Agent and API Terms

Draft for counsel review (2026-10-21).

These terms apply when you connect your own AI agent or software to Ombudly through our API or MCP server using an agent token. They add to the Terms of Service.

1. Your agent acts as you

Anything done with your agent token is done by you. Keep tokens secret, give each agent its own token, and revoke a token in Settings as soon as you stop using it or suspect it leaked.

2. The same approvals apply

Agents work under your permission mode. They can propose consequential actions (commit, attest, share sensitive information, move money) but can't approve them: you approve in the Ombudly app with multi-factor confirmation. Agents can't read vault values; the vault fills them in directly.

3. Fair use

Don't exceed rate limits, share tokens between people, use the API to act on accounts that aren't yours, or use it to build a competing service. We may throttle or revoke tokens that put the Service or other users at risk.

4. Third-party agents

If your agent runs on someone else's platform (for example an AI assistant), that provider's terms and privacy policy apply to what your agent sees. Ombudly sends your agent only what it asks for within its token's scope, but we can't control what that provider does with it.

5. Changes

The API may change. We'll give at least [30] days' notice of breaking changes to stable endpoints.