WSO2 External AI Usage Policy

This WSO2 Responsible AI Usage Policy (“Policy”) governs Your use of AI Services.

This Policy supplements, and does not replace, any of the WSO2 AI Services Terms of Use or any other applicable WSO2 terms and conditions accepted by You.

AI Services allows You to run any Agent including WSO2 Agents and Customer Agents . Because WSO2 does not control the logic, training data, prompts, or behavior of Customer Agents, responsibility is shared between;

a. WSO2's responsibility:

• WSO2 provides the platform, orchestration, observability, and governance tooling needed to operate AI Services safely, including WSO2 AI Services's policy enforcement, guardrails, and monitoring capabilities.
• WSO2 maintains the platform in line with applicable security and privacy standards, as detailed at https://wso2.com/security/compliance.

b. Customer's responsibility:

• You are responsible for configuring guardrails and the protection of associated authentication tokens/credentials.
• You are responsible for verifying that your deployments comply with this Policy, applicable legal frameworks, and third-party intellectual property rights.
• You are responsible for adhering to all terms, usage limits, and licensing mandates set by model and agent providers; WSO2 assumes no liability should a vendor restrict or block access to these assets. Furthermore, You must consistently monitor and ensure ongoing compliance with any modifications or updates made to such third-party provider agreements where you own the subscription keys.
• You are responsible for managing human-in-the-loop validation checkpoints to ensure competent oversight of high-risk operations.
• LLM / MCP access: Customers bring and manage their own API keys; WSO2 provides the configuration pathway and the facility to configure guardrails.
• Anything sourced from an external marketplace or partner and hosted on WSO2 Cloud remains subject to this Policy; using a third-party component does not shift liability for its performance or behavior to WSO2.

You may not use, deploy, or allow others to use, the AI Services (including any Customer Agent run on WSO2 Cloud) to:

• Generate or facilitate intentional disinformation, deception, or impersonation of a real person without consent
• Violate the privacy rights of others, including unlawful tracking, surveillance, profiling, or identification
• Facilitate harm or exploitation of a minor, generate or facilitate the creation of child sexual abuse material, or engage in grooming
• Harass, threaten, defame, or encourage harm against individuals or groups
• Generate or distribute malware, conduct unauthorized intrusion, or otherwise compromise the security of any system
• Circumvent safety filters, guardrails, or usage limits built into WSO2 Agent Manager or any underlying model
• Perform a lethal or safety-critical function autonomously without meaningful human authorization and control
• Violate intellectual property, export control, or other applicable laws and regulations
• Deploy subliminal, manipulative, or deceptive techniques that materially distort a person’s behavior in a way that causes or is likely to cause significant harm
• Exploit the vulnerabilities of a person or group due to age, disability, or a specific social or economic situation, in a way that causes or is likely to cause significant harm
• Perform social scoring of individuals or groups (evaluating trustworthiness based on social behavior or personal characteristics) leading to detrimental or unfavorable treatment in unrelated contexts, or treatment disproportionate to the conduct
• Predict an individual’s likelihood of committing a criminal offense based solely on profiling or personality traits, absent objective, verifiable facts directly linked to criminal activity
• Create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage
• Infer emotions in workplace or educational settings, except for narrow medical or safety-related exceptions permitted by law
• Perform biometric categorization that infers or deduces a person’s race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation
• Perform real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, except in the narrowly defined circumstances the AI Act permits
• Generate non-consensual intimate imagery (“nudification”) of real, identifiable people
• Bypass, disable, or otherwise interfere with the Service’s security controls, including its logging, monitoring, rate-limiting, or permissioning controls

Because Agents (run on WSO2 Cloud) may take autonomous actions (e.g., calling external tools, APIs, or systems, initiating transactions, or modifying data), You must:

• Clearly scope each Agent’s permissions and tool access to the minimum necessary for its intended task;
• Implement human-in-the-loop checkpoints for actions that are irreversible, high-value, or high-risk;
• Use WSO2 AI Services’s audit logging, tracing, and policy controls to monitor Agentic behavior in production;
• Establish a kill-switch or equivalent mechanism to disable a misbehaving Agent promptly.

In connection with High-Stakes Decisions, You must:

• Evaluate the risks of the specific use case before deployment;
• Implement appropriate human oversight, testing, and use-case-specific safeguards; and
• Be prepared to provide WSO2 with information about the intended use case and Your compliance with this Policy upon reasonable request.

WSO2 AI Services, including Customer Agents, rely on probabilistic models and may produce inaccurate, biased, incomplete, or inappropriate output. You and your end users are solely responsible for:

• Evaluating outputs for accuracy and fitness for purpose before acting on them;
• Ensuring You hold appropriate rights to any content or data provided as input to an agent; and
• Ensuring any content published or acted upon as a result of Agent output is properly aligned with Intellectual Property Rights, attributed, or otherwise lawful.

• Do not input sensitive personal data, regulated data (e.g., health, financial, or government-issued identifiers), or confidential third-party data into an Agent unless You have the appropriate legal basis and have configured the Agent and platform controls accordingly, or as offered in the AI Gateway by WSO2 at https://wso2.com/api-platform/policy-hub/?categories=Guardrails and the Docs of AI Gateway Features.
• WSO2 does not use Your prompts to train its own foundation models.

WSO2 may, consistent with its Acceptable Use Policy and applicable law:

• Monitor aggregate usage patterns and platform telemetry to detect abuse, security threats, or violations of this Policy;
• Suspend or terminate access to the AI Services, including specific Customer Agents, where WSO2 has a reasonable basis to believe this Policy has been violated;
• Request information from You regarding a specific Agent’s intended use case if required to assess compliance.

WSO2 will provide notice of suspension or termination where reasonably practicable, except where immediate action is necessary to prevent harm or comply with law.

You are responsible for ensuring your use of the AI Services complies with all applicable laws, rules, and regulations, including AI-specific regulation such as the EU AI Act and any sector-specific requirements mentioned at https://wso2.com/security/compliance applicable to your industry (e.g., financial services, healthcare).

If you become aware of a violation of this Policy, or of an agent behaving unsafely on WSO2 Cloud, please report it to [email protected].

WSO2 may update this Policy from time to time to reflect changes in our services, applicable regulation, or emerging best practices. Material changes will be posted on this page with an updated “Last Updated” date.

WSO2 aims to align its AI governance practices with recognized industry standards and best practices for responsible AI management, security, and risk governance. As industry norms and peer practices evolve, this policy and its associated controls will be reviewed periodically to ensure they remain current and consistent with what customers and partners reasonably expect from an enterprise technology vendor.