This rule detects OpenAI ChatGPT Enterprise workspace feature flag toggles by auditing logs. When a user enables or disables a workspace feature (for example, GPT sharing), the change can expose more data or weaken controls, potentially enabling persistence or broader access. The detection relies on the OpenAI ChatGPT Enterprise integration that feeds compliance logs into Elasticsearch. The ESQL query filters for the openai_chatgpt_enterprise.audit_log dataset and event.action equals workspace_toggle_feature, returning fields such as @timestamp, user.id, user.email, source.ip, action_data.feature, action_data.value, action_privilege, and related data_stream context. The rule maps to MITRE ATT&CK T1562 Impair Defenses (Defense Evasion) and MITRE ATLAS AML.T0081 Modify AI Agent Configuration under Persistence. Investigation fields emphasize identifying the actor, the specific feature toggled, and whether the change increases sharing or weakens security controls, plus correlation with other admin actions and any approved change requests. False positives include administrator-driven toggles during approved rollouts. Remediation guidance includes reverting unauthorized toggles, reviewing other actions by the same actor, and confirming change-control approvals.