Acceptable Use Policy

1. Introduction

This Acceptable Use Policy governs your use of the oakallow API and related services. oakallow exists to make AI agent execution safer through permissions, approvals, and audit trails. We expect all users to use the Service responsibly and in a manner consistent with its security-first purpose.

2. Authorized Use

3. Prohibited Activities

4. Tool Execution Guidelines

oakallow is designed to ensure AI agents ask before they act. When the permission system returns requires_approval, your system must route that request to a human decision-maker. Automatically approving these requests defeats the purpose of the permission system and violates this policy.

Tools with disabled permission must not be executed under any circumstances. If a tool is disabled, do not attempt to bypass the restriction.

5. Data Handling

Do not submit sensitive personal data (Social Security numbers, passwords, health records) as tool parameters. oakallow processes tool parameter data for permission resolution and logs it for audit purposes. If your use case involves sensitive data, ensure you have appropriate data handling agreements in place with your end users.

6. Security Requirements

• Store API keys securely (environment variables, secrets managers)
• Use HTTPS for all API communication
• Rotate API keys periodically and immediately after any suspected compromise
• Validate HMAC-signed execution tokens before executing tools
• Implement appropriate access controls within your own systems

7. Enforcement

We will always attempt to contact you before taking action, except in cases involving immediate security risk or legal obligation.

8. Reporting Violations

9. Contact