Responsible AI Use Policy
In short: this Policy describes how AmazFlow designs, deploys, and governs artificial intelligence (AI) and automated execution in the AmazFlow Service. AI assists within bounded, customer-configured controls. It does not replace Customer judgment for High-Impact Actions. Customer Content is not used to train or fine-tune AmazFlow or provider foundation models.
This Policy does not by itself create a customer contract. It is not a SOC 2, ISO, or HIPAA attestation.
Purpose
This Policy describes how AmazFlow designs, deploys, and governs artificial intelligence (AI) and automated execution in the AmazFlow Service, and how Customers and AmazFlow personnel are expected to use those capabilities responsibly.
AmazFlow is an AI operations execution platform: governed workflows that observe → decide → act → verify → escalate → audit across websites, desktop applications, spreadsheets, inboxes, portals, and internal systems. AI assists within bounded, customer-configured controls. It does not replace Customer judgment for High-Impact Actions.
Related: Security · Acceptable Use · DPA · Privacy · MSA (AI & Automated Execution).
Scope
This Policy applies to:
- The AmazFlow Service — AI-assisted workflow steps, agent runtimes, verification, approvals, and related automation.
- Customers and Authorized Users — configuration and operation of Workflows that use AI or automation.
- AmazFlow personnel and agents — internal use of AI tools (including assistants and coding agents) when acting for AmazFlow.
It does not by itself create a customer contract. Paid Service use is governed by the Master Services Agreement (MSA), Order Form, Acceptable Use Policy (AUP), Data Processing Agreement (DPA), and any Business Associate Agreement (BAA). If this Policy conflicts with an executed Order Form or BAA on a specific topic, the executed paper controls for that engagement.
Principles
| Principle | What it means in practice |
|---|---|
| Human accountability | People remain accountable for High-Impact Actions and for business outcomes of Workflows they configure. |
| Bounded authority | AI operates within Customer-defined options, policies, allowlists, and short-lived tasks — not open-ended standing credentials. |
| Verify then trust | Material actions are designed to be verified; evidence and audit history support review. |
| Least privilege | Users, agents, and steps receive only the access required for the authorized function. |
| No silent training | Customer Content is not used to train or fine-tune AmazFlow or provider foundation models. |
| Honest claims | AmazFlow does not invent SOC 2 attestations, blanket HIPAA compliance, or “AI that never errs.” |
| Lawful use | Customers must have rights to systems and data they connect; regulated data requires the right paper. |
How AmazFlow uses AI in the Service
Bounded AI-assisted steps
AI-assisted steps are designed to operate within Customer-defined options, policies, and allowlists. Structured outputs, confidence thresholds, and policy enforcement may apply. Model output does not itself authorize High-Impact Actions.
High-Impact Actions
High-Impact Actions include actions that, if incorrect or unauthorized, could cause material harm — for example financial transfers or refunds; access grants or revocations; deletion of records; healthcare or benefits determinations; legal filings; or payroll changes.
Verification, escalation, and audit
Workflows are designed to support completion verification, exception escalation, and audit history (actor, method, policy context, timing, result, approval context). Evidence packs document that a run occurred, which verification checks ran, and which human approvals were required. They do not certify business outcomes or create a compliance attestation.
No AI training on Customer Content
AmazFlow will not use Customer Content to train, fine-tune, or improve any AI model, and will not permit its model providers to do so, except that Customer Content may be processed by models solely to produce the relevant Workflow step output as configured by Customer (aligned with MSA §5.3).
Infrastructure posture (summary)
As described on the Security page, AmazFlow’s control plane is AWS-native and tenant-scoped. Model-driven interactions may run through Amazon Bedrock AgentCore and related services; workflow state, approvals, verification, and audit truth remain in AmazFlow’s deterministic control plane. See amazflow.com/security for the live narrative. AmazFlow does not currently claim a SOC 2 examination or attestation.
Customer responsibilities
Customers and Authorized Users must:
- Configure responsibly — set allowlists, approval thresholds, escalation paths, and verification steps appropriate to the Workflow.
- Authorize access — obtain and maintain all rights, consents, and authorizations to connect Third-Party Services and to allow the Service to access systems and data.
- Own outcomes — remain responsible for the legality, appropriateness, and business consequences of Workflow outcomes and automated decisions, except to the extent caused by AmazFlow’s material failure to operate the Service in accordance with the Agreement.
- Validate material results — AI outputs may be incorrect or incomplete; validate before relying on them for material decisions.
- Respect High-Impact gates — do not bypass human approval for High-Impact Actions.
- Handle regulated data correctly — do not submit PHI or other regulated data unless the Order Form (and BAA, if required) expressly allows it; do not put regulated data in unauthorized support channels.
- Follow the AUP — including prohibitions on unauthorized system access and misuse of automation (Acceptable Use Policy).
- Workforce features (e.g., WorkIQ) — if enabled, Customer remains responsible for lawful notice, consent, and employment-law compliance in applicable jurisdictions.
Prohibited uses (AI / automation)
Without limiting the AUP, the following are prohibited:
- Using the Service to access systems or data without authorization.
- Instructing AI or automation to bypass approval, verification, or audit controls for High-Impact Actions.
- Using AI outputs as a sole basis for adverse employment, credit, housing, or similarly consequential decisions where applicable law requires human review or other safeguards — unless Customer has implemented compliant processes.
- Generating or distributing unlawful content, malware, or social-engineering payloads via the Service.
- Attempting to extract model weights, break tenant isolation, or use the Service to build a competing model from non-public AmazFlow materials.
- Representing AmazFlow evidence packs, audit logs, or AI outputs as a legal certification, SOC 2 / ISO attestation, or blanket HIPAA compliance badge.
AmazFlow internal AI use
When AmazFlow personnel (and AmazFlow-directed agents) use AI tools for AmazFlow work:
- Prefer least privilege and need-to-know; do not paste secrets, production credentials, or unnecessary Customer Content into tools that are not approved for that data.
- Do not use Customer Content to train public or third-party models.
- Treat AI drafts (policies, code, outreach, analysis) as assistive — humans remain accountable for what ships externally or to production.
- External claims, competitor comparisons, and ROI language remain under Claims Clearance.
- Customer-facing legal commitments (MSA, Order Form, BAA) require the applicable clearance path; AI does not approve contracts.
Transparency and changes
- AmazFlow may update this Policy as the Service evolves. Material adverse changes affecting Customers will be handled consistently with AmazFlow’s approach to updates of related trust documents (notice where required).
- Security controls and subprocessors are described on the Security page and Subprocessors list; those pages remain the live source for technical detail.
- Questions: legal@amazflow.com · Security: security@amazflow.com · Privacy: privacy@amazflow.com