Dots vs Grok Bot vs Muse: Reading the Permission Models Side by Side

By the end of September 2026, three major labs had shipped an always-on agent with its own cloud computer: OpenAI's dots, xAI's Grok Bot, and Meta's Muse. All three chase a similar pitch — an agent that keeps working after you close the tab — but they answer the hardest question in that pitch, "what stops this thing from doing something wrong," in three genuinely different ways. Reading those answers side by side is more revealing than reading any one launch announcement alone.

Dots: separate the sign-in from the model

OpenAI's approach, detailed across the dots launch materials, is built around keeping the agent's identity distinct from the human's. A dot gets its own credentials and tool provisioning through OpenAI's plugin ecosystem — it isn't logging in as you. On top of that structural separation sits a three-part control layer: Custom Rules let admins require approval for, or outright prohibit, specific actions; Auto-Review checks consequential actions before they execute; and an Activity View lets a human inspect what a dot has been doing in the background. Sensitive operations — the example OpenAI gives is password changes — are reserved for humans outright, full stop, no override.

Layered on top of all of that is proactive research: a dot's unsupervised background scanning is explicitly restricted to read-only access. It can look; it can't act without clearing the review layer above it.

This is, structurally, the most legible of the three models. Every stage of a dot's autonomy has a named checkpoint. Whether those checkpoints work well in practice is untested at scale — dots is one day old as of this writing — but the architecture itself gives an admin something concrete to configure and audit.

Muse: isolate the agent, gate every outbound action

Meta's approach, described in the Muse launch and expanded through its September 23 and 29 updates, takes a different structural bet. Rather than separating identity, Meta isolates environment: each Muse agent runs inside a Secure VM, a sandboxed cloud environment housing both the agent and the user's data. A second, separate agent — Sentinel — sits between Muse and the outside world, approving, blocking, or escalating every connected-app action and every outbound network request Muse tries to make. Critically, Muse itself has no visibility into passwords or payment methods; those flow through Sentinel and through payment mechanisms like Link and one-time-use cards, not through the agent's own context. Every action generates a full audit trail, and users control app-access permissions directly.

Where dots draws its checkpoint at the action type (is this consequential? does a rule flag it?), Muse draws its checkpoint at the network boundary — a second agent, architecturally separate from the first, has to sign off before anything leaves the sandbox. It's a more paranoid design in the literal sense: it doesn't just trust Muse to behave inside its own review logic, it puts a second system in the loop that Muse cannot itself influence.

Grok Bot: no separate identity at all

xAI's Grok Bot, per xAI's own announcement, inverts both approaches. Rather than provisioning a distinct identity (dots) or sandboxing the agent behind a second approver (Muse), Grok Bot signs into your existing tools using your own credentials — explicitly including tools that have no API or MCP integration at all. That's the core of xAI's pitch: no integration work, no waiting for a connector to exist, the bot just logs in as you and uses the software the way you would.

This is, by a wide margin, the highest-trust, highest-risk model of the three. There is no equivalent of Custom Rules, no Sentinel-style second approver, and no formal safety documentation in any source available at launch — a gap worth flagging plainly rather than filling in with an assumption that one exists unpublished. What is documented is that Grok Bot requires explicit approval for certain tasks and is described by xAI itself as beta with "evolving capabilities" — language that reads as an acknowledgment the guardrails are still being built, not a claim that they're complete.

What the differences actually tell you

The permission model a company ships first is a pretty honest signal of who they think will get hurt if it's wrong.

OpenAI's structure reads like it was built by people who've already lived through enterprise procurement conversations — Custom Rules and Activity View are the kind of features a security team asks for by name. Meta's structure reads like it was built for a consumer product where a single bad outbound request (a payment, a message sent to the wrong person) is the worst-case scenario worth architecting hardest against — hence a whole second agent whose only job is saying no. Grok Bot's structure reads like a team optimizing for adoption speed over a formal safety framework, betting that "logs in as you" is compelling enough to businesses that the missing documentation won't slow deals down — at least not yet, while it's confined to a waitlist for anything beyond individual subscribers.

None of these is obviously the correct choice in the abstract. They're three different bets about where an agent is most likely to go wrong, made by three companies with three different customer bases and three different tolerances for a bad headline. The honest takeaway for anyone choosing between them isn't "pick the safest one" — it's "read the specific mechanism, not the marketing," because in this category the mechanism is the entire product.

For a fourth point of comparison, the Claude Code Agent Skills model sidesteps the whole question differently: instead of granting one big agent standing, ambient access and then building review layers on top, you install narrow, git-versioned capabilities one at a time into an agent whose base behavior you already trust. It's a smaller unit of trust, granted more often, rather than one large grant reviewed continuously — a tradeoff worth weighing against all three of the always-on models above.

Part 24 of 30 in the ChatGPT Dots series. Previously: Dots and the Bubbly Avatar: Why Cute Branding Matters. Next: The dot.com Troll: What xAI's Stunt Reveals About the Agent Land Grab. Browse more builder insights or explore AI skills at aiskill.market.