This Elastic rule detects OpenAI ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings; promoting a compromised or malicious account to owner grants durable control-plane access. The rule matches events from openai_chatgpt_enterprise.audit_log with event.action == 'user_role_updated' and where action_data.new_role == 'account-owner' or action_data.role == 'account-owner'. It surfaces key fields such as user.id, user.email, the target role, previous role, actor privileges, and source IP to support rapid triage. The detection maps to MITRE ATT&CK concepts (Account Manipulation T1098 and subtechnique T1098.003, plus Persistence and Privilege Escalation) and aligns with MITRE ATLAS AML.T0012 (Valid Accounts) and AML.TA0012 (Privilege Escalation). It relies on the OpenAI ChatGPT Enterprise integration to ingest compliance logs. The rule is time-bounded (from now-9m) to catch recent escalations and includes an investigation guide, false-positive considerations, and remediation steps. Triage should escalate when there is no change-management authorization, the actor is unexpected, or privileged activity follows; false positives include approved staff promotions. Remediation includes downgrading unauthorized owners, revoking sessions, and auditing related IAM changes by the same actor.