for work through the door, and in what unit | In part. Salesforce’s rate card lists Headless Platform Interaction with its rate to be announced. A rate for that line, a price for the plugin and a price for hosted MCP calls are not stated in the documents searched, as of November 2, 2026. | Flex Credits Rate Card |
| (b) The assistant seat: whether a separate assistant seat is required, and who bills it | Documented. An Anthropic subscription is required, and Salesforce names it as Claude Enterprise. | What Is Salesforce in Claude (Beta) | |
| 10 Way out: partly. The portability of agents or skills is not stated in the documents searched, as of November 2, 2026. | (a) Other routes: other assistants or clients documented for the same application | Documented. Salesforce’s hosted MCP servers take Claude, ChatGPT, Cursor or a custom agent, any client using OAuth 2.0 with PKCE is expected to work, and the Agentforce Sales app reaches ChatGPT. | Salesforce Hosted MCP Servers · Connecting an MCP Client · The #1 AI CRM Meets ChatGPT |
| (b) Notice of change: notice of changes written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) What leaves: what leaves the session with the buyer | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (d) Exit: any exit term written for the door | Documented. Salesforce’s services agreement supplies beta services as is. | Main Services Agreement | |
| 11 Reversal: partly. The application’s own process counts, however the change arrived. | (a) An undo for the door: whether an undo, rollback or reversal is written for actions taken through the door | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) Restore of deletions: whether a record deleted through the door can be restored, and for how long, or a statement that the door cannot delete | Documented. Salesforce writes that the door cannot delete records, which must be deleted in Salesforce itself, and its Recycle Bin keeps deleted items 15 days for restore. | How Record Creation and Updates Work in Salesforce in Claude (Beta) · View, Restore, and Manage Items in the Recycle Bin in Salesforce Classic | |
| (c) The reversing process: the application’s own business process that reverses a completed transaction, such as voiding a payment | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 12 Switching off: partly. An element answered in part holds the criterion at partly. | (a) For everyone: how an administrator suspends, disables or removes the door, or revokes its access, for the whole organization | Documented. Removing the External Client App cuts off its integrations, and its tokens can be revoked. | Delete an External Client App · Manage External Client App OAuth Usage |
| (b) For one user or role: whether access through the door can be withdrawn from one user or role without closing it for everyone | Documented. Salesforce lets the External Client App’s tokens be revoked per user. | Manage External Client App OAuth Usage | |
| (c) What ends: whether withdrawing access revokes the tokens already issued and ends open sessions, and if not, how long they stay valid | In part. Revoked JWT-based tokens stop working, though sessions remain. Whether deleting the app ends tokens or sessions, the JWT token lifetime and open-session validity are not stated in the documents searched, as of November 2, 2026. | Revoke All JSON Web Token (JWT)-Based Access Tokens | |
| (d) On the assistant’s side: how the assistant’s administrator disables or blocks the app or connector | Documented. In Claude, an Owner can remove the connector. | Get started with connectors |
Joule in Microsoft 365 Copilot: SAP, supportedTwelve criteria, forty-one elements
| Criterion and grade | Element, and what it means | What is written | Page |
|---|---|---|---|
| 1 Door and status: documented. The Copilot license is graded under session terms, not here. | (a) The assistant, named: which assistant reaches the application through this door, by name | Documented. Joule’s feature scope description names Microsoft 365 Copilot as the outside assistant Joule currently supports. | Joule Feature Scope Description, version 3.0.0 |
| (b) Its status: in the vendor’s own word, such as live, beta, early access or announced | Documented. SAP’s wording of current support counts as a status, and its usage page delivers Joule as a custom engine agent inside Copilot. | Joule Feature Scope Description, version 3.0.0 · Using Joule with Microsoft 365 Copilot | |
| (c) Eligibility on the application side: the edition, region, role, geography or patch level the door requires | Documented. SAP requires Joule Base, a Copilot system added to the Joule formation, and one Entra ID tenant per Joule environment. | Bi-directional integration between Joule and Microsoft 365 Copilot · Enable Microsoft Copilot and Teams to Pass Requests to Joule | |
| 2 Identity: documented. | (a) Sign-in: how the person signs in to the application through the door | Documented. SAP’s integration guide has the user sign in through Microsoft Entra ID, trusted by SAP Cloud Identity Services. | Integrating Joule with Microsoft 365 Copilot |
| (b) The application user: how the person becomes an application user, with that user’s own role | Documented. SAP requires every Copilot user to exist in its user store, and its roles page processes each question under that user’s own identity and permissions, with no extra roles to maintain. | Integrating Joule with Microsoft 365 Copilot · Roles and Authorizations for Joule with Microsoft 365 Copilot/Microsoft Teams | |
| (c) Shared identities: whether shared or app-to-app identities are allowed | Documented. SAP keeps every question in the scope of the asking user’s identity, so a shared identity is not the documented route. | Roles and Authorizations for Joule with Microsoft 365 Copilot/Microsoft Teams | |
| 3 Consent and scope: partly. | (a) Switching on: per-user consent or administrator enablement | Documented. An admin installs Joule from the Microsoft 365 admin center after consenting to the bot app in Entra and adding Copilot to the Joule formation. | Using Joule with Microsoft 365 Copilot · Enable Microsoft Copilot and Teams to Pass Requests to Joule |
| (b) What is barred: roles, tools or actions barred from the door | Documented. SAP makes what Joule answers in its own client generally available in Copilot, with no added roles, so Joule’s limits carry over. | Using Joule with Microsoft 365 Copilot · Roles and Authorizations for Joule with Microsoft 365 Copilot/Microsoft Teams | |
| (c) Writing and deleting: whether tools that write or delete are exposed, and how they are limited | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 4 Approval of record: not stated. SAP’s usage page carries queries over in general, and SAP’s line on supervision and approvals at every step is a platform principle, not written for outside assistants. | (a) Approval in the assistant: whether the application’s own approval can be given there | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) The record: which system records the approval | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) The confirmation prompt: the assistant’s prompt before an action, and who controls it | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 5 Chained authority: partly. Segregation of duties as such is not stated in the documents searched, as of November 2, 2026. | (a) Checks that apply: whether segregation-of-duties or authorization checks apply to actions through the door | Documented. SAP’s roles page runs each question from Copilot under the user’s own identity and permissions, with the same checks as in Joule itself. | Roles and Authorizations for Joule with Microsoft 365 Copilot/Microsoft Teams |
| (b) Control on chaining: any control on chaining several actions in one session | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Pattern or limit: any documented pattern or limit for chained work | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 6 Reasoning place: partly. | (a) The lending pattern: tools lent to the assistant’s model, or an agent of the vendor’s own lent | Documented. SAP lends an agent, with Copilot handing the conversation to a Joule agent. | Enable Microsoft Copilot and Teams to Pass Requests to Joule |
| (b) Where it reasons: whose model reasons, where, and on whose infrastructure | In part. On the SAP side, Joule reasons on models from technology partners, and Microsoft’s own pages cover the Copilot side. Which partner model Joule uses, and where it runs, are not stated in the documents searched, as of November 2, 2026. | Integrating and Extending Joule, SAP’s AI Copilot · Data, Privacy, and Security for Microsoft Copilot | |
| (c) The vendor’s assurance: whether the application vendor’s assurance covers that place, or where the vendor says its control ends | Documented. SAP writes that it neither controls nor answers for the data Copilot processes. | Using Joule with Microsoft 365 Copilot | |
| 7 Session terms: partly. Microsoft’s documents count for the single product SAP names, Microsoft 365 Copilot. | (a) Retention: how long the conversation is kept | Documented. Microsoft keeps Copilot interactions under Purview retention policies. | Data, Privacy, and Security for Microsoft Copilot |
| (b) Residency and inference location: where the conversation is stored and processed, by plan tier | Documented. Microsoft keeps EU customers inside the EU Data Boundary. | Data, Privacy, and Security for Microsoft Copilot | |
| (c) Training use: whether the conversation trains a model | Documented. Microsoft does not train on prompts, responses or Graph data. | Data, Privacy, and Security for Microsoft Copilot | |
| (d) Zero data retention: whether it is offered for the conversation | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (e) The plugin leg: whose terms cover the call between the assistant and the application | Documented. SAP’s usage page puts Copilot use under the customer’s agreement with Microsoft. | Using Joule with Microsoft 365 Copilot | |
| (f) The plan tier: which plan tier of the assistant the door requires | Documented. SAP names a Microsoft 365 Copilot license. | Using Joule with Microsoft 365 Copilot | |
| 8 Evidence: partly. | (a) The application-side log: whether one is kept, and what it records | In part. Joule’s feature scope description captures conversation history for auditability, and SAP’s architecture guide names tool-call tracing for agents. What the Joule log records for work started in Copilot is not stated in the documents searched, as of November 2, 2026. | Joule Feature Scope Description, version 3.0.0 · Agentic AI & AI Agents on SAP Business AI Platform |
| (b) The assistant-side log: the assistant’s own log or compliance API | Documented. Microsoft 365 Copilot writes audit logs with AgentId and AISystemPlugin fields. | Audit logs for Copilot and AI applications | |
| (c) Retention: how long each log is kept | In part. Microsoft keeps Copilot audit logs under Purview. The retention of the Joule log is not stated in the documents searched, as of November 2, 2026. | Audit logs for Copilot and AI applications | |
| (d) Export: whether either log can be exported | In part. Microsoft exports Copilot audit logs under Purview. Export of the Joule log is not stated in the documents searched, as of November 2, 2026. | Audit logs for Copilot and AI applications | |
| 9 Meter: partly. SAP’s own pages conflict, which holds the criterion at partly, and a money value per AI Unit is not stated in the documents searched, as of November 2, 2026, read as context and not graded. | (a) The application-side unit and rate: what the application charges for work through the door, and in what unit | In part. SAP’s Norwegian page adds no cost beyond Joule Base, its global page currently requires AI Units, and SAP Learning meters Joule agents per step. Whether Copilot-started steps draw AI Units is not stated in the documents searched, as of November 2, 2026. | Bi-directional integration between Joule and Microsoft 365 Copilot · Bi-directional integration between Joule and Microsoft 365 Copilot · Understanding the Commercial Model |
| (b) The assistant seat: whether a separate assistant seat is required, and who bills it | Documented. SAP names a Microsoft 365 Copilot license. | Using Joule with Microsoft 365 Copilot | |
| 10 Way out: partly. | (a) Other routes: other assistants or clients documented for the same application | Documented. SAP’s architecture guide lets Vertex AI, Copilot Studio, Bedrock and others hand SAP tasks to Joule agents, with an MCP gateway for outside clients. | Agentic AI & AI Agents on SAP Business AI Platform |
| (b) Notice of change: notice of changes written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) What leaves: what leaves the session with the buyer | Documented. SAP lets data be exported until the subscription ends, at platform level. | Responsible AI | |
| (d) Exit: any exit term written for the door | In part. SAP’s API Policy reserves throttling, suspension or termination for AI access outside endorsed paths. An exit term written for this door is not stated in the documents searched, as of November 2, 2026. | SAP API Policy v.4.2026a | |
| 11 Reversal: partly. The application’s own process counts, however the change arrived. | (a) An undo for the door: whether an undo, rollback or reversal is written for actions taken through the door | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) Restore of deletions: whether a record deleted through the door can be restored, and for how long, or a statement that the door cannot delete | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) The reversing process: the application’s own business process that reverses a completed transaction, such as voiding a payment | Documented. SAP’s Reverse Payment Run page for S/4HANA Cloud Public Edition 2608 allows a payment run to be reversed until payment media are created, read in a browser on November 4, 2026. | Reverse Payment Run | |
| 12 Switching off: partly. Microsoft’s pages count on the assistant’s side because SAP names Copilot, and SAP’s setup course gives only the switch-on steps. | (a) For everyone: how an administrator suspends, disables or removes the door, or revokes its access, for the whole organization | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) For one user or role: whether access through the door can be withdrawn from one user or role without closing it for everyone | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) What ends: whether withdrawing access revokes the tokens already issued and ends open sessions, and if not, how long they stay valid | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (d) On the assistant’s side: how the assistant’s administrator disables or blocks the app or connector | Documented. A Microsoft 365 admin can block an agent organization-wide, or uninstall it for everyone or chosen users or groups, and a block removes it from members who installed it. | Governance and lifecycle actions for agents available in Microsoft 365 admin center · Understand agent details in Microsoft 365 admin center |
Sana in Claude: Workday, early accessTwelve criteria, forty-one elements
| Criterion and grade | Element, and what it means | What is written | Page |
|---|---|---|---|
| 1 Door and status: partly. The Workday-made listing counts as documentation only for the assistant’s name and the door’s status. | (a) The assistant, named: which assistant reaches the application through this door, by name | Documented. The Workday-made listing names Claude. | Sana from Workday connector listing, made by Workday |
| (b) Its status: in the vendor’s own word, such as live, beta, early access or announced | Documented. The listing calls the connector a beta service, and Workday’s partnership release offers it to early access customers. | Sana from Workday connector listing, made by Workday · Workday and Anthropic Announce New Partnership to Connect Reasoning to the Rules That Run the Business, Wherever People Choose to Work | |
| (c) Eligibility on the application side: the edition, region, role, geography or patch level the door requires | Announced. The listing asks for an active UMSA and agents set up in the Agent Management Hub, an announcement here. Eligibility in Workday’s documentation, which sits behind a login, is not stated in the documents searched, as of November 2, 2026. | Sana from Workday connector listing, made by Workday | |
| 2 Identity: announced. As the listing counts only for name and status, its lines here are announcements, and Workday’s agent identity pages are written for agents, not this door. | (a) Sign-in: how the person signs in to the application through the door | Announced. The listing requires sign-in, and Workday’s partnership release says admins connect once with no per-user setup. | Sana from Workday connector listing, made by Workday · Workday and Anthropic Announce New Partnership to Connect Reasoning to the Rules That Run the Business, Wherever People Choose to Work |
| (b) The application user: how the person becomes an application user, with that user’s own role | Announced. The listing says the connector uses only what each person may see, under Workday’s roles and permissions. | Sana from Workday connector listing, made by Workday | |
| (c) Shared identities: whether shared or app-to-app identities are allowed | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 3 Consent and scope: announced. As the listing counts only for name and status, its lines here are announcements, and which of the connector’s four tools write is not stated in the documents searched, as of November 2, 2026. | (a) Switching on: per-user consent or administrator enablement | Announced. The listing has the Workday side enabled through the UMSA and agents set up in the Agent Management Hub, and says the connector completes supported actions. | Sana from Workday connector listing, made by Workday |
| (b) What is barred: roles, tools or actions barred from the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Writing and deleting: whether tools that write or delete are exposed, and how they are limited | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 4 Approval of record: announced. | (a) Approval in the assistant: whether the application’s own approval can be given there | Announced. Workday’s listing says supported approvals can be handled inside Claude, and its partnership release has a finance leader approve in Claude. The mechanism is not stated in the documents searched, as of November 2, 2026, since it sits behind Workday’s customer login. | Sana from Workday connector listing, made by Workday · Workday and Anthropic Announce New Partnership to Connect Reasoning to the Rules That Run the Business, Wherever People Choose to Work |
| (b) The record: which system records the approval | Announced. Workday’s Sana release keeps policy checks and approvals in Workday. | Workday to Bring Sana Everywhere Employees Work, Including Claude, Gemini Enterprise, Microsoft Copilot, Microsoft Teams, and Slack | |
| (c) The confirmation prompt: the assistant’s prompt before an action, and who controls it | Announced. Workday’s partnership release has the user confirm every change. | Workday and Anthropic Announce New Partnership to Connect Reasoning to the Rules That Run the Business, Wherever People Choose to Work | |
| 5 Chained authority: announced. As the listing counts only for name and status, its line here is an announcement, and segregation of duties as such is not stated in the documents searched, as of November 2, 2026. | (a) Checks that apply: whether segregation-of-duties or authorization checks apply to actions through the door | Announced. Workday’s listing says requests are bound by Workday’s existing roles, permissions, approval chains and audit controls. | Sana from Workday connector listing, made by Workday |
| (b) Control on chaining: any control on chaining several actions in one session | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Pattern or limit: any documented pattern or limit for chained work | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 6 Reasoning place: announced. | (a) The lending pattern: tools lent to the assistant’s model, or an agent of the vendor’s own lent | Announced. Workday’s partnership release says Sana uses Claude’s reasoning per step, passing only that step’s context, and the listing shows Claude sending actions to a Workday plugin, so an agent is lent and the outside model also reasons. | Workday and Anthropic Announce New Partnership to Connect Reasoning to the Rules That Run the Business, Wherever People Choose to Work · Sana from Workday connector listing, made by Workday |
| (b) Where it reasons: whose model reasons, where, and on whose infrastructure | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) The vendor’s assurance: whether the application vendor’s assurance covers that place, or where the vendor says its control ends | Announced. Workday’s Sana release denies outside tools raw access to Workday data. | Workday to Bring Sana Everywhere Employees Work, Including Claude, Gemini Enterprise, Microsoft Copilot, Microsoft Teams, and Slack | |
| 7 Session terms: partly. | (a) Retention: how long the conversation is kept | Documented. Anthropic keeps chats until they are deleted and purges them within 30 days. | How long do you store my organization’s data? Anthropic Privacy Center |
| (b) Residency and inference location: where the conversation is stored and processed, by plan tier | Documented. Anthropic stores data in the United States, routed to several regions. | Where are your servers located? Do you host your models on EU servers? Anthropic Privacy Center | |
| (c) Training use: whether the conversation trains a model | Documented. Workday keeps customer data from training third-party public models. | Responsible AI | |
| (d) Zero data retention: whether it is offered for the conversation | Documented. Anthropic offers zero data retention only outside the Claude app. | I have a zero data retention agreement with Anthropic | |
| (e) The plugin leg: whose terms cover the call between the assistant and the application | In part. Workday’s listing puts the Workday leg under the UMSA, the Product Terms and Workday’s privacy policy. A Workday handover of the session is not stated in the documents searched, as of November 2, 2026. | Sana from Workday connector listing, made by Workday | |
| (f) The plan tier: which plan tier of the assistant the door requires | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 8 Evidence: partly. | (a) The application-side log: whether one is kept, and what it records | In part. Workday’s data sheet says delegation context may also be kept in the audit record, and the listing points to Workday’s audit controls. What the Workday record holds for a Claude action is not stated in the documents searched, as of November 2, 2026. | Agent-Ready Tools Data Sheet · Sana from Workday connector listing, made by Workday |
| (b) The assistant-side log: the assistant’s own log or compliance API | Documented. Anthropic keeps audit logs for Enterprise plans only. Which Claude plan applies to this door is graded under session terms, 7(f). | Access audit logs | |
| (c) Retention: how long each log is kept | In part. Anthropic’s audit logs cover 180 days. The retention of the Workday record is not stated in the documents searched, as of November 2, 2026. | Access audit logs | |
| (d) Export: whether either log can be exported | In part. Anthropic offers export through the Compliance API. Export of the Workday record is not stated in the documents searched, as of November 2, 2026. | Access the Compliance API | |
| 9 Meter: partly. A money value per credit is not stated in the documents searched, as of November 2, 2026, read as context and not graded. | (a) The application-side unit and rate: what the application charges for work through the door, and in what unit | In part. Workday meters Sana per completed task, and its October 12, 2026 Flex Credits rate card charges one credit per Sana self-service action and prices Agent-Ready Tools calls per 100. The door’s row is not stated in the documents searched, as of November 2, 2026. | Workday Flex credits · Flex Credits Rate Card |
| (b) The assistant seat: whether a separate assistant seat is required, and who bills it | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 10 Way out: partly. Agent portability, leaving the Claude route, and an exit term beyond the beta label are not stated in the documents searched, as of November 2, 2026. | (a) Other routes: other assistants or clients documented for the same application | Documented. Workday’s data sheet names six platforms, ChatGPT among them, and Sana for Gemini Enterprise has a setup guide. | Agent-Ready Tools Data Sheet · Set up Sana from Workday for Gemini Enterprise |
| (b) Notice of change: notice of changes written for the door | In part. Workday’s rate card reserves the right to end any offer. A notice term for the door is not stated in the documents searched, as of November 2, 2026. | Flex Credits Rate Card | |
| (c) What leaves: what leaves the session with the buyer | Documented. Workday’s trust page offers standard data export through the contract term. | Security & Compliance (AI Governance Trust) | |
| (d) Exit: any exit term written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 11 Reversal: partly. The application’s own process counts, however the change arrived. | (a) An undo for the door: whether an undo, rollback or reversal is written for actions taken through the door | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) Restore of deletions: whether a record deleted through the door can be restored, and for how long, or a statement that the door cannot delete | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) The reversing process: the application’s own business process that reverses a completed transaction, such as voiding a payment | Documented. Workday’s public administrator guide lets a completed business process be rescinded, restoring its data, and adds cancel and correct, noting that a cancel or rescind cannot be undone. | Reference: Actions Available on Business Processes · Concept: Business Process Management | |
| 12 Switching off: partly. The partnership release speaks of connecting once, and the door’s own documentation sits behind a login. | (a) For everyone: how an administrator suspends, disables or removes the door, or revokes its access, for the whole organization | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) For one user or role: whether access through the door can be withdrawn from one user or role without closing it for everyone | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) What ends: whether withdrawing access revokes the tokens already issued and ends open sessions, and if not, how long they stay valid | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (d) On the assistant’s side: how the assistant’s administrator disables or blocks the app or connector | Documented. Workday’s listing names Claude, so Anthropic’s controls count: an Owner can remove the connector for the organization, and a role’s connector permission can hide it. | Sana from Workday connector listing, made by Workday · Get started with connectors · Manage custom roles on Enterprise plans |
ServiceNow in ChatGPT: ServiceNow, liveTwelve criteria, forty-one elements
| Criterion and grade | Element, and what it means | What is written | Page |
|---|---|---|---|
| 1 Door and status: documented. Employee-written technical articles on servicenow.com count as documentation, and the ChatGPT plan tier is graded under session terms. | (a) The assistant, named: which assistant reaches the application through this door, by name | Documented. In an article, a ServiceNow product manager names ChatGPT, and OpenAI’s plugin page lists ServiceNow as developer. | ITOM MCP Server is now in ChatGPT · ServiceNow plugin for ChatGPT |
| (b) Its status: in the vendor’s own word, such as live, beta, early access or announced | Documented. The product manager’s article says the connector is live in OpenAI’s marketplace as of October 28, 2026. | ITOM MCP Server is now in ChatGPT | |
| (c) Eligibility on the application side: the edition, region, role, geography or patch level the door requires | Documented. ServiceNow’s Action Fabric explainer requires a Now Assist SKU for the domain and Zurich Patch 9 or Australia Patch 2. | Action Fabric: MCP Server, MCP Client, and A2A explained | |
| 2 Identity: documented. | (a) Sign-in: how the person signs in to the application through the door | Documented. Users complete the OAuth sign-in with their own ServiceNow credentials, and OAuth 2.1 applies to every connection. | MCP Server Console FAQ · Action Fabric: MCP Server, MCP Client, and A2A explained |
| (b) The application user: how the person becomes an application user, with that user’s own role | Documented. Each request runs as the user, within that user’s permissions and ACLs. | ITOM MCP Server is now in ChatGPT | |
| (c) Shared identities: whether shared or app-to-app identities are allowed | Documented. ServiceNow writes service identities both ways: autonomous agents use a dedicated integration user, and the client-credentials grant is not supported for these connections. | MCP Server Console FAQ | |
| 3 Consent and scope: partly. ServiceNow’s own documents conflict on deleting, which holds the criterion at partly. | (a) Switching on: per-user consent or administrator enablement | Documented. An administrator registers every client by hand, and the customer picks the capabilities it enables. | MCP Server Console FAQ · ITOM MCP Server is now in ChatGPT |
| (b) What is barred: roles, tools or actions barred from the door | Documented. The administrator sets which tools and fields are exposed, and flows with approval steps are excluded. | Exploring MCP Server Console · MCP Server Console FAQ | |
| (c) Writing and deleting: whether tools that write or delete are exposed, and how they are limited | In part. ServiceNow exposes write tools under ACLs, but its explainer gives Scripted REST full create, read, update and delete, while its What’s New article bars DELETE and PATCH. One consistent answer is not stated in the documents searched, as of November 2, 2026. | ITOM MCP Server is now in ChatGPT · Action Fabric: MCP Server, MCP Client, and A2A explained · What’s New in MCP Server Console: From Skills to Full Platform Action | |
| 4 Approval of record: partly. ServiceNow’s own documents conflict on approvals, which holds the criterion at partly. | (a) Approval in the assistant: whether the application’s own approval can be given there | In part. ServiceNow says a flow with an approval step cannot run as an MCP tool, yet its explainer lets outside clients carry a workflow from submission through approval to confirmation. One consistent answer is not stated in the documents searched, as of November 2, 2026. | MCP Server Console FAQ · Action Fabric: MCP Server, MCP Client, and A2A explained |
| (b) The record: which system records the approval | Documented. ServiceNow keeps the record, and its release places each request on ServiceNow’s approval chain. | ServiceNow opens its full system of action to every AI Agent in the enterprise | |
| (c) The confirmation prompt: the assistant’s prompt before an action, and who controls it | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 5 Chained authority: partly. Segregation of duties as such is not stated in the documents searched, as of November 2, 2026. | (a) Checks that apply: whether segregation-of-duties or authorization checks apply to actions through the door | Documented. Tool calls stay within the signed-in user’s permissions and ServiceNow’s ACLs. | ITOM MCP Server is now in ChatGPT |
| (b) Control on chaining: any control on chaining several actions in one session | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Pattern or limit: any documented pattern or limit for chained work | Documented. ServiceNow’s product controls include hand registration, the approval-step exclusion, per-tool and per-field exposure, and a global pause of any client or server. | MCP Server Console FAQ · Exploring MCP Server Console · Action Fabric: MCP Server, MCP Client, and A2A explained | |
| 6 Reasoning place: partly. The ChatGPT plan is not stated in the documents searched, as of November 2, 2026, and the plan tier is graded under session terms. | (a) The lending pattern: tools lent to the assistant’s model, or an agent of the vendor’s own lent | Documented. ServiceNow lends tools over MCP: ChatGPT chooses the tool, ServiceNow sets what the tool may see and do, and ServiceNow runs the logic and checks. | ITOM MCP Server is now in ChatGPT |
| (b) Where it reasons: whose model reasons, where, and on whose infrastructure | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) The vendor’s assurance: whether the application vendor’s assurance covers that place, or where the vendor says its control ends | In part. The instance holds access control for each interaction, and AI Gateway covers MCP traffic alone, which draws a boundary. Where ServiceNow’s assurance stops is not stated in the documents searched, as of November 2, 2026. | MCP Server Console FAQ · Action Fabric: MCP Server, MCP Client, and A2A explained | |
| 7 Session terms: partly. | (a) Retention: how long the conversation is kept | Documented. OpenAI lets the admin set retention and purges data 30 days after deletion. | Enterprise privacy at OpenAI |
| (b) Residency and inference location: where the conversation is stored and processed, by plan tier | Documented. OpenAI offers residency for Enterprise and Edu, with apps excluded. | Data residency and inference residency for ChatGPT | |
| (c) Training use: whether the conversation trains a model | Documented. OpenAI writes that app data is not used for training on business plans by default. | Connected apps in ChatGPT | |
| (d) Zero data retention: whether it is offered for the conversation | Documented. OpenAI offers zero data retention for the API only. | Enterprise privacy at OpenAI | |
| (e) The plugin leg: whose terms cover the call between the assistant and the application | In part. OpenAI’s plugin page links ServiceNow’s privacy policy for the plugin leg, and the session is OpenAI’s. A ServiceNow handover is not stated in the documents searched, as of November 2, 2026. | ServiceNow plugin for ChatGPT | |
| (f) The plan tier: which plan tier of the assistant the door requires | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 8 Evidence: partly. | (a) The application-side log: whether one is kept, and what it records | Documented. AI Gateway ties each tool call to the agent, client and server behind it, with per-tool usage, latency, success and error figures, but ServiceNow recommends AI Gateway rather than requiring it. | MCP Server Console FAQ · Action Fabric: MCP Server, MCP Client, and A2A explained |
| (b) The assistant-side log: the assistant’s own log or compliance API | Documented. OpenAI’s Compliance Platform serves Enterprise and Edu workspaces. Which ChatGPT plan applies to this door is graded under session terms, 7(f). | OpenAI Compliance Platform for Enterprise and Edu customers | |
| (c) Retention: how long each log is kept | In part. OpenAI keeps compliance logs 30 days. The retention of the ServiceNow-side trace is not stated in the documents searched, as of November 2, 2026. | OpenAI Compliance Platform for Enterprise and Edu customers | |
| (d) Export: whether either log can be exported | Documented. ServiceNow says AI Gateway keeps an exportable audit history. | MCP Server Console FAQ | |
| 9 Meter: partly. A money value per assist is not stated in the documents searched, as of November 2, 2026, read as context and not graded. | (a) The application-side unit and rate: what the application charges for work through the door, and in what unit | In part. ServiceNow meters headless actions in assists like other AI work, on every call, as actions times an assist ratio, with per-run tiers in an employee’s post. Assists per outside MCP call are not stated in the documents searched, as of November 2, 2026. | ServiceNow opens its full system of action to every AI Agent in the enterprise · Action Fabric: MCP Server, MCP Client, and A2A explained · Monitoring Now Assist usage in Subscription Management · Best Practices in managing AI agents, skills, and assists in ServiceNow |
| (b) The assistant seat: whether a separate assistant seat is required, and who bills it | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 10 Way out: partly. | (a) Other routes: other assistants or clients documented for the same application | Documented. ServiceNow documents Moveworks, Copilot Studio, Claude, Bedrock or a custom agent, Gemini Enterprise, and a Claude connector it made. | Action Fabric: MCP Server, MCP Client, and A2A explained · ServiceNow and Google Cloud advance agentic AI for industry workflows · ServiceNow connector listing, made by ServiceNow |
| (b) Notice of change: notice of changes written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) What leaves: what leaves the session with the buyer | Documented. ServiceNow calls the AI Gateway history exportable, and its 2022 subscription agreement returns data within 45 days of termination, at platform level. | MCP Server Console FAQ · Subscription Service Agreement | |
| (d) Exit: any exit term written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 11 Reversal: partly. A conflict between ServiceNow’s own documents on deleting holds the criterion at partly. | (a) An undo for the door: whether an undo, rollback or reversal is written for actions taken through the door | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) Restore of deletions: whether a record deleted through the door can be restored, and for how long, or a statement that the door cannot delete | Documented. ServiceNow recovers a deleted record within seven days, but its explainer lists full create, read, update and delete for Scripted REST, while the What’s New article bars DELETE. | Roll back and delete recovery · Action Fabric: MCP Server, MCP Client, and A2A explained · What’s New in MCP Server Console: From Skills to Full Platform Action | |
| (c) The reversing process: the application’s own business process that reverses a completed transaction, such as voiding a payment | Documented. Canceling a catalog request also cancels purchase orders not yet received. | Cancel a request from the service catalog | |
| 12 Switching off: partly. ServiceNow’s own pages conflict on when a pause takes effect, which holds the criterion at partly. | (a) For everyone: how an administrator suspends, disables or removes the door, or revokes its access, for the whole organization | Documented. ServiceNow can pause all MCP servers or one, and deactivate a server. | AI Gateway · Create a Model Context Protocol server |
| (b) For one user or role: whether access through the door can be withdrawn from one user or role without closing it for everyone | Documented. ServiceNow lets single tokens be revoked. | Manage OAuth tokens | |
| (c) What ends: whether withdrawing access revokes the tokens already issued and ends open sessions, and if not, how long they stay valid | In part. Access tokens last 30 minutes by default, and a pause takes effect instantly or within 10 minutes, depending on the page. Whether a pause ends open sessions or issued tokens is not stated in the documents searched, as of November 2, 2026. | Manage OAuth tokens · Action Fabric: MCP Server, MCP Client, and A2A explained · AI Gateway Implementation Guide | |
| (d) On the assistant’s side: how the assistant’s administrator disables or blocks the app or connector | Documented. ChatGPT admins can disable the app. | Admin controls, security, and compliance for plugins and apps |
Dynamics 365 in Claude: Microsoft, generally available Dataverse endpointTwelve criteria, forty-one elements
| Criterion and grade | Element, and what it means | What is written | Page |
|---|---|---|---|
| 1 Door and status: documented. The Claude plan tier is graded under session terms, not here. | (a) The assistant, named: which assistant reaches the application through this door, by name | Documented. Microsoft Learn names Claude desktop and Claude Code as non-Microsoft clients of the Dataverse MCP server, and the ERP MCP server opens to any compatible agent platform. | Connect to Dataverse with model context protocol in non-Microsoft clients · Use Model Context Protocol for finance and operations apps |
| (b) Its status: in the vendor’s own word, such as live, beta, early access or announced | Documented. Dataverse runs a generally available endpoint beside a preview one. | Connect to Dataverse with model context protocol FAQ | |
| (c) Eligibility on the application side: the edition, region, role, geography or patch level the door requires | Documented. The client needs an Entra app registration with the mcp.tools permission, on the environment’s allowed-clients list. | Connect to Dataverse with model context protocol in non-Microsoft clients | |
| 2 Identity: documented. | (a) Sign-in: how the person signs in to the application through the door | Documented. The client is an Entra app registration with the mcp.tools permission on the allowed-clients list, and the user signs in through Entra. | Connect to Dataverse with model context protocol in non-Microsoft clients |
| (b) The application user: how the person becomes an application user, with that user’s own role | Documented. The Dataverse server applies Dataverse security roles and row-level security, and the ERP server filters what it returns by the user’s security role. | Connect to Dataverse with model context protocol in non-Microsoft clients · Use Model Context Protocol for finance and operations apps | |
| (c) Shared identities: whether shared or app-to-app identities are allowed | Documented. Microsoft writes agent identities separately: an agent can hold a System agent role that grants no permissions, and Entra Agent ID logs all agent sign-ins. | Use Model Context Protocol for finance and operations apps · What is Microsoft Entra Agent ID? Microsoft Learn, June 24 | |
| 3 Consent and scope: documented. | (a) Switching on: per-user consent or administrator enablement | Documented. Admins enable a client through app registration and the allowed-clients list, and users work under their security roles. | Connect to Dataverse with model context protocol in non-Microsoft clients |
| (b) What is barred: roles, tools or actions barred from the door | Documented. The ERP server keeps the separation-of-duties and user role assignment forms out of reach, and rejects calls outside the user’s role. | Use Model Context Protocol for finance and operations apps | |
| (c) Writing and deleting: whether tools that write or delete are exposed, and how they are limited | Documented. Dataverse exposes write tools and the delete tools delete_record and delete_table, each run only after explicit user approval, and ERP tools are filtered by role. | Connect to Dataverse with Model Context Protocol · Use Model Context Protocol for finance and operations apps | |
| 4 Approval of record: partly. A confirmation prompt never counts as an approval of record. | (a) Approval in the assistant: whether the application’s own approval can be given there | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) The record: which system records the approval | Documented. Dynamics 365 runs each call under the user’s security role and keeps the record. | Connect to Dataverse with model context protocol in non-Microsoft clients | |
| (c) The confirmation prompt: the assistant’s prompt before an action, and who controls it | Documented. Microsoft writes the confirmation per tool, with the Dataverse delete tools running only after explicit user approval, as a November 3, 2026 re-read confirmed. | Connect to Dataverse with Model Context Protocol | |
| 5 Chained authority: partly. A segregation-of-duties check across a session is not stated in the documents searched, as of November 2, 2026. | (a) Checks that apply: whether segregation-of-duties or authorization checks apply to actions through the door | Documented. Security roles and row-level security apply, and the ERP server filters by role and keeps the separation-of-duties configuration form out of reach. | Connect to Dataverse with model context protocol in non-Microsoft clients · Use Model Context Protocol for finance and operations apps |
| (b) Control on chaining: any control on chaining several actions in one session | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) Pattern or limit: any documented pattern or limit for chained work | Documented. Microsoft’s product controls include the allowed-clients list, the excluded forms, per-tool approval and an agent role that grants no permissions. | Connect to Dataverse with model context protocol in non-Microsoft clients · Connect to Dataverse with Model Context Protocol · Use Model Context Protocol for finance and operations apps | |
| 6 Reasoning place: partly. The Claude plan is not stated in the documents searched, as of November 2, 2026, the non-Microsoft clients page included on a re-read of November 3, 2026, and the plan tier is graded under session terms. | (a) The lending pattern: tools lent to the assistant’s model, or an agent of the vendor’s own lent | Documented. Microsoft lends tools over MCP, and the ERP page places the cost of the LLM orchestration with the agent client, so the reasoning is the client’s. | Use Model Context Protocol for finance and operations apps |
| (b) Where it reasons: whose model reasons, where, and on whose infrastructure | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (c) The vendor’s assurance: whether the application vendor’s assurance covers that place, or where the vendor says its control ends | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 7 Session terms: partly. | (a) Retention: how long the conversation is kept | Documented. Anthropic keeps data indefinitely unless an Enterprise retention period is set. | Configure custom data retention controls for Enterprise plans |
| (b) Residency and inference location: where the conversation is stored and processed, by plan tier | Documented. Anthropic stores data in the United States, routed to several regions. | Where are your servers located? Do you host your models on EU servers? Anthropic Privacy Center | |
| (c) Training use: whether the conversation trains a model | Documented. Anthropic’s commercial terms rule out training on customer content. | Commercial Terms of Service | |
| (d) Zero data retention: whether it is offered for the conversation | Documented. Anthropic offers zero data retention only outside the Claude app. | I have a zero data retention agreement with Anthropic | |
| (e) The plugin leg: whose terms cover the call between the assistant and the application | In part. Dataverse use is charged or exempt by license, and Microsoft’s Purview page covers Claude Enterprise as an AI app. A handover by Microsoft is not stated in the documents searched, as of November 2, 2026. | Connect to Dataverse with Model Context Protocol · Microsoft Purview data security and compliance protections for Microsoft 365 Copilot and other generative AI apps | |
| (f) The plan tier: which plan tier of the assistant the door requires | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 8 Evidence: partly. | (a) The application-side log: whether one is kept, and what it records | In part. Entra Agent ID logs all agent sign-ins and activity, and Purview audits Copilot and AI applications. A Dataverse log of MCP calls from Claude, and what Dynamics 365 records per tool call, are not stated in the documents searched, as of November 2, 2026. | What is Microsoft Entra Agent ID? Microsoft Learn, June 24 · Audit logs for Copilot and AI applications |
| (b) The assistant-side log: the assistant’s own log or compliance API | Documented. Anthropic keeps audit logs for Enterprise plans only. Which Claude plan applies to this door is graded under session terms, 7(f). | Access audit logs | |
| (c) Retention: how long each log is kept | In part. Anthropic’s audit logs cover 180 days. The retention of the Dynamics 365 record is not stated in the documents searched, as of November 2, 2026. | Access audit logs | |
| (d) Export: whether either log can be exported | In part. Anthropic offers export through the Compliance API. Export of the Dynamics 365 record is not stated in the documents searched, as of November 2, 2026. | Access the Compliance API | |
| 9 Meter: documented. Copilot Credits sell at USD 200 per 25,000, read as context, and the seat, not its tier, is graded here. | (a) The application-side unit and rate: what the application charges for work through the door, and in what unit | Documented. The ERP server charges one Copilot Credit per 10 tool calls from other agent clients, and Dataverse tools are charged for agents outside Copilot Studio, with Premium and Copilot licenses exempt. | Use Model Context Protocol for finance and operations apps · Connect to Dataverse with Model Context Protocol |
| (b) The assistant seat: whether a separate assistant seat is required, and who bills it | Documented. The agent client bills its own token use, so a client subscription is written. | Use Model Context Protocol for finance and operations apps | |
| 10 Way out: partly. | (a) Other routes: other assistants or clients documented for the same application | Documented. The ERP server serves any compatible agent platform, and the non-Microsoft clients page names Claude desktop and Claude Code. | Use Model Context Protocol for finance and operations apps · Connect to Dataverse with model context protocol in non-Microsoft clients |
| (b) Notice of change: notice of changes written for the door | In part. The ERP page dated its static server’s retirement to October 1, 2026, and Dataverse runs a preview endpoint beside the generally available one. Notice of model or terms changes is not stated in the documents searched, as of November 2, 2026. | Use Model Context Protocol for finance and operations apps · Connect to Dataverse with model context protocol FAQ | |
| (c) What leaves: what leaves the session with the buyer | Not stated in the documents searched, as of November 2, 2026. | None found | |
| (d) Exit: any exit term written for the door | Not stated in the documents searched, as of November 2, 2026. | None found | |
| 11 Reversal: partly. Microsoft’s own pages conflict on the restore window, which holds the criterion at partly. | (a) An undo for the door: whether an undo, rollback or reversal is written for actions taken through the door | Not stated in the documents searched, as of November 2, 2026. | None found |
| (b) Restore of deletions: whether a record deleted through the door can be restored, and for how long, or a statement that the door cannot delete | In part. Dataverse restores deleted records kept 1 to 90 days, if enabled beforehand, while a developer page says up to 30 days. A restore after the ERP server’s delete tool is not stated in the documents searched, as of November 2, 2026. | Restore deleted Microsoft Dataverse table records · Restore deleted records with code · Use Model Context Protocol for finance and operations apps | |
| (c) The reversing process: the application’s own business process that reverses a completed transaction, such as voiding a payment | Documented. Dynamics 365 Finance reverses a vendor payment, which Microsoft keeps distinct from deleting, voiding or rejecting it. | Reverse a vendor payment | |
| 12 Switching off: partly. | (a) For everyone: how an administrator suspends, disables or removes the door, or revokes its access, for the whole organization | In part. Clearing a setting turns off the Dataverse MCP server and its dependent tools, and the app’s admin consent can be revoked in Entra, though users may consent again. The ERP switch-off is not stated in the documents searched, as of November 2, 2026. | Configure the Dataverse model context protocol (MCP) server · Review permissions granted to enterprise applications |
| (b) For one user or role: whether access through the door can be withdrawn from one user or role without closing it for everyone | In part. Security roles govern every channel alike. A per-user withdrawal is not stated in the documents searched, as of November 2, 2026. | Security for Dynamics 365 ERP MCP | |
| (c) What ends: whether withdrawing access revokes the tokens already issued and ends open sessions, and if not, how long they stay valid | In part. Disabling the Dataverse server interrupts work in progress. What happens to issued tokens is not stated in the documents searched, as of November 2, 2026. | Configure the Dataverse model context protocol (MCP) server | |
| (d) On the assistant’s side: how the assistant’s administrator disables or blocks the app or connector | In part. Claude Code admins can deny the server. The control in Claude desktop is not stated in the documents searched, as of November 2, 2026. | Control MCP server access for your organization |
Sources And References: Every Document Behind Every Claim
Every fact, figure, and quotation in this research note traces to one of the sources below, presented in Harvard reference format and grouped by class. Each source is also linked in the sentence that carries it. Oracle’s, OpenAI’s and each other vendor’s documents are that company’s account of itself and prove what the company said rather than that the thing is true. Transcripts marked third-party are not the company’s own record. Standing pages that carry no publication date are marked n.d. All sources were accessed between October 26 and November 5, 2026.
Oracle announcements
Oracle Corporation (2026a) Oracle Extends Fusion Agentic Applications with Introduction of Fusion Claw. Press release, September 29. Available at: https://www.oracle.com/news/announcement/oracle-extends-fusion-agentic-applications-with-introduction-of-fusion-claw-2026-09-29/
Oracle Corporation (2026b) Oracle Introduces New AI-Powered Ways to Execute Work Across Oracle Fusion Applications. Press release, October 26. Available at: https://www.oracle.com/news/announcement/ai-world-oracle-introduces-new-ai-powered-ways-to-execute-work-across-oracle-fusion-applications-2026-10-26/
Oracle Corporation (2026c) Oracle Reinvents Enterprise Computing for the AI Era with OpenAI. Press release, October 27. Available at: https://www.oracle.com/news/announcement/ai-world-oracle-reinvents-enterprise-computing-for-the-ai-era-with-openai-2026-10-27/
Oracle Corporation (2026d) Oracle Advances Enterprise Security for the AI Era. Press release, October 27. Available at: https://www.oracle.com/news/announcement/ai-world-oracle-advances-enterprise-security-for-the-ai-era-2026-10-27/
Oracle Corporation (2026e) NVIDIA and Oracle Expand NVIDIA Vera Rubin to Multi-Gigawatt Scale and Bring NVIDIA Vera CPU to Oracle Cloud Infrastructure. Press release, October 27. Available at: https://www.oracle.com/news/announcement/ai-world-nvidia-and-oracle-expand-nvidia-vera-rubin-to-multi-gigawatt-scale-2026-10-27/
Oracle NetSuite (2026) NetSuite Introduces SuiteSkills to Give AI Comprehensive Business Expertise. Press release, October 26. Available at: https://www.netsuite.com/portal/company/newsroom/netsuite-introduces-suiteskills-to-give-ai-comprehensive-business-expertise.shtml
Oracle product pages and blogs
Acosta, J. (2026) Introducing Oracle AI Security Mesh: Put AI to work finding your hidden security gaps. Oracle Blogs, October 27. Available at: https://blogs.oracle.com/ai-and-datascience/introducing-oracle-ai-security-mesh
Bozada, B. (2026) Announcing Oracle App Composer: Go from ideas to governed applications. Oracle Blogs, October 27. Available at: https://blogs.oracle.com/cloud-infrastructure/announcing-oracle-app-composer
Meng, M. (2026) Introducing Oracle AI Workspace: Put AI to work across your enterprise. Oracle Blogs, October 27. Available at: https://blogs.oracle.com/ai-and-datascience/introducing-oracle-ai-workspace
Oracle Corporation (2026f) Fusion AI Agents: Secure by Enforcement Best-Practice Considerations. Oracle Blogs, July 29. Available at: https://blogs.oracle.com/cloud-infrastructure/fusion-ai-agents-secure-by-enforcement
Oracle Corporation (n.d.a) OpenAI models through the API, listing made by OpenAI. Oracle Cloud Marketplace listing. Available at: https://marketplace.oracle.com/listings/openai-models-through-the-api/ocid1.mktpublisting.oc1.iad.amaaaaaat6luqayaioshepuwn3tfmutyeaxu2gddgne5nnpqcugffqcxwhfq
Oracle Corporation (n.d.b) Oracle AI Workspace. Product page, updated October 27, 2026. Available at: https://www.oracle.com/artificial-intelligence/workspace/
Oracle Corporation (n.d.c) Oracle and OpenAI. Product page, updated October 27, 2026. Available at: https://www.oracle.com/artificial-intelligence/oracle-openai/
Oracle Corporation (n.d.d) Access OpenAI services with Oracle Universal Credits. Product page, updated August 7, 2026. Available at: https://www.oracle.com/artificial-intelligence/openai/
Oracle Corporation (n.d.e) Oracle AI SMB Bundle. Product page, updated October 28, 2026. Available at: https://www.oracle.com/artificial-intelligence/smb-bundle/
Tiao, S. (2026) Oracle and OpenAI: Put frontier AI to work for your business. Oracle Blogs, October 27. Available at: https://blogs.oracle.com/ai-and-datascience/oracle-openai
Oracle documentation and contracts
Oracle Corporation (2026g) Oracle Fusion Service Descriptions. Contract document, effective October 20. Available at: https://oracle.com/contracts/docs/oracle-fusion-cloud-service-desc-1843611.pdf
Oracle Corporation (2026h) How do I use AI Agent Studio? Release 26D, G59779-05. Oracle Help Center, November 2. Available at: https://docs.oracle.com/en/cloud/saas/fusion-ai/26d/aiaas/index.html
Oracle Corporation (2026i) Can I access agent teams from applications outside of Fusion Applications? Oracle AI for Fusion Applications Questions and Answers, Oracle Help Center, September 22. Available at: https://docs.oracle.com/en/cloud/saas/fusion-ai/aiaqa/can-i-access-agent-teams-from-applications-outside-of-fusion-applications.html
Oracle Corporation (2026j) Access Oracle Fusion Data Intelligence MCP Server (Preview). Release 26R3, Oracle Help Center, October 1. Available at: https://docs.oracle.com/en/cloud/saas/analytics/26r3/fawag/access-oracle-fusion-data-intelligence-mcp-server-preview.html
Oracle Corporation (n.d.f) Where are the locations of the OpenAI endpoints for AI agents in Fusion Applications? Oracle AI for Fusion Applications Questions and Answers, Oracle Help Center. Available at: https://docs.oracle.com/en/cloud/saas/fusion-ai/aiaqa/where-are-the-locations-of-the-openai-endpoints-for-ai-agents-in-fusion-applications.html
Oracle Corporation (n.d.g) Supplier Registration Process. Using Procurement, Release 26D, Oracle Help Center. Available at: https://docs.oracle.com/en/cloud/saas/procurement/26d/oaprc/supplier-registration-process.html
Oracle Corporation (n.d.h) How Payment Approval Is Processed. Using Payables Invoice to Pay, Release 26D, Oracle Help Center. Available at: https://docs.oracle.com/en/cloud/saas/financials/26d/fappp/how-payment-approval-is-processed.html
Oracle Corporation (n.d.i) Void Payment or Payment File. Using Payables Invoice to Pay, Release 26D, Oracle Help Center. Available at: https://docs.oracle.com/en/cloud/saas/financials/26d/fappp/void-payment-or-payment-file.html
Oracle Corporation (n.d.j) Overview of Oracle Advanced Controls. Using Advanced Controls, Release 26C, Oracle Help Center. Available at: https://docs.oracle.com/en/cloud/saas/risk-management-and-compliance/26c/faacm/overview-of-oracle-advanced-controls.html
Oracle Corporation (n.d.k) Set Up Auditing for Oracle Fusion Applications. Implementing Applications, Release 26D, Oracle Help Center. Available at: https://docs.oracle.com/en/cloud/saas/applications-common/26d/facia/set-up-auditing-for-oracle-fusion-applications.html
Oracle NetSuite (n.d.a) NetSuite AI Connector Service FAQ. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_4160616848.html
Oracle NetSuite (n.d.b) Available Tools in the MCP Standard Tools SuiteApp. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_0902023508.html
Oracle NetSuite (n.d.c) Associated Risks, Controls, and Mitigation Strategies. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_9002708453.html
Oracle NetSuite (n.d.d) Record Action Tools. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_98151918001.html
Oracle NetSuite (n.d.e) Connect to the NetSuite AI Connector Service. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_0714082142.html
Oracle NetSuite (n.d.f) Record Tools. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_0905122629.html
Oracle NetSuite (n.d.g) REST Web Services Supported Records. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_1558962745.html
Oracle NetSuite (n.d.h) Vendor Bill Approvals. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N2373552.html
Oracle NetSuite (n.d.i) Custom Workflow-Based Approvals for Vendor Payments. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1554290907.html
Oracle NetSuite (n.d.j) Audit Enablement. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4604128838.html
Oracle NetSuite (n.d.k) System Notes Overview. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_158644279544.html
Oracle NetSuite (n.d.l) Voiding, Deleting, or Closing Transactions. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N563543.html
Oracle NetSuite (n.d.m) Inactivating Vendor Records. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4443201053.html
Oracle NetSuite (n.d.n) Canceling and Voiding Payments. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_0805062605.html
Oracle NetSuite (n.d.o) Get Started. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_3200541651.html
Oracle NetSuite (n.d.p) MCP Standard Tools SuiteApp. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_143403258.html
Oracle NetSuite (n.d.q) NetSuite AI Connector Service And Concurrency Governance. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_0827103226.html
Oracle NetSuite (n.d.r) Required Features and Permissions. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_0714080625.html
Oracle NetSuite (n.d.s) Step Two POST Request to the Token Endpoint. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_158081952044.html
Oracle NetSuite (n.d.t) Viewing and Revoking OAuth 2.0 Authorized Applications. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157960925955.html
Oracle NetSuite (n.d.u) Voiding a Check. NetSuite Help Center. Available at: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_3951602420.html
Oracle investor day
Oracle Corporation (2026k) Redefining Enterprise Applications for the Age of AI. Investor Day presentation by Chris Leone, October 28. Available at: https://s23.q4cdn.com/440135859/files/doc_downloads/2026/10/Oracle-Investor-Day-Meeting/3-Chris_Wednesday-AM.pdf
StockAnalysis (2026) Oracle (ORCL) Transcript: Investor Day 2026. Third-party transcript, October 28. Available at: https://stockanalysis.com/stocks/orcl/transcripts/780561-investor-day-2026/
OpenAI
OpenAI (2026a) OpenAI expands partnership with Oracle to bring its apps to ChatGPT. Announcement, October 27. Available at: https://openai.com/index/oracle-apps-in-chatgpt/
OpenAI (2026b) Access OpenAI models and Codex through your Oracle cloud commitment. Announcement, June 10, updated August 7. Available at: https://openai.com/index/openai-on-oracle-cloud/
OpenAI (2026c) OpenAI and ServiceNow expand partnership across enterprise workflows. Announcement, October 28. Available at: https://openai.com/index/openai-servicenow-partnership-expansion/
OpenAI (2026d) Enterprise privacy at OpenAI. Trust page, updated January 8. Available at: https://openai.com/enterprise-privacy/
OpenAI (2026e) Connected apps in ChatGPT. OpenAI Help Center, updated about October 28. Available at: https://help.openai.com/en/articles/11487775-connected-apps-in-chatgpt
OpenAI (2026f) Data residency and inference residency for ChatGPT. OpenAI Help Center, updated about October 21. Available at: https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt
OpenAI (2026g) Where your ChatGPT Business content is stored. OpenAI Help Center, updated about October 22. Available at: https://help.openai.com/en/articles/20001418-where-your-chatgpt-business-content-is-stored
OpenAI (2026h) Admin controls, security, and compliance for plugins and apps. OpenAI Help Center, updated about October 30. Available at: https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-for-plugins-and-apps
OpenAI (2026i) OpenAI Compliance Platform for Enterprise and Edu customers. OpenAI Help Center, updated November 2. Available at: https://help.openai.com/en/articles/9261474-openai-compliance-platform-for-enterprise-and-edu-customers
OpenAI (2026j) ChatGPT Business release notes. OpenAI Help Center, updated about October 31. Available at: https://help.openai.com/en/articles/11391654-chatgpt-business-release-notes
OpenAI (n.d.a) OpenAI and Oracle partnership. Partner page. Available at: https://openai.com/business/partners/oracle/
OpenAI (n.d.b) NetSuite plugin for ChatGPT. Plugin page. Available at: https://openai.com/business/plugins/netsuite/
OpenAI (n.d.c) Business data privacy, security, and compliance. Trust page. Available at: https://openai.com/business-data/
OpenAI (n.d.d) ChatGPT Work cloud security. ChatGPT Learn. Available at: https://learn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-security
OpenAI (n.d.e) Build an MCP server. OpenAI Developers, plugins documentation. Available at: https://developers.openai.com/plugins/build/mcp-server
OpenAI (n.d.f) ServiceNow plugin for ChatGPT. Plugin page. Available at: https://openai.com/business/plugins/servicenow/
Other model companies
Anthropic (2025) Commercial Terms of Service. Effective June 17. Available at: https://www.anthropic.com/legal/commercial-terms
Anthropic (2026a) Developing Enterprise Frontier Safeguards with our customers. Announcement, September 1. Available at: https://www.anthropic.com/news/enterprise-frontier-safeguards
Anthropic (2026b) Use Salesforce in Claude. Claude Help Center, September 25. Available at: https://support.claude.com/en/articles/16952186-use-salesforce-in-claude
Anthropic (n.d.a) I have a zero data retention agreement with Anthropic. What products does it apply to? Anthropic Privacy Center. Available at: https://privacy.claude.com/en/articles/8956058-i-have-a-zero-data-retention-agreement-with-anthropic-what-products-does-it-apply-to
Anthropic (n.d.b) Use connectors to extend Claude’s capabilities. Claude Help Center. Available at: https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities
Anthropic (n.d.c) NetSuite connector listing, made by Oracle NetSuite. Claude connectors directory, added November 2025. Available at: https://claude.com/es/connectors/oracle-netsuite
Anthropic (n.d.d) Sana from Workday connector listing, made by Workday. Claude connectors directory, added October 2026. Available at: https://claude.com/marketplace/connectors/workday
Anthropic (n.d.e) Access audit logs. Claude Help Center. Available at: https://support.claude.com/en/articles/9970975-access-audit-logs
Anthropic (n.d.f) Access the Compliance API. Claude Help Center. Available at: https://support.claude.com/en/articles/13015708-access-the-compliance-api
Anthropic (n.d.g) Configure custom data retention controls for Enterprise plans. Anthropic Privacy Center. Available at: https://privacy.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans
Anthropic (n.d.h) Control MCP server access for your organization. Claude Code documentation. Available at: https://code.claude.com/docs/en/managed-mcp.md
Anthropic (n.d.i) Get started with connectors. Claude documentation. Available at: https://claude.com/docs/connectors/getting-started
Anthropic (n.d.j) How long do you store my organization’s data? Anthropic Privacy Center. Available at: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data
Anthropic (n.d.k) List activities. Compliance API reference, Claude Platform Docs, API version 2026-10-21. Available at: https://platform.claude.com/docs/en/api/compliance/activities/list
Anthropic (n.d.l) Manage custom roles on Enterprise plans. Claude Help Center, updated over a week before it was read on November 5, 2026. Available at: https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plans
Anthropic (n.d.m) ServiceNow connector listing, made by ServiceNow. Claude connectors directory. Available at: https://claude.com/marketplace/connectors/servicenow
Anthropic (n.d.n) Where are your servers located? Do you host your models on EU servers? Anthropic Privacy Center. Available at: https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers
Google (n.d.) Connect Your Agentforce Sales Agent to Gemini Enterprise. Google Codelabs. Available at: https://codelabs.developers.google.com/agentforce-sales-setup
Google Cloud (2026a) Gemini Enterprise Salesforce connector: Overview. Google Cloud Documentation, last updated October 30. Available at: https://docs.cloud.google.com/gemini/enterprise/docs/connectors/salesforce
Google Cloud (2026b) Configure the assistant. Gemini Enterprise, Google Cloud Documentation, last updated October 28. Available at: https://docs.cloud.google.com/gemini/enterprise/docs/configure-assistant
Other application vendors
Microsoft (2025a) Accounts payable home page. Dynamics 365 Finance, Microsoft Learn, last updated August 27. Available at: https://learn.microsoft.com/en-us/dynamics365/finance/accounts-payable/accounts-payable
Microsoft (2025b) Set up segregation of duties. Finance and operations apps, Microsoft Learn, last updated November 26. Available at: https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/fin-ops/sysadmin/set-up-segregation-duties
Microsoft (2025c) Review permissions granted to enterprise applications. Microsoft Entra ID, Microsoft Learn, last updated March 6. Available at: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions
Microsoft (2026a) The next phase of the Microsoft-OpenAI partnership. Official Microsoft Blog, April 27. Available at: https://blogs.microsoft.com/blog/2026/04/27/the-next-phase-of-the-microsoft-openai-partnership/
Microsoft (2026b) Microsoft Fiscal Year 2027 First Quarter Earnings Conference Call. Microsoft Investor Relations, October 28. Available at: https://www.microsoft.com/en-us/investor/events/fy-2027/earnings-fy-2027-q1
Microsoft (2026c) Use Model Context Protocol for finance and operations apps. Microsoft Learn, last updated August 19. Available at: https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/copilot/copilot-mcp
Microsoft (2026d) Connect to Dataverse with Model Context Protocol. Microsoft Learn, last updated June 5. Available at: https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp
Microsoft (2026e) Confirmation prompts for MCP and API plugins for Microsoft 365 Copilot. Microsoft Learn, last updated July 16. Available at: https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-confirmation-prompts
Microsoft (2026f) Choose an external model as the primary AI model. Microsoft Copilot Studio, Microsoft Learn, last updated August 3. Available at: https://learn.microsoft.com/microsoft-copilot-studio/authoring-select-external-response-model
Microsoft (2026g) Microsoft Copilot Studio Plans and Pricing. Microsoft, undated, read November 2. Available at: https://www.microsoft.com/en-us/copilot/pricing/copilot-studio
Microsoft (2026h) Connect to Dataverse with model context protocol FAQ. Microsoft Learn, last updated June 5. Available at: https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-faq
Microsoft (2026i) Automate vendor payment proposals. Dynamics 365 Finance, Microsoft Learn, last updated August 4. Available at: https://learn.microsoft.com/en-us/dynamics365/finance/accounts-payable/automate-vendor-payment-proposal
Microsoft (2026j) Configure database logging. Finance and operations apps, Microsoft Learn, last updated March 14. Available at: https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/sysadmin/configure-manage-database-log
Microsoft (2026k) Restore deleted Microsoft Dataverse table records. Power Platform, Microsoft Learn, last updated October 29. Available at: https://learn.microsoft.com/en-us/power-platform/admin/restore-deleted-table-records
Microsoft (2026l) Reverse a vendor payment. Dynamics 365 Finance, Microsoft Learn, last updated July 20. Available at: https://learn.microsoft.com/en-us/dynamics365/finance/accounts-payable/reverse-vendor-payment
Microsoft (2026m) Audit logs for Copilot and AI applications. Microsoft Purview, Microsoft Learn, August 26. Available at: https://learn.microsoft.com/en-us/purview/audit-copilot
Microsoft (2026n) Configure the Dataverse model context protocol (MCP) server. Microsoft Learn, last updated June 5. Available at: https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-disable
Microsoft (2026o) Connect to Dataverse with model context protocol in non-Microsoft clients. Microsoft Learn, last updated June 5. Available at: https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-other-clients
Microsoft (2026p) Data, Privacy, and Security for Microsoft Copilot. Microsoft Learn, ms.date July 9. Available at: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
Microsoft (2026q) Governance and lifecycle actions for agents available in Microsoft 365 admin center. Microsoft Learn, last updated October 23. Available at: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-actions
Microsoft (2026r) Microsoft Purview data security and compliance protections for Microsoft 365 Copilot and other generative AI apps. Microsoft Learn, May 27. Available at: https://learn.microsoft.com/en-us/purview/ai-microsoft-purview
Microsoft (2026s) Restore deleted records with code. Microsoft Learn, last updated April 21. Available at: https://learn.microsoft.com/en-us/power-apps/developer/data-platform/restore-deleted-records
Microsoft (2026t) Security for Dynamics 365 ERP MCP. Microsoft Learn, last updated August 19. Available at: https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/copilot/mcp/mcp-security
Microsoft (2026u) Understand agent details in Microsoft 365 admin center. Microsoft Learn, last updated October 23. Available at: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-details
Microsoft (2026v) What is Microsoft Entra Agent ID? Microsoft Learn, June 24. Available at: https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id
Microsoft (n.d.) Microsoft Data Management. Microsoft Trust Center. Available at: https://www.microsoft.com/en-us/trust-center/privacy/data-management
Salesforce (2023) Main Services Agreement. October 16. Available at: https://salesforce.com/company/msa.jsp
Salesforce (2026a) Salesforce and Anthropic Announce Claudeforce: The #1 AI Meets the #1 AI CRM. Investor release, August 26. Available at: https://investor.salesforce.com/news/news-details/2026/Salesforce-and-Anthropic-Announce-Claudeforce-The-1-AI-Meets-the-1-AI-CRM/default.aspx
Salesforce (2026b) The #1 AI CRM Meets ChatGPT. Press release, January 7. Available at: https://www.salesforce.com/ap/news/press-releases/2026/01/07/the-1-ai-crm-meets-chatgpt/
Salesforce (2026c) Flex Credits Rate Card. Rate card, August 31. Available at: https://www.salesforce.com/en-us/wp-content/uploads/sites/4/assets/pdf/agentforce/Flex-Credits-Rate-Card-08.31.2026.pdf
Salesforce (2026d) Product Terms Directory. Effective November 2. Available at: https://ptd.salesforce.com
Salesforce (2026e) New Salesforce Editions Bundle Everything Businesses Need for Agentic Transformation. Announcement, September 3. Available at: https://www.salesforce.com/news/stories/salesforce-simplifies-editions-2026/
Salesforce (2026f) Einstein Platform / Agentforce Security, Privacy and Architecture. July 24. Available at: https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/misc/einstein-platform-security-privacy-and-architecture.pdf?bc=OTH
Salesforce (2026g) Agentforce pricing. Salesforce, undated, read November 2. Available at: https://www.salesforce.com/agentforce/pricing/
Salesforce (2026h) Headless 360 MCP Server (Beta). Salesforce Developers, available from July 2026. Available at: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/headless-360-mcp.html
Salesforce (2026i) Field Audit Trail. Field Audit Trail Implementation Guide, Salesforce Developers, Summer ‘26. Available at: https://developer.salesforce.com/docs/atlas.en-us.field_history_retention.meta/field_audit_trail.htm
Salesforce (2026j) Access Salesforce Context Without Leaving Claude (Beta). Salesforce Release Notes, updated the week of October 19. Available at: https://help.salesforce.com/s/articleView?id=release-notes.rn_salesforce_in_claude.htm&language=en_US&release=264&type=5
Salesforce (n.d.a) Supported Models. Salesforce Developers. Available at: https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html
Salesforce (n.d.b) Set Tool Restrictions for the Salesforce MCP Server. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=ai.set_tool_restrictions.htm&type=5
Salesforce (n.d.c) Large Language Model Support. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=ai.generative_ai_large_language_model_support.htm&type=5
Salesforce (n.d.d) Security and Governance in Headless Experiences. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=platform.aif_governance.htm&type=5
Salesforce (n.d.e) View, Restore, and Manage Items in the Recycle Bin in Salesforce Classic. Salesforce Help. Available at: https://help.salesforce.com/apex/HTViewHelpDoc?id=home_delete.htm
Salesforce (n.d.f) About Claudeforce. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=platform.what_is_claudeforce.htm&type=5
Salesforce (n.d.g) Activate the MCP Server. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=ai.activate_the_mcp_server.htm&type=5
Salesforce (n.d.h) Connecting an MCP Client. Salesforce Developers. Available at: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/client-connection-overview.html
Salesforce (n.d.i) Delete an External Client App. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=xcloud.delete_an_external_client_app.htm&language=en_US&type=5
Salesforce (n.d.j) How Record Creation and Updates Work in Salesforce in Claude (Beta). Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=sales.salesforce_in_claude_record_crud.htm&type=5
Salesforce (n.d.k) Legal and Ethical Considerations with Headless Functionality. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=platform.aif_considerations.htm&type=5
Salesforce (n.d.l) Manage External Client App OAuth Usage. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=xcloud.manage_external_client_app_usage.htm&language=en_US&type=5
Salesforce (n.d.m) Revoke All JSON Web Token (JWT)-Based Access Tokens. Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_revoke_jwt.htm&language=en_US&type=5
Salesforce (n.d.n) Salesforce Hosted MCP Servers. Salesforce Developers. Available at: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/hosted-mcp-servers-overview.html
Salesforce (n.d.o) What Is Salesforce in Claude (Beta). Salesforce Help. Available at: https://help.salesforce.com/s/articleView?id=sales.what_is_salesforce_in_claude.htm&type=5
SAP (2025) Enable Microsoft Copilot and Teams to Pass Requests to Joule. SAP Community, May 30. Available at: https://community.sap.com/t5/technology-blog-posts-by-sap/enable-microsoft-copilot-and-teams-to-pass-requests-to-joule/ba-p/14109137
SAP (2026a) Agentic AI & AI Agents on SAP Business AI Platform. SAP Architecture Center, last updated October 26. Available at: https://architecture.learning.sap.com/docs/ref-arch/98efa0
SAP (2026b) Joule Feature Scope Description, version 3.0.0. SAP Help Portal, May 5. Available at: https://help.sap.com/doc/0a1c2b2b16f843dca835b44a5db033be/CLOUD/en-US/Joule_FSD.pdf
SAP (2026c) Integrating and Extending Joule, SAP’s AI Copilot. SAP Architecture Center, last updated March 16. Available at: https://architecture.learning.sap.com/docs/ref-arch/464deb
SAP (2026d) SAP API Policy v.4.2026a. SAP Help Portal. Available at: https://help.sap.com/doc/sap-api-policy/latest/en-US/API_Policy_latest.pdf
SAP (n.d.a) Responsible AI. Available at: https://www.sap.com/products/artificial-intelligence/ai-ethics.html
SAP (n.d.b) SAP Business AI packages and pricing. Available at: https://www.sap.com/products/artificial-intelligence/pricing.html
SAP (n.d.c) Bi-directional integration between Joule and Microsoft 365 Copilot. Product page, global edition. Available at: https://www.sap.com/products/artificial-intelligence/joule-joule-and-microsoft-365-copilot.html
SAP (n.d.d) Bi-directional integration between Joule and Microsoft 365 Copilot. Product page, Norway edition. Available at: https://www.sap.com/norway/products/artificial-intelligence/joule-joule-and-microsoft-365-copilot.html
SAP (n.d.e) Integrating Joule with Microsoft 365 Copilot. Integrating Joule with SAP Solutions, SAP Help Portal. Available at: https://help.sap.com/docs/joule/integrating-joule-with-sap/integrating-joule-with-microsoft-365-copilot
SAP (n.d.f) Using Joule with Microsoft 365 Copilot. What is Joule, SAP Help Portal. Available at: https://help.sap.com/docs/joule/serviceguide/using-joule-with-microsoft-365-copilot
SAP (n.d.g) Roles and Authorizations for Joule with Microsoft 365 Copilot/Microsoft Teams. What is Joule, SAP Help Portal. Available at: https://help.sap.com/docs/joule/serviceguide/roles-and-authorizations-for-joule-with-microsoft-365-copilot-microsoft-teams
SAP (n.d.h) Display Change Documents. SAP S/4HANA Cloud Public Edition, version 2608, SAP Help Portal. Available at: https://help.sap.com/docs/SAP_S4HANA_CLOUD/55a7cb346519450cb9e6d21c1ecd6ec1/c5e2a4c55a0b402dba62a151da004eba.html
SAP (n.d.i) Reverse Payment Run. SAP S/4HANA Cloud Public Edition, version 2608, SAP Help Portal. Available at: https://help.sap.com/docs/SAP_S4HANA_CLOUD/031c345485b84c8c94265be9ef61d3a8/8495b14aa22f4626bd879f90a9ccc749.html
SAP (n.d.j) Understanding the Commercial Model. Introducing Joule, SAP Learning. Available at: https://learning.sap.com/courses/introducing-joule/understanding-the-commercial-model
ServiceNow (2022) Subscription Service Agreement. Version of November 17. Available at: https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/legal/servicenow-subcription-service-agreement.pdf
ServiceNow (2025a) Viewing Sys Audit and Audit Relationship Change tables. ServiceNow documentation, Zurich release, updated July 31. Available at: https://www.servicenow.com/docs/r/zurich/platform-security/c_UnderstandingTheSysAuditTable.html
ServiceNow (2025b) Create a Model Context Protocol server. ServiceNow documentation, Australia release, updated August 8. Available at: https://www.servicenow.com/docs/r/XRgEFx7nPN6ciT_BBIvnbg/a2CY_8UaP1y3J_5_ry5NCQ
ServiceNow (2025c) Exploring MCP Server Console. ServiceNow documentation, Yokohama release, updated August 8. Available at: https://www.servicenow.com/docs/r/_yCRwrQYX6H0b46tCsDNZA/BAM3q4XVPSc5Q0UTkmbdbg
ServiceNow (2025d) Manage OAuth tokens. ServiceNow documentation, Zurich release, July 31. Available at: https://www.servicenow.com/docs/r/oJu9n0q6rU~F9UHAnNCt5w/pS1uT7~fVFOHquHvwxuQBw
ServiceNow (2026a) ServiceNow opens its full system of action to every AI Agent in the enterprise. Press release, May 5. Available at: https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-opens-its-full-system-of-action-to-every-AI-Agent-in-the-enterprise/default.aspx
ServiceNow (2026b) ServiceNow and Google Cloud advance agentic AI for industry workflows. Press release, October 27. Available at: https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-and-Google-Cloud-advance-agentic-AI-for-industry-workflows/default.aspx
ServiceNow (2026c) Model provider updates. ServiceNow documentation, updated September 23. Available at: https://www.servicenow.com/docs/r/intelligent-experiences/servicenow-large-language-model-now-llm/now-llm-model-updates.html
ServiceNow (2026d) MCP Server Console FAQ. ServiceNow Community, written by ServiceNow staff, May 28, edited October 1. Available at: https://www.servicenow.com/community/now-assist-articles/mcp-server-console-faq/ta-p/3550125
ServiceNow (2026e) Action Fabric: MCP Server, MCP Client, and A2A explained. ServiceNow Community, written by ServiceNow staff, June 16, edited July 30. Available at: https://www.servicenow.com/community/tkb/articleprintpage/tkb-id/now-assist-articles/article-id/878
ServiceNow (2026f) What’s New in MCP Server Console: From Skills to Full Platform Action. ServiceNow Community, written by ServiceNow staff, May 27, edited June 15. Available at: https://www.servicenow.com/community/servicenow-otto-articles/what-s-new-in-mcp-server-console-from-skills-to-full-platform/ta-p/3541621
ServiceNow (2026g) Ordering Agreement. Version of February 6. Available at: https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/legal/servicenow-ordering-agreement.pdf
ServiceNow (2026h) Roll back and delete recovery. ServiceNow AI Platform Administration documentation, Brazil release, updated September 10. Available at: https://www.servicenow.com/docs/r/platform-administration/table-administration-and-data-management/rollback-delete-recovery.html
ServiceNow (2026i) Cancel a request from the service catalog. IT Service Management documentation, Australia release, updated March 12. Available at: https://www.servicenow.com/docs/r/australia/it-service-management/procurement/t_CancelReqFromServCatalog.html
ServiceNow (2026j) AI Gateway. ServiceNow documentation, Brazil release, September 10. Available at: https://www.servicenow.com/docs/r/intelligent-experiences/ai-gateway.html
ServiceNow (2026k) AI Gateway Implementation Guide. ServiceNow Community, written by ServiceNow staff, September 15, edited October 28. Available at: https://www.servicenow.com/community/ai-control-tower-articles/ai-gateway-implementation-guide/ta-p/3587444
ServiceNow (2026l) Best Practices in managing AI agents, skills, and assists in ServiceNow. ServiceNow Community, written by ServiceNow staff, July 7, edited July 10. Available at: https://www.servicenow.com/community/servicenow-otto-articles/best-practices-in-managing-ai-agents-skills-and-assists-in/ta-p/3569710
ServiceNow (2026m) ITOM MCP Server is now in ChatGPT. Your ops context just went global. ServiceNow Community, written by ServiceNow staff, October 28. Available at: https://www.servicenow.com/community/itom-articles/itom-mcp-server-is-now-in-chatgpt-your-ops-context-just-went/ta-p/3615499
ServiceNow (2026n) Monitoring Now Assist usage in Subscription Management. ServiceNow documentation, Brazil release, updated September 10. Available at: https://www.servicenow.com/docs/r/platform-administration/monitoring-now-assist-usage.html
Workday (2023) Concept: Auditing. Workday Administrator Guide, last updated June 23. Available at: https://doc.workday.com/admin-guide/en-us/manage-workday/tenant-configuration/auditing/dan1370797846272.html
Workday (2026a) Workday and Anthropic Announce New Partnership to Connect Reasoning to the Rules That Run the Business, Wherever People Choose to Work. Press release, October 13. Available at: https://newsroom.workday.com/2026-10-13-Workday-and-Anthropic-Announce-New-Partnership-to-Connect-Reasoning-to-the-Rules-That-Run-the-Business,-Wherever-People-Choose-to-Work
Workday (2026b) Workday’s Trusted Agent Platform Now Delivers Headless Access to HR and Finance, Letting Customers Build and Run Lawful AI Agents. Press release, October 13. Available at: https://newsroom.workday.com/2026-10-13-Workdays-Trusted-Agent-Platform-Now-Delivers-Headless-Access-to-HR-and-Finance,-Letting-Customers-Build-and-Run-Lawful-AI-Agents
Workday (2026c) Workday to Bring Sana Everywhere Employees Work, Including Claude, Gemini Enterprise, Microsoft Copilot, Microsoft Teams, and Slack. Press release, October 13. Available at: https://newsroom.workday.com/2026-10-13-Workday-to-Bring-Sana-Everywhere-Employees-Work,-Including-Claude,-Gemini-Enterprise,-Microsoft-Copilot,-Microsoft-Teams,-and-Slack
Workday (2026d) Agent-Ready Tools Data Sheet. Data sheet, document code 20261008. Available at: https://www.workday.com/content/dam/web/en-us/documents/datasheets/Agent-Ready-Tools-Data-Sheet.pdf
Workday (2026e) Flex Credits Rate Card. Rate card, October 12. Available at: https://www.workday.com/content/dam/web/en-us/documents/legal/flex-credits-rate-card.pdf
Workday (2026f) Q2 FY27 Earnings Prepared Remarks. Investor Relations, August 27. Available at: https://s21.q4cdn.com/950027458/files/doc_earnings/2027/q2/generic/Q2-FY27-Earnings-Prepared-Remarks.pdf
Workday (2026g) Concept: Business Process Management. Workday Administrator Guide, last updated March 13. Available at: https://doc.workday.com/admin-guide/en-us/manage-workday/business-processes/manage-business-processes/ikj1637605088663.html
Workday (2026h) Reference: Actions Available on Business Processes. Workday Administrator Guide, last updated March 13. Available at: https://doc.workday.com/admin-guide/en-us/manage-workday/business-processes/business-process-framework-concepts/mee1553714361673.html
Workday (2026i) Set up Sana from Workday for Gemini Enterprise. Workday Documentation, last updated August 21. Available at: https://doc.workday.com/admin-guide/en-us/human-capital-management/hcm-innovation-services/workday-everywhere/set-up-sana-from-workday-for-gemini-enterprise.html
Workday (n.d.a) Security & Compliance (AI Governance Trust). Available at: https://www.workday.com/en-us/ai-platform/ai-governance-trust.html
Workday (n.d.b) Responsible AI. Workday. Available at: https://www.workday.com/en-us/ai-platform/responsible-ai.html
Workday (n.d.c) Workday Flex credits. Workday. Available at: https://www.workday.com/en-us/artificial-intelligence/ai-flex-credits.html
Workday and Google Cloud (2026) Workday and Google Cloud Expand Strategic Partnership to Bring AI Agents for HR and Finance Into Employees’ Daily Workflows. Press release, May 28. Available at: https://www.googlecloudpresscorner.com/2026-05-28-Workday-and-Google-Cloud-Expand-Strategic-Partnership-to-Bring-AI-Agents-for-HR-and-Finance-Into-Employees-Daily-Workflows
Standards, regulation and security research
A2A Project (n.d.) Agent2Agent (A2A) Protocol Specification. Version 1.0.0, Linux Foundation. Available at: https://a2a-protocol.org/latest/specification/
Costello, A. (2026) BodySnatcher (CVE-2025-12420): agentic hijacking vulnerability in ServiceNow. AppOmni, January 13. Available at: https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/
European Commission (2026) AI Act. Shaping Europe’s digital future, policy page, last updated October 19. Available at: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
European Union (2024) Regulation (EU) 2024/1689 (Artificial Intelligence Act). Regulation of June 13, published in the Official Journal of the European Union, July 12. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689
Ishay Sharbat, T. (2025) AgentFlayer: ChatGPT Connectors 0click Attack. Zenity Labs, August 6. Available at: https://labs.zenity.io/p/agentflayer-chatgpt-connectors-0click-attack-5b41
Levi, S. (2025a) ForcedLeak: AI agent risks exposed in Salesforce Agentforce. Noma Security, September 25. Available at: https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/
Levi, S. (2025b) Hacking Google Gemini Enterprise with an Indirect Prompt Injection. Noma Security, December 8. Available at: https://noma.security/noma-labs/geminijack
Levi, S. (2025c) GeminiJack: the Google Gemini zero-click vulnerability leaked Gmail, Calendar and Docs data. Noma Security, December 8. Available at: https://noma.security/blog/geminijack-google-gemini-zero-click-vulnerability/
Microsoft Security Response Center (2025) CVE-2025-32711 M365 Copilot Information Disclosure Vulnerability. Released June 11, updated February 20, 2026. Available at: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32711
Model Context Protocol (2026a) Specification. Revision 2026-07-28. Available at: https://modelcontextprotocol.io/specification/2026-07-28
Model Context Protocol (2026b) Schema Reference. Revision 2026-07-28. Available at: https://modelcontextprotocol.io/specification/2026-07-28/schema
Model Context Protocol (2026c) Cancellation. Revision 2026-07-28. Available at: https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/cancellation
Model Context Protocol (n.d.) Versioning. Available at: https://modelcontextprotocol.io/specification/versioning
OWASP Gen AI Security Project (n.d.) LLM01:2025 Prompt Injection. Available at: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
Rehberger, J. (2025) Claude Pirate: Abusing Anthropic’s File API For Data Exfiltration. Embrace The Red, October 28. Available at: https://embracethered.com/blog/posts/2025/claude-abusing-network-access-and-anthropic-api-for-data-exfiltration/
Named media and transcripts
Bruce, G. (2026) Larry Ellison wants to kill EHR screens: ‘Any other user interface is nonsense’. Becker’s Hospital Review, October 29. Available at: https://www.beckershospitalreview.com/healthcare-information-technology/ehrs/larry-ellison-wants-to-kill-ehr-screens-any-other-user-interface-is-nonsense/
Constantin, L. (2025) Black Hat: Researchers demonstrate zero-click prompt injection attacks in popular AI agents. CSO Online, August 8. Available at: https://www.csoonline.com/article/4036868/black-hat-researchers-demonstrate-zero-click-prompt-injection-attacks-in-popular-ai-agents.html
The Motley Fool (2026) SAP (SAP) Q3 2026 Earnings Call Transcript. Third-party transcript, October 21. Available at: https://www.fool.com/earnings/call-transcripts/2026/10/21/sap-sap-q3-2026-earnings-call-transcript/
Nuñez, M. (2026) Salesforce just put its entire CRM inside Claude, and says you’ll never need its app again. VentureBeat, August 26. Available at: https://venturebeat.com/orchestration/salesforce-just-put-its-entire-crm-inside-claude-and-says-youll-never-need-its-app-again
van Eenbergen, C. (2026) NetSuite declares the end of ERP: The future is invisible. Techzine Global, November 2. Available at: https://www.techzine.eu/blogs/applications/145450/netsuite-declares-the-end-of-erp-the-future-is-invisible/
Yeung, K. (2026) Oracle Embeds OpenAI Into Its Business Software in What It Calls an Enterprise ‘Coming-Out Party’. The Letter Two, October 27. Available at: https://thelettertwo.com/2026/10/27/oracle-openai-partnership-coming-out-party
Research this note builds on
Greyhound Research (2026a) Everyone Is Building AI Agents. Oracle Is Moving The Contest Inside The Runtime. Research report, July 20. Available at: https://greyhoundresearch.com/everyone-is-building-ai-agents-oracle-is-moving-the-contest-inside-the-runtime/
Greyhound Research (2026b) Oracle Fusion Claw – Autonomy Arrives With A Receipt. Research report, October 14. Available at: https://greyhoundresearch.com/oracle-fusion-claw-autonomy-arrives-with-a-receipt/
Greyhound Research (2026c) Oracle Agentic Implementation – When Agents Draft The Setup, Review Becomes The Control. Research note, October 29. Available at: https://greyhoundresearch.com/oracle-agentic-implementation-when-agents-draft-the-setup-review-becomes-the-control/
Greyhound Research (2026d) Oracle AI Security – When AI Finds The Flaws Faster, Fixing Becomes The Control. Research note, October 29. Available at: https://greyhoundresearch.com/oracle-ai-security-when-ai-finds-the-flaws-faster-fixing-becomes-the-control/
Greyhound Research (2026e) Oracle Fusion Claw By Function – When Agents Reach Every Function, Ownership Becomes The Control. Research note, October 31. Available at: https://greyhoundresearch.com/oracle-fusion-claw-by-function-when-agents-reach-every-function-ownership-becomes-the-control/
Greyhound Research (2026f) Oracle OCI And Multicloud – When Rivals Run Inside Oracle’s Cloud, The Contract Becomes The Control. Research note, November 2. Available at: https://greyhoundresearch.com/oracle-oci-and-multicloud-when-rivals-run-inside-oracles-cloud-the-contract-becomes-the-control/
Disclosures: Independence, Financial, Intended Use, Methodology, Authoring, And Copyright
The evidence in this research note is current through November 2, 2026. Any written response received from an organization named in it after that date is dated where it appears.
Independence Disclosure
Research under the Greyhound Research brand is independent, and no organization holds a right of approval over its content or publication. Greyhound Research did not offer any named organization a pre-publication factual review of this research note. Editorial control remained entirely with Greyhound Research throughout. Greyhound Consilium is the B2B thought-leadership arm of The House Of Greyhound and a sister brand to Greyhound Research. It builds on Greyhound Research’s independent research through collaborations that produce thought-leadership content, research, and practical toolkits for decision-makers. Every Greyhound Consilium publication names its partner on the face of the document. This research note is published under the Greyhound Research brand.
Financial Disclosure
Greyhound Research undertakes advisory and consulting engagements with enterprise buyers and technology providers, and no such engagement confers control over its research findings or its decision to publish them. Oracle is a client of Greyhound Research (part of The House Of Greyhound). The engagement covers only thought-leadership content published under the Greyhound Consilium brand and did not fund this research note. Greyhound Research holds no other financial interest in Oracle or its subsidiaries.
Intended Use
This research note is written for chief information officers, chief information security officers and identity leads, heads of enterprise applications and controllers, chief data officers and data protection officers, chief financial officers and procurement leaders, heads of vendor management, enterprise architects, and the press. It reads Oracle’s and OpenAI’s announcements at Oracle AI World 2026, the documents beside them, and the documentation of five other application vendors and four model companies, to inform decisions on identity, approvals, data terms, cost, dependency and exit when employees work on enterprise applications from an AI assistant. This research note is not investment advice, a recommendation to buy, sell, or hold any security, or a view on any company’s share price or valuation. It is not legal advice, and its reading of contract, privacy and regulatory terms is to be confirmed with counsel. Its assessments rest on the documents listed in Sources And References as they stood on November 2, 2026, and can change as Oracle, OpenAI, and the other companies named publish more. Product availability, plan terms, regions, features, and prices are described as each company published them through November 2, 2026, so confirm them with the vendor before acting on them.
Research Methodology
Greyhound Research’s analysis rests on source evidence verified against the document that supports each claim. The evidence comprises the two hundred and twelve sources listed in Sources And References, in ten classes, from Oracle’s announcements, product pages, blogs, documentation, contracts and investor day to OpenAI’s and other model companies’ documentation, other application vendors’ documents, standards, regulation and security research, named media and transcripts, and the research this note builds on. A finding that something is not stated or not written is bounded to the documents the text names, as they stood on November 2, 2026. Statuses are given as each company states them, and where two documents from one company word the same status differently, both readings are given.
The Greyhound Front Door Scorecard, Edition 1, applied in Table 5, Exhibits 7, 8 and 9 and the appendix, is Greyhound Research’s own framework, and its twelve criteria grade forty-one elements, each under one criterion only. It reads seven doors, each an application reached from one named assistant, on twelve criteria. Each element is read as documented, announced or not stated from the public documents searched, and each criterion takes one grade from its elements, documented, partly, announced or not stated, as Exhibit 7 sets out. Documentation means the vendor’s own product documentation, help pages, contract terms, rate cards, release notes, trust pages and technical articles that state how the product behaves, and the model company’s documentation counts only for the elements on the assistant’s side, once the vendor names the assistant, as Table 5 sets out criterion by criterion. Two readers marked every cell independently from the same records, and where their grades differed, in twenty of eighty-four cells, each a difference of rule, Greyhound Research settled the rule once and applied it to every door alike. Every cell carries an evidence line with the vendor’s exact words and the page, and the appendix gives every cell’s evidence in Greyhound Research’s words, linked to its page. No criterion is weighted, and no overall score is computed. The worked example in Exhibit 10 carries each door’s grade for the criterion a step tests and changes no mark, and the reading of reversal in Table 6 keeps apart what the door writes, what the platform keeps and the business process that reverses a transaction. The grades measure whether an answer is written and where, not whether it is generous or whether the product behaves as written. Remarks from Oracle’s investor day and from SAP’s third-quarter 2026 earnings call are cited from the third-party transcripts linked where each remark appears, and no financial figure from either is used. Karan Batta’s remarks rest on one newsletter, linked where they appear, and only what it records him saying is attributed to him. Published security research is cited with the researcher, the date and the vendor’s stated response, and the absence of a disclosure involving Oracle’s doors, SAP’s Joule, Workday’s Sana or Microsoft’s Dynamics 365 MCP servers is bounded to the researcher indexes checked.
The Greyhound CIO Pulse 2026 figure is cited as published in Greyhound Research’s research note of October 29, 2026, labeled with its edition. The five routes, the lending patterns, the comparison marks, the readings in Tables 1 to 7 and Exhibits 1 to 15, the worked example, the reading of reversal, the risks, the Runbook moves, the signals, and every term proposed for a contract are Greyhound Research’s analysis, not statements by Oracle, OpenAI or any other company. No Greyhound Fieldnotes are cited, and no factual claim in this research note rests on unpublished material. Quotations are checked against the live source before publication.
Authoring Disclosure
This material reflects the analysis, viewpoint and editorial judgment of Greyhound Research. The position presented is developed from Greyhound Research’s research, advisory work and accumulated institutional knowledge. Depending on the assignment, AI may be used to retrieve relevant material; structure, draft or polish prose from analyst-provided concepts, dictation, notes, rough drafts and source material; support secondary research and factual cross-checking; and assist with editing, condensation and consistency with Greyhound Research’s house style. AI does not independently establish Greyhound Research’s viewpoint, analytical position or conclusions. Material factual claims are verified against source evidence before release. Greyhound Research reviews and approves the final material and retains responsibility for it.
Copyright Policy
All content in this document and on the Greyhound Research website is protected by copyright law and may not be reproduced, distributed, transmitted, displayed, published, or broadcast without the prior written permission of Greyhound Research or, in the case of third-party materials, the prior written consent of the copyright owner of that content. You may not alter, delete, obscure, or conceal any trademark, copyright, or other notice appearing in any Greyhound Research content. Quotation of up to one hundred words is permitted where it carries attribution to Greyhound Research and a link to the published page. Reproduction, redistribution or republication beyond that extent, in whole or in part, by email or in any medium including websites, newsletters and intranets, requires prior written permission, which may be requested at the address below. The published version of each content piece on the Greyhound Research website carries sharing tools for readers who wish to share it.
For questions arising from these disclosures, including licensing requests, contact the Greyhound Research Community Relations Team at connect@thofgr.com. For media inquiries, write to media@thofgr.com.
Analyst In Focus: Sanchit Vir Gogia
Sanchit Vir Gogia, or SVG as he is popularly known, is a globally recognized technology analyst, innovation strategist, digital consultant and board advisor. SVG is the Chief Analyst at Greyhound Research (part of The House Of Greyhound), a Global, Award-Winning Technology Research, Advisory, Consulting & Education firm. Greyhound Research works closely with global organizations, their CxOs and the Board of Directors on Technology & Digital Transformation decisions.
Discover more from Greyhound Research
Subscribe to get the latest posts sent to your email.