A coding agent that can edit a repository is not a chat window. It can see the work, change the work, and reach the network if you leave that path open. For a regulated team, that reach is the decision. Traffic to a commercial model endpoint is a default risk you deny on purpose. A GovCloud route does not make the risk impossible just by existing.
AWS has published a walkthrough for running the ChatGPT desktop app against Amazon Bedrock in AWS GovCloud (US). OpenAI has published a separate guide, “Configuring Codex for Inference with Amazon Bedrock in GovCloud.” The path OpenAI actually documents for engineering teams is Codex sending inference to Amazon Bedrock Mantle in us-gov-west-1. Authentication is AWS, not an ordinary ChatGPT workspace user.
Mantle is the OpenAI-compatible Amazon Bedrock endpoint this route uses, the bedrock-mantle host. It is not a direct OpenAI government API. Responses is the API style the sample selects. It is not a retention switch.
The two documents do not match in every field. Treat them as two control specs, not one recipe. If you are putting AI agents on real work, a seat in a chatbot admin console will not settle it. Inference, identity, network egress, and retention each have to sit on rails you chose.
A configured endpoint is not an authorization
OpenAI’s guide sets the model provider to amazon-bedrock, the Region to us-gov-west-1, OpenAI authentication to off, and the wire API to responses. The base URL in that sample is:
https://bedrock-mantle.us-gov-west-1.api.aws/openai/v1
The sample is configured to send inference to that host. That is what the guide specifies. It is not a test result. It is not proof that every byte of the workflow stays in the Region. And it is not permission to operate.
OpenAI’s guide “is not legal advice and does not grant an authorization to operate (ATO), ” and “Using GovCloud for inference does not establish that the entire workflow meets your agency’s requirements.”
AWS’s walkthrough makes the same point in operational language: “Using AWS GovCloud (US) and following this guide do not, by themselves, authorize your workload.” OpenAI also points agencies to the AWS shared responsibility model. Devices, credentials, repositories, local records, enabled third-party services, and the authorization decision stay with the customer.
Desktop support is version-gated. OpenAI’s guide says to use desktop app version 26.1002.51308 or later, as shown in About. The managed requirements have to be deployed through system configuration or mobile device management before the app launches. Another Region or endpoint means updating the URL, the Region, and the network policy together. A rewritten URL is not a supported integration.
The workspace console does not govern this
AWS’s walkthrough is direct: “Because this setup uses AWS directly, ChatGPT workspace rules and user roles don’t control it.” What still applies is the computer’s policy and the AWS identity in use.
If your AI automation program still assumes a vendor workspace decides who can do what, this deployment will not inherit those rules. A buyer should not miss four controls. The guide shuts off a long list of other app features. Read that list there. Do not treat a summary as the policy.
- Identity. Access is an AWS IAM problem, including the named profile the process actually uses. ChatGPT roles do not travel with this setup.
- Egress. The managed requirements file is where allowed and denied hosts belong. A Bedrock URL does not block commercial OpenAI hosts for you.
- Browser and computer use. The recommended policy turns both off. OpenAI says those features can reach whatever the computer can reach, and that it does not currently add protections restricting those network paths.
- Who can widen the policy. An administrator can turn features back on after accepting the risk. Users cannot override the managed requirements file. The sample is a restrictive starting point, not the only lawful configuration, and not a substitute for your system security plan.
OpenAI explicitly recommends denying OpenAI and ChatGPT endpoints “to avoid any risk that user data is sent to commercial OpenAI infrastructure.” That list includes the commercial hosts and also gov.api.openai.com and gov.chatgpt.com. This Mantle route is distinct from those government OpenAI endpoints. Denying them is a control you deploy.
Do not merge the two sample files
Put the AWS walkthrough’s example next to OpenAI’s recommended sample and the files will argue. Let them. Copying the wrong line is how a pilot fails a review.
- Profile name. OpenAI’s sample profile is codex-govcloud, and the instruction is to replace it. The walkthrough’s example name, codex-il5, does not appear in OpenAI’s guide. Nothing in either document establishes an IL5 authorization. If that sample name lands in an authorization package, an assessor can read it as an impact-level claim you never made.
- Model ID. OpenAI’s example model ID is openai.gpt-5.6-terra, with an instruction to replace it with an approved Bedrock model ID. That string is an example, not evidence the model is approved in your GovCloud account. The walkthrough uses a placeholder instead. Neither document lists the approved OpenAI model IDs or their retention modes. An assessor will ask for the current model card and the access your account actually has.
- Web search. OpenAI’s sample sets web search to disabled. Cached search is only for the case where the model, the GovCloud Region, and the deployment approval support it. The walkthrough’s sample uses cached. Shipping cached because one example file says so, without that approval, adds a data flow your package may not describe.
- Sandbox network access. OpenAI’s sample sets it to true, with command destinations controlled by the managed requirements file. The walkthrough’s sample sets it to false. If the narrative says commands cannot reach the network and the file says they can, the review fails on the mismatch. Pick one and describe that one.
- Windows sandbox. OpenAI’s sample allows the elevated sandbox implementation. The walkthrough instead says sandbox_private_desktop must be supported by the approved runtime. A name the runtime does not honor is not a restriction. Confirm the implementation against the runtime you are approved to run.
- Where API-only login lives. In OpenAI’s guide, API-only login is set in the administrator requirements file, which users cannot override. The walkthrough also shows a user-level login flag. Those are not the same control. Deploy the managed file before the first launch, or the capability limits are not the policy you think you shipped.
Keep credentials, bearer tokens, session tokens, and other secrets out of TOML files. The AWS profile, credential files, and helper scripts also have to sit outside any folder Codex can modify. Secrets in a config the agent can edit are not a control. They are a suggestion.
AWS’s walkthrough also describes a Work mode for larger planning and file tasks, and Codex through a command-line tool and IDE integrations. OpenAI’s GovCloud guide, as published for this path, documents Codex inference through the desktop app. Build the authorization package around the path you can configure and verify, not around every surface a companion document names.
Which file actually controls the network
These samples use more than one network control. Reading them as a single allow-list is how the contradiction shows up.
OpenAI’s recommended requirements file is the domain policy. It names bedrock-mantle.us-gov-west-1.api.aws as an allowed host and lists OpenAI and ChatGPT hosts to deny, including the government hosts above. The same policy turns network controls on, limits allowed domains to what the managed policy permits, and allows no domains by default. The managed file is what permits the Mantle host. A user config does not get to widen that list on its own.
Separately, OpenAI’s sample user config sets sandbox network access to true and says command destinations are controlled by the requirements file. The walkthrough’s sample sets sandbox network access to false, so sandboxed writes do not get that network path at all. Those are different egress stories. Document the one you deployed.
Pointing the base URL at Bedrock does not apply either story. Without the managed deny list, commercial OpenAI hosts can remain reachable.
If an administrator turns browser use or computer use back on, OpenAI says those features can reach whatever the computer can reach, and that it does not currently add protections restricting those paths. The guides do not say the domain allow-list covers those features. Treat turning them on as a new data-flow review. It is not a toggle inside a policy you already approved.
Zero retention has an exception
The walkthrough says zero data retention is supported, and that in that mode prompts and responses are processed without durable storage by AWS or sharing with model providers. That sentence is too clean for a security plan.
AWS’s Security Blog post, “Enforce zero data retention on Amazon Bedrock with Bedrock Projects and service control policies, ” updated August 13, 2026, is the clearer account. Three rules are enough to brief a leadership team.
- What mode none discards. Prompts and responses are processed and immediately discarded, and they are not shared with the provider.
- What can still be kept. Even in that mode, Amazon Bedrock may store and review content flagged by automated CSAM detection so it can be reported. Anyone writing “we retain nothing, ” without that exception, is overstating the product. The mode is also not an inventory of every log, metadata field, or operational record.
- What provider sharing permits. Opting into provider data sharing means data may be shared with the provider and retained for up to 30 days for trust and safety. Models that require that mode stay unavailable until the account or project explicitly opts in. Under the default mode, some models may retain data for trust and safety for up to 30 days without provider sharing. Default does not mean “never retained, ” and it does not mean “always shared with the provider.” Read the current model card. Requirements can change.
The mode you set is a maximum, not a minimum. A model that can run without retention still does, even if the account would allow a looser mode.
You can set that maximum per account and Region, per project, with IAM, and with organization service control policies that block opting into data sharing. Service control policies do not cover the management account. IAM has to do that job there. A project set to inherit defers to the account, and an account set to inherit defers to the service default. Leaving an account on inherit or default does not, by itself, start provider sharing just because a model could use it.
On the Mantle endpoint, Amazon Bedrock Projects are the documented way to put different ceilings on different workloads in the same account. A research project can allow provider data sharing while a production project stays at none, for models that support those modes. Confirm each one on the current model card. Otherwise an experiment and a production repository are sharing a ceiling you did not mean to share.
One limit sits next to the wire API, and it is easy to misread. AWS says the Responses API with store set to true requires retention and is blocked when the mode is none. The GovCloud sample selects Responses. Neither guide says this Codex path sets store to true. Do not treat that wire setting as proof that zero retention is on, or that it cannot be.
Questions to settle before the pilot leaves one laptop
Does GovCloud, plus either guide, authorize the workload?
No. OpenAI says the guide is not legal advice, does not grant an ATO, and that GovCloud inference does not establish that the whole workflow meets agency requirements. AWS says using GovCloud and following the guide do not, by themselves, authorize the workload. Devices, repositories, credentials, and local records remain yours.
Which desktop build is actually supported?
OpenAI’s guide requires version 26.1002.51308 or later, as shown in About. Push the managed policy through system configuration or mobile device management before the first launch, and confirm that build supports the GovCloud endpoint you are using.
If workspace roles do not apply, what does?
The AWS identity and permissions in use, plus the administrator policy on the machine. A Bedrock URL without the managed deny list still leaves commercial OpenAI hosts reachable until you block them.
What does zero retention actually discard?
In mode none, according to AWS’s Security Blog post updated August 13, 2026, prompts and responses are processed and immediately discarded and are not shared with the provider. Amazon Bedrock may still store and review content flagged by automated CSAM detection for reporting. The mode is not a promise about every log or operational record.
Can research and production share an account?
Yes, if you separate them with Amazon Bedrock Projects on the Mantle endpoint and give them different retention ceilings, for models that support those modes. Confirm each model on the current model card before you treat the project setting as the mode you will actually get.
What does the walkthrough say this costs?
AWS’s walkthrough says you pay per token, with no seat licenses and no per-developer commitments. It does not publish rates or token-accounting rules. Price the pilot from your AWS agreement, not from that sentence.
The useful pattern is an AI agent whose inference route, identity, network egress, and retention ceiling are each an explicit choice. “ChatGPT, but in a government Region” is the wrong brief. Teams that copy a sample file and call it compliant will hear the difference in the authorization meeting. Teams that pick the model from the current card, pin the app version, deny the commercial endpoints, and split retention by project will have something a security officer can review.
The same four choices are the ones worth making outside GovCloud. Wherever an agent can write code, the route, the identity, the egress, and the retention ceiling matter more than the login screen.