OpenAI’s Forward-Deployed Engineers Make Enterprise AI a Field-Operations Business
OpenAI is formalizing forward-deployed engineering, a model for turning enterprise AI from a demo into an accountable operating system.
A software engineer sitting beside a customer’s legal, finance, or operations team is a different kind of AI product than a model exposed through an API. OpenAI’s October 22, 2026 explanation of forward-deployed engineering, or FDE, describes a role built around putting models into the customer’s real workflow, where permissions, data quality, exceptions, and institutional habits determine whether the system works. The announcement matters because it moves the center of enterprise AI away from model selection and toward the difficult last mile between a capable model and a process that can be trusted on a Tuesday afternoon.
The FDE idea also reveals a tension in the current AI market. Vendors want deployments that look repeatable and software-like; customers often need bespoke integration, judgment about ambiguous records, and a person who can explain why an agent did not take an action. OpenAI’s own language is a vendor account of the role, not independent proof that every deployment produces savings. But it is a useful admission: a frontier model does not arrive as an operating model. Someone has to translate capability into controls.
The role is closer to a systems engineer than a solutions salesperson
The most important detail in OpenAI’s description is not the title. It is the location of the work. FDEs operate where a general model meets a company’s particular tools and rules. That can mean mapping an approval chain, deciding which records are authoritative, testing retrieval against stale documents, or adding a review queue before an output changes a customer account. The work resembles production engineering because the question is not whether a prompt produces a persuasive answer. The question is whether the result remains safe when an input is missing, a policy has two interpretations, or an external system times out.
This role changes the buyer’s mental model. A company purchasing an AI assistant is also purchasing discovery, integration, evaluation, training, and maintenance. Those costs may be hidden inside a services engagement, but they do not disappear. FDEs make them visible. The strongest deployments will define an interface between the model and the business process: inputs, tools, allowed actions, escalation paths, evidence requirements, and a rollback procedure. Without that interface, the deployment is a prototype with a login screen.
Why enterprise context defeats the general-purpose demo
A demo can show a model summarizing a contract. An enterprise workflow must decide which contract version counts, whether a clause is within the assistant’s authority, how a missing exhibit is represented, and who signs off on the recommendation. OpenAI’s own examples of customer work, including AT&T’s legal-work account and other enterprise case studies, illustrate the difference between a polished answer and a controlled process. The value is created in the handoffs around the model.
Data access is only the first boundary. A retrieval system can find a relevant document and still produce the wrong operational conclusion because the document is superseded, the user lacks the right role, or the request silently mixes two business units. FDE work therefore includes negative testing: deliberately ambiguous requests, contradictory source records, revoked permissions, and actions that should be refused. This is less glamorous than a benchmark, but it is where enterprise liability lives.
The hidden product is the evaluation loop
An FDE deployment needs an evaluation set that reflects the customer’s actual work. For a legal team, that may include clause extraction, exception classification, and citation fidelity. For a support organization, it may include correct routing, tone, and the ability to abstain when a refund rule is unclear. The set should include normal cases and adversarial cases, then be rerun as prompts, models, tools, and policies change.
That loop also gives the customer negotiating power. Instead of asking whether a model is “smart,” the buyer can ask how it performs on the organization’s own error budget. How often does it invent a source? How often does it route a case to the wrong queue? How many actions require rework? How quickly can an operator understand a failure? An FDE can help build these measurements, but the customer should own them. Otherwise the vendor becomes the only party that can define success.
The economics of people around the model
Forward deployment is expensive precisely because it works on exceptions. A standardized product can amortize its design across thousands of customers; an FDE team spends time learning one company’s vocabulary, systems, and risk tolerance. OpenAI can justify that cost when the resulting workflow creates durable usage, larger contracts, or feedback that improves the platform. Customers should still separate one-time implementation from recurring operational work.
The staffing question is equally important. A company may need a process owner, a security reviewer, a data steward, and an engineer who can maintain tool integrations after the vendor team leaves. If the FDE becomes a permanent interpreter between the model and the customer, the deployment has not yet become a product. A good engagement leaves behind documentation, tests, ownership, and a path to change the system without waiting for a vendor appointment.
Where FDE can improve safety
Putting engineers close to users can reduce a familiar AI failure: building an impressive system around an invented understanding of the work. Field engineers observe how people actually resolve cases, which shortcuts are safe, and which “edge cases” happen every day. They can turn those observations into narrower permissions and better escalation rules.
There is a governance advantage too. If an assistant can draft but not send, recommend but not approve, or search but not alter a record, the organization can review the boundary in concrete terms. The FDE can make that boundary testable. Still, proximity is not independence. A vendor team embedded with a customer may be motivated to show adoption. Internal audit and security teams must retain authority to pause a workflow.
The danger of bespoke intelligence
Customization can create a new form of lock-in. A workflow may depend on private prompts, undocumented tool adapters, vendor-specific tracing, or an FDE team’s personal knowledge. When the model changes, the customer may discover that its “application” was actually a collection of fragile assumptions.
Portability should be a requirement from the first design meeting. Store business rules outside prompts where possible. Keep source citations and action logs in customer-controlled systems. Define a model-independent test suite. Export the agent’s tool contract. These practices do not make a deployment vendor-neutral, but they make its behavior inspectable and its replacement imaginable.
A field test for buyers
A serious pilot should name one workflow, one measurable outcome, and one unacceptable failure. It should capture the baseline before AI is introduced. If a claims team currently resolves a case in two days with a known error rate, the pilot should compare the complete process, including review time and escalations, rather than counting generated drafts.
Buyers should ask for examples of abstention, not only successful completion. They should inspect the logs of a wrong answer and a correctly refused request. They should also ask who can revoke a tool, rotate a credential, or stop the agent outside business hours. Those questions expose whether the system is owned as production software or merely showcased as a capability.
What changes for engineers
For engineers, FDE is a reminder that the application boundary is widening. The important artifacts are not only code and infrastructure. They include a decision inventory, data lineage, tool permissions, evaluation cases, reviewer instructions, and a change log that connects model updates to observed behavior.
This creates a new professional profile: someone who can read a business process, reason about model uncertainty, and ship ordinary software around extraordinary probabilistic components. That person must be comfortable saying no to an autonomous action when the evidence is thin. The best FDE practice is therefore not maximum automation. It is deliberate placement of automation inside a process that can absorb mistakes.
The next enterprise AI milestone is boring on purpose
OpenAI’s FDE announcement is easy to read as a hiring or go-to-market story. It is more revealing as a product signal. When a model vendor invests in people who enter customer operations, it acknowledges that the durable advantage is not just parameter count. It is the accumulated knowledge of how to connect models to permissions, evidence, and accountability.
The companies that benefit will resist the temptation to confuse closeness with control. They will use field work to discover a repeatable pattern, then turn that pattern into documented software and customer-owned governance. The measure of success is whether the workflow remains reliable after the original experts leave the room.
Evidence map for this story
The reporting above separates what the organizations announced from what follows as analysis. The primary documents used for the factual spine are:
- OpenAI, “What FDE means at OpenAI”
- OpenAI, “How AT&T is rethinking in-house legal work”
- OpenAI, “Broad access through consistent standards”
- OpenAI, API platform documentation
- NIST AI Risk Management Framework
- NIST Generative AI Profile
- OpenAI safety practices
- OpenAI enterprise privacy
- OpenAI preparedness framework
- OpenAI model spec
The decision readers should take away
The practical lesson is not that one vendor has solved the whole problem. It is that enterprise ai is becoming a design choice with operational consequences. Teams should name the boundary, assign a human owner, measure the failure mode, and make the permission to act narrower than the permission to suggest. That discipline is more durable than any launch-day benchmark.
graph TD
A[Customer workflow] --> B[Field discovery]
B --> C[Tools and evidence]
C --> D[Human review boundary]
D --> E[Measured production loop]
Operational question 1: what survives contact with the real system?
The production review
A deployment should be considered mature only when a new operator can understand it without interviewing the original project team. That means the customer needs a map of the workflow, a list of model and tool dependencies, examples of acceptable and unacceptable outputs, and a clear owner for each exception. The map should include the ordinary path and the paths that begin with missing data, conflicting policies, or a user request outside the system’s scope. This is where field engineering becomes organizational learning instead of permanent consulting.
The handoff also tests whether the product has a stable abstraction. If every customer requires a new hidden instruction, a private connector, and a custom monitoring script, then the vendor has learned something but has not yet built a repeatable product. Buyers should ask which artifacts will become standard after the engagement and which will remain customer-specific. That distinction helps forecast maintenance cost and prevents a pilot from being approved on an unrealistically low first-month bill.
A useful contract can make this concrete. It can require export of prompts, tool schemas, evaluation cases, audit records, and configuration. It can specify notification before a model change and give the customer a way to rerun its acceptance tests. These provisions do not eliminate vendor dependence, but they turn dependence into a visible engineering risk that can be managed.
Operational question 2: what survives contact with the real system?
The production review
A deployment should be considered mature only when a new operator can understand it without interviewing the original project team. That means the customer needs a map of the workflow, a list of model and tool dependencies, examples of acceptable and unacceptable outputs, and a clear owner for each exception. The map should include the ordinary path and the paths that begin with missing data, conflicting policies, or a user request outside the system’s scope. This is where field engineering becomes organizational learning instead of permanent consulting.
The handoff also tests whether the product has a stable abstraction. If every customer requires a new hidden instruction, a private connector, and a custom monitoring script, then the vendor has learned something but has not yet built a repeatable product. Buyers should ask which artifacts will become standard after the engagement and which will remain customer-specific. That distinction helps forecast maintenance cost and prevents a pilot from being approved on an unrealistically low first-month bill.
A useful contract can make this concrete. It can require export of prompts, tool schemas, evaluation cases, audit records, and configuration. It can specify notification before a model change and give the customer a way to rerun its acceptance tests. These provisions do not eliminate vendor dependence, but they turn dependence into a visible engineering risk that can be managed.
Operational question 3: what survives contact with the real system?
The production review
A deployment should be considered mature only when a new operator can understand it without interviewing the original project team. That means the customer needs a map of the workflow, a list of model and tool dependencies, examples of acceptable and unacceptable outputs, and a clear owner for each exception. The map should include the ordinary path and the paths that begin with missing data, conflicting policies, or a user request outside the system’s scope. This is where field engineering becomes organizational learning instead of permanent consulting.
The handoff also tests whether the product has a stable abstraction. If every customer requires a new hidden instruction, a private connector, and a custom monitoring script, then the vendor has learned something but has not yet built a repeatable product. Buyers should ask which artifacts will become standard after the engagement and which will remain customer-specific. That distinction helps forecast maintenance cost and prevents a pilot from being approved on an unrealistically low first-month bill.
A useful contract can make this concrete. It can require export of prompts, tool schemas, evaluation cases, audit records, and configuration. It can specify notification before a model change and give the customer a way to rerun its acceptance tests. These provisions do not eliminate vendor dependence, but they turn dependence into a visible engineering risk that can be managed.
Operational question 4: what survives contact with the real system?
The production review
A deployment should be considered mature only when a new operator can understand it without interviewing the original project team. That means the customer needs a map of the workflow, a list of model and tool dependencies, examples of acceptable and unacceptable outputs, and a clear owner for each exception. The map should include the ordinary path and the paths that begin with missing data, conflicting policies, or a user request outside the system’s scope. This is where field engineering becomes organizational learning instead of permanent consulting.
The handoff also tests whether the product has a stable abstraction. If every customer requires a new hidden instruction, a private connector, and a custom monitoring script, then the vendor has learned something but has not yet built a repeatable product. Buyers should ask which artifacts will become standard after the engagement and which will remain customer-specific. That distinction helps forecast maintenance cost and prevents a pilot from being approved on an unrealistically low first-month bill.
A useful contract can make this concrete. It can require export of prompts, tool schemas, evaluation cases, audit records, and configuration. It can specify notification before a model change and give the customer a way to rerun its acceptance tests. These provisions do not eliminate vendor dependence, but they turn dependence into a visible engineering risk that can be managed.
Operational question 5: what survives contact with the real system?
The production review
A deployment should be considered mature only when a new operator can understand it without interviewing the original project team. That means the customer needs a map of the workflow, a list of model and tool dependencies, examples of acceptable and unacceptable outputs, and a clear owner for each exception. The map should include the ordinary path and the paths that begin with missing data, conflicting policies, or a user request outside the system’s scope. This is where field engineering becomes organizational learning instead of permanent consulting.
The handoff also tests whether the product has a stable abstraction. If every customer requires a new hidden instruction, a private connector, and a custom monitoring script, then the vendor has learned something but has not yet built a repeatable product. Buyers should ask which artifacts will become standard after the engagement and which will remain customer-specific. That distinction helps forecast maintenance cost and prevents a pilot from being approved on an unrealistically low first-month bill.
A useful contract can make this concrete. It can require export of prompts, tool schemas, evaluation cases, audit records, and configuration. It can specify notification before a model change and give the customer a way to rerun its acceptance tests. These provisions do not eliminate vendor dependence, but they turn dependence into a visible engineering risk that can be managed.
Operational question 6: what survives contact with the real system?
The production review
A deployment should be considered mature only when a new operator can understand it without interviewing the original project team. That means the customer needs a map of the workflow, a list of model and tool dependencies, examples of acceptable and unacceptable outputs, and a clear owner for each exception. The map should include the ordinary path and the paths that begin with missing data, conflicting policies, or a user request outside the system’s scope. This is where field engineering becomes organizational learning instead of permanent consulting.
The handoff also tests whether the product has a stable abstraction. If every customer requires a new hidden instruction, a private connector, and a custom monitoring script, then the vendor has learned something but has not yet built a repeatable product. Buyers should ask which artifacts will become standard after the engagement and which will remain customer-specific. That distinction helps forecast maintenance cost and prevents a pilot from being approved on an unrealistically low first-month bill.
A useful contract can make this concrete. It can require export of prompts, tool schemas, evaluation cases, audit records, and configuration. It can specify notification before a model change and give the customer a way to rerun its acceptance tests. These provisions do not eliminate vendor dependence, but they turn dependence into a visible engineering risk that can be managed.
A practical test for the next deployment
The FDE teams question 1 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 2 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 3 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 4 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 5 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 6 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 7 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 8 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 9 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 10 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 11 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 12 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 13 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 14 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 15 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 16 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 17 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 18 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 19 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 20 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 21 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 22 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 23 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 24 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 25 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 26 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 27 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 28 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 29 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.
The FDE teams question 30 is concrete rather than rhetorical: how does a customer workflow behave when the input is incomplete, the responsible person is busy, and the system has to explain its next move? In this story, model permissions is not a background setting; it is the mechanism that determines whether the capability can be used safely. The answer should be tested against enterprise rollout, recorded in an evidence trail, and reviewed by someone who can stop the process.