This rule detects OpenAI ChatGPT Enterprise app authentication events where a third‑party application is linked to a user or workspace, establishing a durable OAuth‑style access that could be abused to persist access after initial compromise. It analyzes OpenAI ChatGPT Enterprise app_auth_log data streams, focusing on events with event.action == 'link' and excluding a small set of known approved connectors by app_id. An alert is raised when an unapproved app is linked, particularly if the actor exhibits suspicious authentication activity or multiple unusual app links occur within a short window. The rule surfaces potential persistence vectors involving third‑party app linkages that could grant access to sensitive data or connectors. It aligns with MITRE ATT&CK T1098 (Account Manipulation) under Persistence and with MITRE ATLAS AML.T0081 (Modify AI Agent Configuration) under Persistence guidance, providing investigation context for remediation.