OpenAI is the inversion of the traditional infrastructure vendor. The company conducting the largest AI infrastructure buildout in history sells none of it: Stargate, the serving fleet spread across OpenAI-operated, Azure, AWS, and Oracle capacity, and the Jalapeño inference chip are OpenAI's supply chain, not the customer's menu. What a customer can actually deploy is the top of the stack: frontier model serving, an agent runtime, and the most widely used AI application on earth. Everything below that, compute, data foundation, pipelines, orchestration, stays the enterprise's responsibility, by design.
The capture is two-tier, and the tiers point in opposite directions. The model is the commodity; the platform is the capture. The OpenAI-compatible completions interface has become the S3 of inference — a genuine multi-vendor standard implemented across the industry, hot-swappable in production when the application's logic lives in deterministic code rather than in the model — and gpt-oss is a real Apache 2.0 open-weight exit. That openness is genuine, and it is the reassuring layer. The captivity accumulates beyond it: the Responses platform surface, fine-tunes whose weights never export, the Codex harness, and above all the accumulated context estate. Consumer sentiment is the clean evidence: users don't complain about rival models' capability — they rate the alternatives as capable enough — they stay because memory and context don't move. The more judgment you borrow, the harder it is to leave as capabilities grow.
That is the same capture mechanism as the deepest coupled lock-in in enterprise software, running at conversational speed. Salesforce accumulates org config and sharing logic over decades of admin decisions; OpenAI accumulates memory, groundings, and working context per user per day, which makes it faster-compounding and harder to audit. Enterprise architects should read ChatGPT's consumer memory lock-in as the preview of what company knowledge and workspace-scale context become at enterprise scale.
The governance hole is the row's sharpest asymmetry. The vendor whose models power more production agents than anyone else's ships no generally available plane to govern them. Today, OpenAI-powered agent estates are governed by other vendors' reasoning planes — Microsoft Agent 365 registers them, MuleSoft Agent Fabric brokers and meters them, Entra Agent ID gives them identities. OpenAI is the object of everyone else's Layer 2C and the operator of none. Frontier is the reclaim attempt — agent registry, per-agent permissions, onboarding lifecycle, model-agnostic governance — and it is limited availability, watch-listed until a customer can buy it per the docs.
Platform mutability is the finding a capability grade can't carry, so the row carries it in prose: the primitives hold and the wrappers die on schedule. Custom GPTs gave way to Workspace Agents, the Assistants API shuts down August 26, 2026, Agent Builder and Evals retire November 30, 2026 — while the models, the Responses API, and the vector stores persist underneath. Lab 001's guidance, extended: build against the primitive, not the wrapper. The wrapper adds captivity and subtracts visibility while it lives, and the vendor's own history says the wrapper is the layer that dies.
The buyer's trade: frontier intelligence, the largest application estate in the market, zero infrastructure burden, and zero transmitted NVIDIA exposure. In exchange, the buyer's Layer 0 through 2A position is not just unowned but unknowable — the same token contract can be served from four different owners' silicon — and the judgment estate compounds toward captivity by default. The exits are real: the standard interface, the open weights, the multi-cloud channels. But every exit is an architectural decision the buyer must make on day one, because none of them is the default, and the default path borrows more judgment every day it runs.
Layer-by-layer status: Layer 0 (Not a Customer Surface (By Design)), Layer 1A (Trust Apparatus, Not a Data Foundation), Layer 1B (Hosted RAG Primitive), Layer 1C (Intake, Not Movement), Layer 2A (Metered Consumption, No Customer Plane), Layer 2B (Frontier Serving + Agent Runtime), Layer 2C (Enterprise Responsibility (Frontier Pre-GA)), Layer 3 (+1) (First-Party Value Plane, Assistant Altitude).
Assessment framework: 4+1 Layer AI Infrastructure Model. Scoring model: Decision Authority Placement Model (DAPM) — Retained, Delegated, or Ceded. Published by The CTO Advisor LLC. Author: Keith Townsend. Date assessed: July 22, 2026. Version: v1.1 - Reader-Legible Summary Lead.
Raw compute, networking, and acceleration fabric
OpenAI's own fleet is among the largest NVIDIA estates on earth, and the customer never touches it. The API boundary absorbs the entire dependency: no instance types, no GPU selection, no fabric visibility. OpenAI is also the one vendor on the instrument actively engineering out of the dependency it absorbs — the Broadcom-built Jalapeño inference chip (unveiled June 24, 2026) targets late-2026 deployment across Stargate capacity. That hedge is OpenAI's supply-chain story, not a customer capability; it is logged here as context for the near-empty NVIDIA column that holds across the whole row.
The buyer never thinks about silicon, and that is the pitch. Behind the API sits arguably the largest single-purpose compute buildout in history: Stargate (the Oracle/SoftBank joint venture), a $38B AWS compute commitment, roughly $250B in committed Azure consumption, and the Broadcom partnership deploying 10 GW of OpenAI-designed accelerators. None of it is an option on the architect's menu. An architect building a production system today cannot buy, rent, or administer any OpenAI compute; provisioned API capacity is a throughput commitment denominated in tokens, not compute. The exposure test governs (ratified CoreWeave 1C vs. Supermicro 1C; applied to Salesforce's first-party data centers): an underlay capability the vendor does not surface as a purchasable, customer-administered product is not that vendor's capability. The substrate-surface rule, ratified on this row, makes the boundary decidable: Layer 0 credit requires the substrate itself to be the purchasable thing — silicon choice, instance types, fabric, placement. Compute administered through an abstraction that hides the substrate is a runtime product and scores at the runtime layers; OpenAI's container and sandbox execution surfaces are scored at 2B on exactly that basis. The OpenAI-specific sharpening: the enterprise's Layer 0 position under the OpenAI API is not just unowned, it is unknowable. Post-restructuring, the same API contract can be served from OpenAI-operated Stargate capacity, Azure, AWS, or Oracle infrastructure, and OpenAI can move inference between them without notice. A Salesforce adoption decision resolves no Layer 0 authority question; an OpenAI adoption decision actively obscures it. The counterweight is real: gpt-oss and the Bedrock/Azure channels let an enterprise resolve the Layer 0 question deliberately by choosing the hosting channel — at which point the authority lands in that channel's row, not this one.
Total at Layer 0, and structurally invisible. The enterprise inherits the silicon, fabric, and placement judgment of whichever owner's cloud serves the request, and cannot audit which one that was. The vendor spending the most on Layer 0 on the entire instrument transmits no Layer 0 authority to its customers at all.
Watch-list (June 24, 2026): Jalapeño (OpenAI-designed, Broadcom-built LLM inference processor), initial deployment targeted late 2026 as part of Stargate's first 10 GW phase. Internal to OpenAI's fleet — it likely never becomes a scoreable customer component at this layer regardless of GA; tracked as the NVIDIA-hedge context. Fact question standing: does OpenAI sell any dedicated-capacity product an enterprise administers (single-tenant inference deployments) outside bespoke sovereign/government arrangements? Read of the docs is no.
Durable, governed data foundation — the Governance Catalog that Layer 2C queries
No storage product exists for NVIDIA to accelerate. The near-empty column continues.
The enterprise's data comes to OpenAI, not the reverse, and OpenAI has built real trust machinery around that fact: data residency in 10 regions (some with in-region inference), customer-managed encryption keys, SCIM, the Global Admin Console as a tenant-level control plane across ChatGPT workspaces and API organizations, retention controls, and a Compliance API exposing logs and metadata for eDiscovery and DLP workflows. For the buyer this answers the question they actually ask: can I let my people use this without losing control of our data. None of it is a data foundation. The layer's purpose is the governed data foundation — the governance catalog a Layer 2C would query — and OpenAI ships no storage product, no catalog, no classification engine, no lineage, and no authorization authority beyond its own workspace walls. The doc-confirmed findings are decisive. Classification is inherited, not provided: when a file carries a sensitivity label, ChatGPT captures the label into the audit log; it does not author or enforce one, and the actual classification and DLP enforcement belong to third-party integrations — Microsoft publishes its own Purview guide for governing ChatGPT Enterprise, which is the tell that the governance authority for ChatGPT data is a different vendor's product. Permissions are inherited too: company knowledge respects existing permissions in connected apps, so OpenAI is a permission consumer, honoring the source system's catalog rather than being one. Honoring someone else's catalog is well-designed behavior, and it is the opposite of 1A capability. The deciding line from the Salesforce/Qlik boundary is authorization authority versus curation, and OpenAI does not reach the curation rung: there is no catalog to curate. The uploaded files and vector stores in the API are real shipped bits, but they are derived, rebuildable copies — captive input caches for the retrieval tool — so the real-dependence guardrail does not trigger. Their weight is scored at 1B, per the precedent that splits retrieval from movement and storage.
None to borrow at this layer — the enterprise's data foundation stays wherever it already lives (SharePoint, Drive, Salesforce, the lakehouse), governed by those vendors' catalogs and the enterprise's own DLP stack. An OpenAI adoption decision transfers no data-governance authority; it adds a consumer that honors the existing authorities.
The trust apparatus (residency, CMEK, Global Admin Console, Compliance API) is named here as sub-threshold platform administration, not scored capability — the same treatment the metering apparatus receives at 2A. Fact question, texture only: where the ChatGPT company-knowledge index physically lives and what admin surface governs it; informs the 1B narration, does not move this cell.
Low-latency retrieval for RAG — vector/hybrid search, context windows
GA. Managed parse/chunk/embed pipeline with hybrid semantic-plus-keyword retrieval, metadata filtering, reranking, and a standalone vector-store search endpoint any application can call — retrieval as consumable infrastructure, not an OpenAI-app-only feature. Single-vendor API with no independent implementations; the embeddings are OpenAI's models, so leaving means re-embedding and rebuilding every store and retriever binding elsewhere. The retrieval capability is scored here; its integration as a hosted tool inside the agent runtime is scored at 2B, not double-counted.
GA. The endpoint shape is OpenAI-compatible and widely imitated, but the accumulated opinions are the vectors themselves, and vectors are useless without the same model at query time. No second vendor can serve the same embedding space, and OpenAI does not release these weights — so unlike the completions interface (Delegated at 2B, where integration code and prompts lift and recalibrate), the embedding artifacts have no exit: lift-to-leave is a full re-embed of every corpus. The standard-looking interface is the decoy; the embedding space is the capture.
GA for Business/Enterprise/Edu. Cross-SaaS retrieval with citations across Slack, SharePoint, Google Drive, GitHub, Salesforce and more, honoring source-system permissions per user. The index and retrieval layer are OpenAI's; connector configuration and enabled-app decisions live in OpenAI's admin plane. The source data staying put is the decoupled-capture decoy: the bytes remain in the source systems while the grounding layer accumulates in OpenAI.
Whatever silicon serves the embedding and retrieval calls is invisible behind the API. The near-empty column holds.
Two real surfaces, one infrastructure and one product. The infrastructure surface: file search on vector stores in the API. Upload files and OpenAI handles parsing, chunking, embedding, and hybrid semantic-plus-keyword retrieval with metadata filtering and reranking, composable with the Responses API and Structured Outputs. Critically, a standalone vector-store search endpoint exists, so a non-OpenAI application can consume the retrieval directly — the external-consumption gate that separated Salesforce (strong) from Qlik (moderate), and OpenAI clears it. The product surface: company knowledge in ChatGPT — retrieval across the connected SaaS estate (Slack, SharePoint, Drive, GitHub, Salesforce) with citations and source-permission inheritance. That is the Azure M365-grounding play made cross-vendor: OpenAI retrieves from everyone's corpus, a grounding reach even Microsoft cannot claim outside its own estate. What holds the cell at moderate is rule 4 and rule 6 together. The pipeline shape is fixed: upload, OpenAI parses, OpenAI chunks, OpenAI embeds, hybrid search. No bring-your-own embeddings, no insertable stages, no structured-data retrieval, no index architecture beyond the exposed knobs. That is the NetApp AIDE precedent almost exactly — fixed stages terminating in the vendor's own retrieval surface scored moderate — versus the VAST DataEngine's arbitrary-functions strong. Frontier check (rule 6): the 1B frontier is integrated enterprise retrieval platforms (Azure AI Search's full search-engine architecture, Vertex AI Search, Salesforce's permission-aware VDMO stack, Databricks). File search is a hosted RAG primitive for agent knowledge bases — real, GA, deployable, externally consumable, and a slice of the layer's function rather than the general enterprise retrieval platform. Moderate is that trade stated honestly: above Dell's Delegated-to-Elastic moderate (OpenAI's is first-party IP), below the platform frontier.
The retrieval intelligence is entirely OpenAI's and entirely opaque: chunking defaults, the embedding model, ranking behavior, and the agentic query planning inside deep research are opinions the enterprise inherits and cannot inspect. The capture is the decoupled kind: the documents stay in Slack and SharePoint, feeling portable, while the retriever configurations, vector stores, and agent grounding accumulate in OpenAI's namespace. Wrapper-vs-primitive guidance applies (Lab 001, 'Borrow the vendor's plumbing, not its judgment', June 27, 2026), extended by this row's own history: the wrapper adds captivity and subtracts visibility while it lives, and the vendor's deprecation record says the wrapper is the layer that dies. Build against the primitive.
Capability is scored on the durable primitive (vector stores, file search, the standalone search endpoint in the Responses API), not the wrappers. Two dated wrapper retirements logged as platform-stability findings, not capability deductions: the Assistants API — the wrapper file search originally shipped inside — shuts down August 26, 2026 after the Responses API reached feature parity; Agent Builder and Evals (AgentKit, launched October 6, 2025) retire November 30, 2026, with the Agents SDK, ChatKit, and Responses surviving. The pattern across the row: primitives hold, authoring wrappers turn over roughly every eighteen months — a lift-to-stay cost the strong-1B peers have not imposed on their installed base at this cadence. Texture, not grade-moving: embedding choice is confined to OpenAI's own embedding models (matching the Salesforce own-catalog ruling that this is grade-neutral). Fact question standing from 1A: administrability and location of the company-knowledge index.
Move/transform data — ETL/ELT, lineage, cost-aware movement, KV cache tiering
No movement platform exists to accelerate. The near-empty column continues.
Thin by design. What exists: batch ingestion into vector stores (the upload-parse-chunk-embed path scored at 1B), the Batch API for asynchronous bulk inference at half price, and connector-based sync where company knowledge pulls from SaaS sources on OpenAI's schedule. The buyer never builds an ETL pipeline to use OpenAI, and that is the offer: bring nothing, connect and go. There is no data movement platform here. No ETL/ELT authoring, no lineage, no CDC, no cost-aware movement, and no administrable KV-cache tiering surface — OpenAI runs prompt caching internally, but it is a billing discount, not a tier the architect manages. Movement between the enterprise's systems remains entirely the enterprise's problem, solved with someone else's tools (MuleSoft, Informatica, Glue, Airflow). The connector sync is fixed-function ingestion feeding OpenAI's own retrieval surface — the narrowest possible slice of this layer. Calibration: Salesforce holds strong here on two owned movement platforms; Qlik's strong ran on CDC plus Talend; Dell's moderate carries an owned orchestration engine. OpenAI has no movement product at all, and the shipped bits are features of the retrieval and inference products. The real-dependence guardrail does not trigger: connector configs are trivially rebuildable and the Batch API holds no accumulated opinions. Where Salesforce moves and governs records between systems that were never designed to talk, OpenAI moves nothing between anyone's systems but its own intake.
None to borrow — the movement function stays with the enterprise and its existing integration stack. The sync cadence of company-knowledge connectors is OpenAI's judgment, inherited invisibly, and it is scheduling texture rather than a pipeline authority.
Prompt caching and the Batch API are named here as sub-threshold economics features, not scored components. Watch-list (February 5, 2026): Frontier's 'systems of record' integration language could conceal a first-party integration layer; limited availability keeps it unscored row-wide, and the question travels with it to GA.
GPU scheduling, quotas, RBAC, fair-share scheduling, utilization optimization
Layer 2A is where NVIDIA dependency concentrates for most of the map (Run:ai, GPU operators, scheduling), and OpenAI exposes no plane in which to be dependent. Upstream, OpenAI's own fleet orchestration across NVIDIA, AMD, and soon Jalapeño silicon is among the most sophisticated on earth — and none of it is a product. The exposure test cuts it off exactly as it cut off Stargate at Layer 0.
There is nothing to operate, and as with Salesforce, that is the offer. OpenAI provisions, schedules, and scales the entire inference fleet invisibly. What the customer touches is the commercial metering edge: rate limits and usage tiers, Scale Tier and provisioned-throughput commitments for guaranteed API capacity, priority and flex service tiers trading latency for price per request, the Batch API queue, and per-project quota and budget administration through the admin console. No GPU plane is exposed. No scheduler, no quotas on compute (quotas are on tokens), no fair-share configuration, no utilization visibility. The Salesforce precedent decides the grade: Salesforce earned moderate at 2A on Runtime Fabric — a real orchestration product the customer deploys on their own Kubernetes — while its governor limits and consumption metering were ruled to weigh on the authority reading rather than lift the capability grade. OpenAI has no deployable orchestration artifact of any kind; everything the customer configures is denominated in tokens and dollars, never in compute, scheduling, or placement. A procurement surface is not an orchestration surface. The layer's function stays with whoever hosts the workload: the enterprise's own cluster for gpt-oss, the cloud's 2A for the Bedrock and Azure channels. The authority sharpening from Layer 0 recurs at this layer's altitude: the enterprise cannot see which silicon, which region, or even which owner's cloud served a request. Substrate-level decision provenance — which model instance, at what cost or compliance tier — is structurally unanswerable for the customer. You cannot audit what you cannot configure.
Total for the serving substrate, and unauditable. The enterprise inherits an unconfigurable orchestration plane spread across a multi-owner fleet, with the metering edge as the only visible surface of that authority.
Fact question (the same one that closed Salesforce's 2A): does any doc-confirmed surface let an enterprise allocate reserved capacity or spend across business units in compute terms rather than dollar/token terms? Read of the docs: project-level limits are budget administration, so no. A briefing surfacing a real capacity-partitioning surface reopens the moderate argument.
Model serving, agent execution, inference APIs, distributed inference
GA. Frontier models consumed through the interface the industry standardized on: independent vendors (vLLM, the inference clouds, competing model providers) implement the same API, so integration opinions lift and providers hot-swap without rebuilding — the S3 of inference. The remaining switching cost is behavioral recalibration (prompts and evals re-validated against a different model), the managed-Kubernetes kind of cost that kept managed K8s Delegated across the cloud rows. Depth of prompt-calibration to one model's dispositions is a graduated capture narrated in borrowedJudgment, not a component chip.
GA. The proprietary surface layered beyond the standard interface: stateful sessions, hosted tool execution (code-interpreter containers, computer use, web search, file search integration), structured outputs orchestration. Opinions built against it run nowhere else. This is the industry-standard-then-proprietary-surface pattern the litmus names at S3 (a captive engine layered past the open interface), executed by OpenAI on its own product line. The container/sandbox execution inside it is the landing spot for the Layer 0 ruling: execution-as-a-service on an invisible, unchoosable substrate.
GA. Managed customization whose accumulated opinions live in weights the customer can never take — fine-tunes on OpenAI's platform do not export. Lab 002 ('Own the weights, or the platform owns you', July 1, 2026): the managed path takes the weights, and against an owned-weights alternative the token price becomes a rented floor.
GA, including on AWS Bedrock (June 1, 2026). Hosted autonomous coding agent with cloud sandboxes and terminal/IDE surfaces. The harness, sandbox environments, and execution opinions are OpenAI-hosted; AGENTS.md conventions are portable texture, the harness is not. The runtime is scored here; the developer-application altitude is scored at Layer 3, not double-counted.
GA. Open-source agent framework — handoffs, guardrails, sessions, tracing — self-hostable and runnable against any compatible endpoint. Matches the Microsoft Agent Framework and Google ADK Retained calls: agent code built on the open SDK lifts out; the substrate is the enterprise's.
GA (self-managed; OpenAI provides no support for self-hosted deployments). gpt-oss-120b (o4-mini-class reasoning, datacenter GPUs) and gpt-oss-20b (high-end consumer hardware). The one place on the row where the enterprise can own OpenAI-lineage intelligence outright: weights lift anywhere, no vendor required. No other closed frontier lab on the instrument ships an escape valve at this capability class.
The serving fleet is heavily NVIDIA today, and no customer-facing NVIDIA surface exists — the API boundary transmits none of the dependency. OpenAI is simultaneously the vendor most central to NVIDIA's revenue and the one actively engineering the dependency out of its own fleet (Jalapeño, watch-listed at Layer 0).
The deepest inference and agent-execution surface on the instrument. Model serving at the industry's largest scale through the Responses API: the GPT-5.6 family (Sol/Terra/Luna, GA July 9, 2026), GPT-5.5/5.4, Codex models, all multimodal. Around the serving core, a real agent runtime estate: the open-source Agents SDK (handoffs, guardrails, sessions, tracing), Codex as a hosted autonomous coding agent with cloud sandboxes, hosted tool execution (code-interpreter containers, computer use, web search, file search), ChatKit for embedding, and managed fine-tuning including reinforcement fine-tuning. And the escape valve no other closed frontier lab ships: gpt-oss-120b and gpt-oss-20b, Apache 2.0 open-weight models an enterprise can run on its own hardware with no OpenAI relationship at all. Frontier-pegged strong by rule 6 and genuinely at the frontier: the serving scale, the model family, and the agent-execution estate stand with Azure Foundry and the Gemini Enterprise Agent Platform, and above them on raw serving. The capable-but-captive ruling applies cleanly: platform binding is an authority finding on the DAPM axis, not a capability deduction. The authority map is graduated, and that is this cell's distinctive finding. The completions interface has become the S3 of inference: a genuine multi-vendor standard implemented by independent vendors across the industry, with an entire routing ecosystem existing precisely because swaps work. Plain completions consumption is therefore the most portable position in the OpenAI relationship (Delegated). Every step past the standard interface — Responses-native state and hosted tools, fine-tunes, the Codex harness — moves authority toward Ceded. Capture is not a property of the vendor relationship; it is a function of how far past the standard interface the buyer builds.
The most concentrated model-judgment inheritance on the instrument: alignment, refusal behavior, safety tuning, and — distinctly — lifecycle judgment. OpenAI retires and swaps models on its own cadence, and behavior drifts under the enterprise's feet unless versions are pinned; the wrapper-churn finding at 1B has a model-layer sibling here. The mitigations are real: version pinning, the four-month first-mover lag before models reach other clouds, and the gpt-oss exit. The switching cost itself is architectural, not fixed: production swaps across model vendors — Gemini-class to GPT-5.6-class with no rebuild — are documented where the application's logic lives in deterministic code and the model does bounded work behind the standard interface (Lab 006, 'Put the judgment in the constraints, not the weights'). DCITL-style builds make the model a commodity; prompt-deep builds re-create Ceded one prompt at a time. The vendor does not decide which position the buyer is in. The buyer's architecture does.
Watch-list (dated, not scored): Workspace Agents (research preview April 22, 2026, credit-based pricing from May 6, 2026) — the custom-GPTs successor, Codex-powered persistent agents shared across an organization; likely a 2B/3 straddle at GA. OpenAI Frontier (launched February 5, 2026; limited availability as of July 2026, custom pricing, named customers HP, Intuit, Oracle, State Farm, Thermo Fisher, Uber) — limited availability is a disqualifying status under the GA-gate, ratified on this row. Agent Builder and Evals retire November 30, 2026; Assistants API shuts down August 26, 2026 (both narrated at 1B). Fact question flagged as inference: the Agents SDK's model-agnosticism (running against non-OpenAI compatible endpoints) is doc-supported, but what silently degrades off-platform — tracing, guardrail integrations — is a briefing question.
Policy-driven placement and resource coordination — the Autonomy Layer
NVIDIA controls no governance surface here — and neither, yet, does OpenAI. The near-empty column continues.
What ships today: workspace and tenant administration with RBAC over which connectors, apps, and tools users and agents may touch; the Compliance API streaming full interaction logs into eDiscovery/DLP/SIEM tooling; guardrails as an open-source library inside the Agents SDK; sandbox-level controls on Codex cloud environments (network egress policy, secrets handling); and user-confirmation gates on consequential agent-mode actions. An enterprise can constrain what OpenAI's surfaces are allowed to reach, and audit what happened after the fact. None of that is a reasoning plane, and the sharper finding is that OpenAI's actual 2C story is entirely pre-GA. Frontier — the agent registry, per-agent permissions, onboarding lifecycle, feedback loops, model-agnostic governance, the 'treat agents like employees' claim — is the productized 2C, and it is limited availability, watch-listed under the GA-gate. What is GA is platform administration, not agent governance: no agent identity system, no registry, no cross-agent gateway or broker, no policy engine evaluating anything at request time beyond connector allow-lists. Calibration is the crisp part. The moderate cohort at 2C (Salesforce, AWS, Databricks, IBM) earned it on a productized governance plane — gateway plus registry plus governed agent identity, GA, enforcing statically authored policy. The gap cohort is defined as inherited permissions and at most a thin gateway rather than a productized governance plane. OpenAI's GA surface — inherited source-system permissions, workspace RBAC, log export, a client-side guardrails library — matches the gap cohort's description almost word for word. The real-dependence guardrail does not rescue it: admin RBAC is dependence on platform administration, the same trust apparatus ruled sub-threshold at 1A. The headline finding: the vendor whose models power more production agents than anyone else's ships no GA plane to govern them. Today, OpenAI agents are governed by other vendors' 2C products — Microsoft Agent 365 registers them, MuleSoft Agent Fabric brokers and meters them, Entra Agent ID gives them identities. OpenAI is the object of everyone else's reasoning plane and the operator of none, pending Frontier — which is honestly framed as OpenAI's attempt to reclaim the governance layer currently being built on top of it. The universal findings are logged as universal, not charged to this vendor: no live infrastructure placement (the customer cannot even express a placement policy — consistent with the 2A finding that the fleet is multi-owner and invisible), and no deterministic outcome validation (SDK guardrails are prompt-shaped or code the developer writes; the platform validates legality of tool access, never rightness of outcome — you can't prompt your way to deterministic output). Routing-is-not-reasoning, vendor-specific note: ChatGPT's automatic model routing across the 5.6 family is opaque vendor-side model selection, the same sub-threshold signal as Salesforce Default's managed mix.
There is no judgment to borrow — the enterprise retains full responsibility for this function, and in practice discharges it with a different vendor's product. An OpenAI-centric agent estate today has someone else's reasoning plane or none. That is the most consequential architecture decision an OpenAI buyer makes, and it is made outside the OpenAI relationship entirely.
Watch-list (February 5, 2026; checked July 2026): OpenAI Frontier — limited availability, custom pricing, six named customers; the entire scored future of this cell rides on its GA. Ruling ratified on this row: limited availability is a disqualifying status under the GA-gate; marketing cadence must not move the heat map. Watch-list: Workspace Agents' sharing/permission model (research preview). Fact questions: (1) the AgentKit Connector Registry (beta at launch) — GA, still beta, or absorbed into the admin console post-wind-down? A GA centralized tool-governance registry would give the thin-gateway argument for moderate a leg. (2) Within the Workspace Agents preview, are the admin governance controls themselves GA for enterprise admins even while the feature is preview? Read: they ride the preview flag and do not score.
AI-powered business capabilities — business logic, workflow automation
GA. The horizontal knowledge-work surface: projects, company knowledge, deep research, agent mode, memory. The accumulated workspace estate — habits, instructions, groundings, working context — is the fastest-compounding captive artifact set on the instrument, and it survives model interchangeability entirely: swap the model underneath and none of it moves, which is precisely what makes it the moat. Proprietary platform, no open exit.
GA across cloud, CLI, and IDE surfaces. The application-altitude relationship: issue-to-PR delegation, code review, autonomous task execution against the enterprise's repos. AGENTS.md conventions are portable texture; the application relationship and its accumulated delegation patterns are not. Runtime scored at 2B, not double-counted.
GA as application and API (doc-confirmed via standard customer dashboard availability, July 2026). Creative-generation surface; prompts, styles, and workflow integrations are captive to the platform. Proprietary, no open exit.
GA (connectors renamed to apps December 17, 2025). Menu-altitude Delegated, matching AppExchange and Dell's Ecosystem Program: the pre-purchase choice among third-party apps is real, and each deployed app captures per its own terms. The interface split from 2B replays in miniature: an app's MCP-server core is built on a genuine multi-vendor standard and lifts to other MCP hosts; the OpenAI-specific UI components and the directory/monetization surface sit beyond the standard. The distribution judgment — which app ChatGPT invokes for a user's intent — is OpenAI's, and opaque.
The value plane is OpenAI IP end to end. The NVIDIA column closes the row empty on every customer-facing surface — the starkest NVIDIA finding on the instrument: the vendor most central to NVIDIA's revenue transmits zero NVIDIA dependency to its customers, because the API boundary absorbs all of it. The customer's silicon exposure through OpenAI is a price, not an architecture.
The largest-installed-base AI application on earth, and the row's center of gravity for the business buyer. ChatGPT Enterprise/Business is the horizontal knowledge-work surface: projects, company knowledge, deep research, agent mode. Codex is the developer application (runtime scored at 2B; the application altitude scores here, per the Azure precedent that put Foundry at 2B and GitHub Copilot at 3). Sora covers video and creative generation, as an application and through the API. Apps in ChatGPT (connectors renamed December 17, 2025) plus the Apps SDK turn ChatGPT itself into a distribution surface where third-party software meets users inside the conversation. Daybreak (May-June 2026) extends into a defensive-cybersecurity vertical. Strong, frontier-pegged, with the caveat named the way peers got theirs. This is a first-party value plane peer to Salesforce's on installed base, breadth, and product maturity. The caveat: OpenAI's GA Layer 3 is assistant-altitude — knowledge work, coding, creative. The business-execution altitude (agents executing workflows in systems of record under commit-boundary governance, which is what Salesforce's strong does all day) is exactly the part of OpenAI's story that is pre-GA: Frontier is limited availability, Workspace Agents is research preview. The strong stands on what ships; the caveat keeps it honest about domain. A distribution-authority finding new to the instrument: when ChatGPT decides which third-party app to invoke for a user's intent, OpenAI holds app-store-grade distribution judgment inside the conversation itself, opaque to both the enterprise and the ISV.
The capture here is coupled and visible, Salesforce-style, but broader and faster-compounding: the workforce's daily habits, projects, custom instructions, memory, and grounded workflows accumulate in OpenAI's namespace and lift nowhere — and they accumulate per user per day rather than per admin per release cycle. Practitioner-conversation sentiment supplies the clean evidence, because it holds capability constant: users of the consumer product do not complain about rival models' capability — they rate Gemini and Claude as capable enough for their needs — they stay because the memory and context do not move. The moat was never the model. The model is the commodity (proven by production swaps at 2B); the platform surfaces and the accumulated context estate are the capture, which is why the platform owners are racing up-stack while the models commoditize underneath them. The more judgment you borrow, the harder it is to leave as capabilities grow. The blast-radius point from the Azure row applies at maximum width: this is every employee's daily tool, not a department's.
Watch-list (dated, not scored): Workspace Agents (research preview April 22, 2026) — the business-execution bridge; scores at GA, likely straddling 2B/3. OpenAI Frontier (February 5, 2026, limited availability) — the systems-of-record execution story. Daybreak's gated tiers (GPT-5.5 Trusted Access for Cyber and GPT-5.5-Cyber, May 11 and June 22-23, 2026) are verification-gated and do not score; the open-access Daybreak components are context. Sora API availability doc-confirmed via standard customer API dashboard access (no special relationship), July 2026.
OpenAI is the inversion of the traditional infrastructure vendor. The company conducting the largest AI infrastructure buildout in history sells none of it: Stargate, the serving fleet spread across OpenAI-operated, Azure, AWS, and Oracle capacity, and the Jalapeño inference chip are OpenAI's supply chain, not the customer's menu. What a customer can actually deploy is the top of the stack: frontier model serving, an agent runtime, and the most widely used AI application on earth. Everything below that, compute, data foundation, pipelines, orchestration, stays the enterprise's responsibility, by design.
The capture is two-tier, and the tiers point in opposite directions. The model is the commodity; the platform is the capture. The OpenAI-compatible completions interface has become the S3 of inference — a genuine multi-vendor standard implemented across the industry, hot-swappable in production when the application's logic lives in deterministic code rather than in the model — and gpt-oss is a real Apache 2.0 open-weight exit. That openness is genuine, and it is the reassuring layer. The captivity accumulates beyond it: the Responses platform surface, fine-tunes whose weights never export, the Codex harness, and above all the accumulated context estate. Consumer sentiment is the clean evidence: users don't complain about rival models' capability — they rate the alternatives as capable enough — they stay because memory and context don't move. The more judgment you borrow, the harder it is to leave as capabilities grow.
That is the same capture mechanism as the deepest coupled lock-in in enterprise software, running at conversational speed. Salesforce accumulates org config and sharing logic over decades of admin decisions; OpenAI accumulates memory, groundings, and working context per user per day, which makes it faster-compounding and harder to audit. Enterprise architects should read ChatGPT's consumer memory lock-in as the preview of what company knowledge and workspace-scale context become at enterprise scale.
The governance hole is the row's sharpest asymmetry. The vendor whose models power more production agents than anyone else's ships no generally available plane to govern them. Today, OpenAI-powered agent estates are governed by other vendors' reasoning planes — Microsoft Agent 365 registers them, MuleSoft Agent Fabric brokers and meters them, Entra Agent ID gives them identities. OpenAI is the object of everyone else's Layer 2C and the operator of none. Frontier is the reclaim attempt — agent registry, per-agent permissions, onboarding lifecycle, model-agnostic governance — and it is limited availability, watch-listed until a customer can buy it per the docs.
Platform mutability is the finding a capability grade can't carry, so the row carries it in prose: the primitives hold and the wrappers die on schedule. Custom GPTs gave way to Workspace Agents, the Assistants API shuts down August 26, 2026, Agent Builder and Evals retire November 30, 2026 — while the models, the Responses API, and the vector stores persist underneath. Lab 001's guidance, extended: build against the primitive, not the wrapper. The wrapper adds captivity and subtracts visibility while it lives, and the vendor's own history says the wrapper is the layer that dies.
The buyer's trade: frontier intelligence, the largest application estate in the market, zero infrastructure burden, and zero transmitted NVIDIA exposure. In exchange, the buyer's Layer 0 through 2A position is not just unowned but unknowable — the same token contract can be served from four different owners' silicon — and the judgment estate compounds toward captivity by default. The exits are real: the standard interface, the open weights, the multi-cloud channels. But every exit is an architectural decision the buyer must make on day one, because none of them is the default, and the default path borrows more judgment every day it runs.