Acceptable use policy

This policy is part of the terms of service. It applies to everybody using UtilitySpaces — you, your workspace members, and the agents you run. If it would be wrong for a person on your team to do it, it is wrong for an agent to do it, and “the agent decided to” is not a defence.

Do not break the law

• No illegal activity of any kind, under the governing law of these terms or the law that applies to you.
• No content that sexually exploits or endangers children. This is reported, not warned about.
• No fraud, no phishing, no fake invoices, no impersonating a real business to extract money or credentials.
• No content that infringes someone else's copyright, trademark, trade secret or privacy rights.
• No sanctions evasion, money laundering, or trade in prohibited goods.

Do not attack systems

• No unauthorised access, scanning, or penetration testing of anyone's systems — including ours — without written permission.
• No malware, ransomware, botnet control, or credential stuffing.
• No attempts to break out of your workspace, read another workspace's data, escalate privileges, or bypass the approval gate.
• No load that degrades the service for others: no denial of service, no scraping loops, no deliberately spinning agents to burn capacity.
• No reselling or reverse-proxying our AI gateway as if it were your own model API.

Security research is welcome when it is on your own workspace and reported responsibly to security@utilityspaces.com. Tell us before you go looking, never touch another customer's data, and give us a reasonable window to fix what you find.

Do not harm people

• No harassment, threats, stalking, or targeted abuse of an individual.
• No hate speech or incitement to violence against a person or a group.
• No doxxing: publishing someone's private information, or building an agent whose job is to assemble it.
• No non-consensual intimate imagery, and no sexual content involving anyone who cannot consent.

Do not spam

• No bulk unsolicited email, WhatsApp or other messaging, whether sent by you or by an agent on your behalf.
• Only message people who agreed to hear from you, and always give them a working way to stop.
• No forged headers, no misleading sender identities, no purchased contact lists.
• Respect the rules of every platform you connect. Getting a connected account banned for spam is your problem, and repeated incidents become ours.

This matters more than usual here. Our mail server and WhatsApp gateway are shared infrastructure; one workspace spamming from them damages deliverability for every other customer, so we enforce this rule quickly.

Rules that apply specifically to agents

Agents can act at a speed and volume a person cannot, which is exactly why these are written out separately.

• Do not disguise an agent as a human. If an agent talks to someone outside your workspace — a customer, a supplier, a member of the public — do not claim it is a person, and answer honestly if you are asked.
• Do not impersonate a real individual or organisation. An agent may represent your business. It may not pretend to be a named person who has not agreed to it, or a company you do not run.
• Only connect data you are entitled to connect. Authorising a connector means confirming you have the right to give an agent that access.
• Do not route around the approval gate. Writes a connection's policy refuses stay refused, and gated work waits for a person, on purpose. Do not build workarounds that get past either, and do not rubber-stamp approvals you have not read.
• Scope agents to the job. Give an agent the narrowest permissions its work requires. An agent with more access than it needs is the most common way this goes wrong.
• Do not automate high-stakes decisions about people — hiring, firing, credit, housing, healthcare, insurance, or legal outcomes — without a person actually reviewing each one. Model output is not a decision maker.
• Do not generate deceptive content at scale: no fake reviews, no fabricated news, no synthetic media presented as real, no astroturfing.
• Do not use agents to defeat the security of other services: no solving captchas at scale, no evading rate limits, no bypassing access controls.

Provider rules flow through

Requests sent to an AI provider are subject to that provider's own usage policies as well as this one, whether they run on our gateway or on a key you supplied. A provider suspending our gateway account over one workspace's traffic affects every customer, so we treat provider policy breaches as breaches of this policy.

Demo workspaces

The free demo exists so people can try the product. It expires about an hour after it is created, and it is not a way to get free capacity: creating demo workspaces in bulk, scripting signups, or cycling demos to avoid paying is a breach of this policy and is blocked.

How we enforce this

We do not monitor your workspace content. We act on reports, on abuse signals from our own infrastructure — bounce rates, provider complaints, traffic patterns — and on legal requests we are obliged to answer.

• Usually: we write to the workspace owner, explain the problem, and give you a chance to fix it.
• For serious or ongoing abuse: we suspend the workspace, or the specific capability being abused, immediately and explain afterwards.
• For illegal content: we remove it, close the account, and report it where the law requires.
• Appeals: write to legal@utilityspaces.com. A suspension made in error is reversed, and any time lost is credited.

Suspension for a breach does not entitle you to a refund of the period already invoiced. The refund policy covers the rest.

Reporting abuse

If a UtilitySpaces workspace or agent is doing something on this list, tell us at support@utilityspaces.com. Include what you saw, when, and anything that identifies the source — a message, a header, an address. Security vulnerabilities go to security@utilityspaces.com instead.

Changes

As agents get new capabilities, this list grows to match. The date at the top of this page shows the last substantive revision, and material changes are emailed to workspace owners before they take effect.