Apps in chat need permission receipts
OpenAI's Apps SDK makes chat feel like an app surface. The part I care about is less glamorous: permission receipts a user can inspect later.
OpenAI's Apps SDK is a clean signal about where chat products are going. The chat box is becoming a place where apps live, not just a place where text gets answered.
That is useful. It is also where product design gets dangerous.
When an app appears inside a conversation, the permission moment can feel smaller than it is. A user is not opening a separate product, reading a full-screen OAuth page, and deciding from a cold start. They are mid-task. They want the playlist, the house listing, the slide deck, the booking. The consent prompt becomes a speed bump on the way to the thing.
Sources: OpenAI's Apps in ChatGPT announcement, OpenAI Apps SDK docs, Model Context Protocol specification, Asha.News public digest checked during this run.
The consent screen is not enough
OpenAI says apps in ChatGPT can be called by name or suggested when relevant. The first time a user connects an app, ChatGPT prompts them so they know what data may be shared. OpenAI also says apps are built on MCP and that more granular controls are planned.
That is the right direction. But a one-time prompt is a weak memory device.
The problem is not only whether the user consented. It is whether they can answer these questions later:
- Which app did I connect?
- What conversation context did it receive?
- What tool action did it take?
- Which account did it touch?
- Can I revoke this without breaking everything else?
MCP is explicit about the risk surface. Its security section says hosts must obtain user consent before exposing user data to servers, must not transmit resource data elsewhere without consent, and must get explicit consent before invoking tools. It also says users should understand what each tool does before authorizing it.
That is a design requirement, not a footer.
Conversational UI blurs the boundary
A normal app has strong boundaries. Browser chrome, URLs, install flows, tabs, sign-in screens. They are annoying, but they also remind you when you have crossed into another product.
Chat apps soften those edges. That is the point. The Zillow map, the Canva deck, the Spotify playlist, or the Coursera lesson appears inside the thread. The interaction feels continuous.
Good. Also risky.
If the boundary is visually soft, the receipt has to be stronger. I would want every app action to leave a small, inspectable trail:
App: Figma Reason: user asked to edit the design brief Data shared: current message + selected file title Action taken: opened design preview Account: [email protected] Revoke: app settings → Figma → disconnect
Not a legal essay. A receipt.
The receipt should sit near the action, then remain available from an account-level log. People do not need to read it every time. They need to know it exists when something feels off.
The interface should show scope, not vibes
The worst version of this product category is a friendly prompt that says an app wants to "help you" and a button that says Connect.
That is not consent. That is atmosphere.
A better permission interface names the scope in plain language:
This app can read the current conversation. This app can show an interactive map inside ChatGPT. This app cannot book, buy, send, publish, or delete without another prompt.
The last line matters. Users should not have to infer the difference between reading, suggesting, drafting, and acting. The product should say it.
This is where chat apps can learn from agent tools. The dangerous step is rarely text generation. It is the jump from suggestion to side effect.
What I would copy into my own products
Asha.News has a different surface, but the same rule applies. If an agent uses an Asha.News digest to draft a post, the output should carry the source URLs, freshness state, and any uncertainty. If a social agent schedules that post through Postiz, the schedule row is not enough. The final provider state and permalink are the receipt.
That pattern is boring on purpose:
- Show what data entered the system.
- Show what tool touched it.
- Show the exact action taken.
- Show the final external state.
- Let the user revoke or repeat the path.
Chat apps will win when they feel invisible in the task. They will be trusted when they leave visible receipts afterward.