The report
A card token can make a checkout possible without revealing the original card number, but it cannot answer the more consequential question: which purchase is the assistant authorized to submit? OpenAI's ChatGPT Wallet terms, effective November 12, 2026, distinguish approval of a particular order from authority granted in advance. The terms document both possibilities; they do not publish a complete technical specification of every advance-delegation limit.
For a specific purchase, ChatGPT can assemble an order and present the merchant, items, quantities, card, total or maximum price, and known additional obligations such as recurring charges or holds. Approval authorizes submission of the terms actually displayed, not every subsequent change to the basket. If a material detail changes before submission, the terms say the user must be asked again. That creates an explicit boundary between an agent preparing a proposal and the user authorizing an external effect.
A token is a credential, not a spending policy
| Boundary | What the published terms establish | What remains separate |
|---|---|---|
| Card enrollment | A payment provider collects card details through a secure form; OpenAI receives tokenized credentials and limited card attributes | Permission to purchase from a particular merchant |
| Order confirmation | The user can approve specified merchant, item, payment and delivery terms | Whether a changed order falls within the approved terms |
| Order submission | OpenAI can send the authorized order and credential to merchant and payment services | Issuer authorization, merchant acceptance and fulfillment |
| Card removal | The stored instrument can be removed from the wallet | Cancellation of an already submitted purchase or discharge of a merchant obligation |
The merchant remains the seller, while the card issuer decides whether to authorize a charge. A completed merchant-side transaction is not automatically undone by a later model stop. The distinction resembles the I-HITL controlled wallet test, where an agent's access to its own approval channel defeated a nominal human gate. That experiment did not test ChatGPT Wallet; it demonstrates why control of a credential and independent permission to use it must not be collapsed into one event.
The unexplained part of advance delegation
The published terms acknowledge advance authority, yet do not provide a comprehensive public account of its duration, per-merchant scope, cumulative spending caps, recurring-payment handling or the exact revocation sequence for tasks already in progress. It would therefore be incorrect to describe the service as permitting unrestricted autonomous purchases, and equally incorrect to assert that a tested cancellation mechanism always reverses external effects. Effect-bound approval remains the relevant control question: which actor can approve which merchant, items and maximum amount, and which executor verifies that same permission before a charge is submitted?
The accompanying Wallet Privacy Notice says the payment provider, rather than OpenAI, receives the full card number and security code. OpenAI nevertheless handles purchase requests, approvals and rejections, transaction and authentication events, device information, delivery details and fraud-related records; some records can remain after the card is removed. Tokenization reduces exposure of raw card credentials, not the sensitivity of purchase metadata or the need to bound future spending authority. These are documented product and policy statements, not a published independent audit of real purchase attempts, abuse rates or revocation under failure.