Lighthouse AdvisorySLED AI Adoption Intelligence
← Back to results

From the OpenAI edition of October 30, 2026

Vendor claimEmergingPeer review status unknownUndated source

OpenAI guide configures Codex and the ChatGPT desktop app for Bedrock inference in AWS GovCloud, with restrictive defaults and no ATO claim

OpenAI · State and local government (also federal) · United States

OpenAI
Publisher
OpenAI ChatGPT Learn
Original publication
Undated documentation; AWS announcement dated October 30, 2026
Source retrieved
2026-10-31
Event date
2026-10-30
Read original source

What happened

OpenAI documents a local Codex and ChatGPT desktop deployment that sends inference to Amazon Bedrock in AWS GovCloud: it requires desktop version 26.1002.51308 or later, MDM-delivered requirements.toml with restrictive defaults (MCP servers, apps and plugins off; OpenAI endpoints denied), and states it is not legal advice and does not grant an ATO. An AWS post dated Oct. 30 (also inspected) announces the availability.

Why it matters

Gives state and local agencies with GovCloud-bound security plans an OpenAI-documented path to coding and agent tools without sending data to OpenAI endpoints, though authorization stays with the agency.

Evidence and measured results

Vendor configuration guidance only; no deployments or outcomes reported. The AWS post notes ChatGPT workspace rules and user roles do not control this setup.

Limitations and uncertainty

Scope note: AWS-delivered infrastructure details belong to the aws stream; this item covers OpenAI's product configuration. Documentation is undated; no SLED adopters named.

Cross-source patterns this evidence supports

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-31; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway
Customer problem
Agencies with GovCloud-bound security plans could not use OpenAI coding and agent tools under their data-boundary requirements.
Stakeholders
  • Agency CISO
  • Application development lead
  • Authorizing official
  • Cloud platform team
Discovery questions
  • Does your security plan require GovCloud inference?
  • Do you manage developer devices with MDM?
  • Who would authorize an agent tool on workstations?
Value hypothesis
A controlled GovCloud pilot may let developers use Codex without data leaving the agency's AWS boundary; productivity is unmeasured.
Potential engagement
A bounded pilot on a small set of managed developer devices with a security review package.
Unsupported claims
  • That the setup is authorized or compliant
  • Developer productivity gains
  • That workspace governance applies

Pre-sales engineering

Role takeaway
Fit
Agencies already on AWS GovCloud with managed developer endpoints.
Architecture and integration
ChatGPT desktop/Codex CLI on managed devices, inference via Bedrock Mantle in us-gov-west-1 using IAM or Bedrock API keys.
Prerequisites
  • AWS GovCloud account with approved model access
  • MDM deployment of requirements.toml and config.toml
  • Network egress allowlist
  • Desktop version 26.1002.51308+
Constraints
  • Not an ATO
  • GovCloud region feature differences
  • Workspace controls do not apply
Security
Restrictive sandbox defaults, MCP and plugins off, OpenAI endpoints denied; protect credentials and SSO caches from agent writes.
Proof of value
  • Confirm provider shows amazon-bedrock
  • Verify blocked egress to non-approved endpoints
  • Test rollback and credential revocation

Delivery

Role takeaway
Work
Deploy configuration via MDM, validate controls, run a scoped developer pilot and document results.
Dependencies
  • GovCloud account
  • MDM tooling
  • Security review
Ownership
Agency CISO with the application development lead.
Skills and adoption
Developer training on approval modes and sandbox limits.
Governance checkpoints
  • Security review before pilot
  • Authorizing official sign-off before expansion
Acceptance criteria
  • All pilot devices verified on approved endpoint (proposed)
  • Zero unapproved egress in pilot logs (proposed)
Risks
  • Misconfigured policy enabling unapproved tools
  • Credential exposure
  • Assuming GovCloud equals compliance

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

Local desktop/CLI agent with inference on Bedrock Mantle in us-gov-west-1; controls shift from ChatGPT workspace admin to device MDM, IAM and network policy.

Governance

Who approves, reviews and stays accountable for outcomes?

Agencies must own the ATO, device policy and network restrictions; workspace governance does not apply.

Security and privacy

What data, permissions and controls need testing?

Credentials must be kept out of config files; agent sandboxing and network isolation are the main controls; browser and computer use are left to agency risk appetite.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

Developer-focused; limited relevance to general staff.

Procurement

What should contracts, pricing and exit terms secure?

Per-token AWS billing rather than ChatGPT seats, per the AWS post.

Operating model

Which teams own the service once it runs?

Moves AI tool governance to device management and cloud IAM teams.

Publication history

  1. 2026-10-30OpenAI · Issue 027 resources
Read preserved resource versions (JSON)

Stable resource ID: openai-codex-chatgpt-desktop-bedrock-govcloud-guide-202610