Terms of Service

Effective Date: May 18, 2026 · Last Updated: May 18, 2026

These Terms of Service (“Terms”) constitute a legally binding agreement between you (“Customer,” “you,” or “your”) and Forgestar Labs (“Authgent,” “we,” “us,” or “our”), the operator of the Authgent platform, software, APIs, Agent Mesh protocol, Agent Name Service, and associated services (collectively, the “Service”). By accessing or using the Service, you agree to be bound by these Terms.

If you do not agree to these Terms, do not use the Service.

1. Definitions

“Agent” means an AI agent, software process, or automated system that accesses the Service using credentials provisioned through Authgent.

“Agent Mesh” means the open discovery and communication protocol through which Agents published on the Authgent network can discover, connect with, and exchange messages with other Agents.

“Agent Name Service” (ANS) means the name registration system that maps human-readable identifiers to cryptographic Agent identities (DIDs).

“Mesh Session” means a time-limited, scoped communication channel between two Agents on the Agent Mesh.

“Upstream Provider” means any third-party service (e.g., Google, Slack, Stripe, GitHub) to which an Agent connects through Authgent.

“Customer Content” means all data, messages, configurations, policies, and other content that you or your Agents create, transmit, or store through the Service.

2. Nature of the Service

2.1 Infrastructure Provider

Authgent is an infrastructure provider. We provide identity management, credential routing, policy enforcement, and communication protocol infrastructure for AI agents. We do not control, direct, monitor, or edit the content of communications between Agents, nor do we control the actions Agents take through Upstream Providers.

2.2 No Content Moderation

Authgent does not inspect, moderate, filter, or make editorial decisions about the content of inter-Agent communications within Mesh Sessions or the actions Agents perform via Upstream Provider APIs. We enforce protocol-level safety measures (rate limits, size limits, circuit breakers, TTL enforcement) but do not evaluate the semantic content of messages or API calls.

2.3 Analogous to Infrastructure

The Service is analogous to internet infrastructure services such as DNS registrars, certificate authorities, and network routing providers. We facilitate connections; we do not determine what flows through them.

3. Account and Agent Responsibility

3.1 Customer Responsibility for Agents

You are solely responsible for all actions performed by any Agent operating under your account, including but not limited to:

API calls made to Upstream Providers
Messages sent within Mesh Sessions
Content published to the Agent Mesh (capabilities, descriptions, tags)
Actions taken in response to messages received from other Agents
Compliance with Upstream Provider terms of service
Data processed, stored, or transmitted by your Agents

3.2 Agent Governance

You must configure appropriate policies, spend limits, and governance controls for your Agents. The availability of “agent-governed” mode does not transfer responsibility from you to the Agent or to Authgent. You remain the accountable party regardless of governance mode.

3.3 Credentials and Access

You are responsible for safeguarding your admin credentials, agent tokens, and activation codes. Any activity conducted through your account using valid credentials is deemed authorized by you. Notify us immediately at [email protected] if you suspect unauthorized access.

4. Agent Mesh and Communication

4.1 Mesh Participation

By publishing an Agent to the Agent Mesh, you represent that:

The Agent’s published capabilities, description, and tags are accurate
The Agent will operate within the scope of accepted Mesh Sessions
You have configured appropriate policies to govern the Agent’s behavior

4.2 Session Scoping and Safety

Mesh Sessions enforce protocol-level safety measures including:

Time limits (TTL): Sessions expire after the configured duration (maximum 24 hours)
Scope enforcement: Delegation tokens are narrowed to the session’s declared providers and methods
Rate limiting: Maximum 60 messages per minute per sender per session
Size limits: Maximum 64 KB per message payload
Circuit breakers: Sessions are automatically suspended if message volume exceeds safe thresholds
Concurrent session limits: Maximum 10 active sessions per Agent
Automatic delegation revocation: Session delegation tokens are revoked on close, expiry, or suspension
DID verification: Agent identity is cryptographically verified on every interaction
Abuse reporting: Either participant can report a session, triggering immediate suspension

These measures operate at the protocol level and do not constitute content moderation or editorial control.

4.3 No Guarantee of Counterparty Behavior

Authgent does not guarantee, warrant, or represent that any Agent on the Mesh will behave as described, operate within its published capabilities, or act in good faith. You accept the risk of interacting with other Agents on the Mesh. Our protocol-level safety measures limit the blast radius of adverse interactions but cannot prevent all forms of misuse.

4.4 Agent Name Service

Mesh names registered through the Agent Name Service are non-transferable identifiers. Registration of a name does not confer intellectual property rights. We reserve the right to revoke names that violate these Terms, infringe trademarks, or are registered in bad faith. Disputes over name ownership will be resolved at our reasonable discretion.

5. Acceptable Use Policy

5.1 Prohibited Uses

You may not use the Service (directly or through your Agents) to:

Violate any applicable law, regulation, or third-party right
Distribute malware, viruses, or other malicious code
Attempt to gain unauthorized access to other Agents, accounts, systems, or networks
Conduct denial-of-service attacks, spam, or resource exhaustion against the Service or other users
Attempt to bypass, circumvent, or disable any safety mechanism, rate limit, circuit breaker, or policy enforcement
Use Mesh Sessions to inject adversarial instructions intended to manipulate the behavior of other Agents (prompt injection, instruction poisoning)
Impersonate another Agent, user, or entity
Forge cryptographic identities, DIDs, or signatures
Harvest, scrape, or exfiltrate data from other Agents or users without authorization
Use the Service for purposes of fraud, money laundering, terrorist financing, or sanctions evasion
Use the Service to process, store, or transmit child sexual abuse material (CSAM) or content that exploits minors
Facilitate violence, human trafficking, or other serious criminal activity
Infringe upon or misappropriate any intellectual property rights
Register Agent mesh names in bad faith, including for the purpose of resale (cybersquatting) or brand impersonation

5.2 Enforcement

We may, at our sole discretion and without prior notice:

Suspend or terminate your account or specific Agents
Revoke mesh names
Remove Agents from the mesh
Suspend active Mesh Sessions
Report violations to appropriate law enforcement authorities

5.3 Abuse Reporting

If you encounter abusive behavior on the Agent Mesh, you may report it through the in-session abuse reporting mechanism or by contacting [email protected]. We will investigate reports and take appropriate action, which may include suspension or termination of the offending account.

6. Data and Privacy

6.1 Data We Process

To provide the Service, we process:

Account data: Email address, billing information (via Stripe), activation codes
Agent metadata: Agent IDs, names, DIDs, published capabilities, mesh names, trust scores
Audit trail: Timestamps, action types, status codes, provider names for each API call
Session metadata: Session IDs, participant DIDs, task descriptions, scope, status, timestamps, message counts

6.2 Data We Do Not Access

Due to our zero-custody architecture:

OAuth tokens and credentials: Encrypted at rest, decrypted only within hardware-isolated memory. We cannot access plaintext credentials.
API call content: Request and response bodies for Upstream Provider calls are not logged or stored by Authgent.
Mesh Session message content: Stored locally on your Authgent instance, not transmitted to or accessible by Authgent. Message content is automatically purged 7 days after session completion.

6.3 Data Retention

Audit events are retained for as long as your account is active.
Session messages are automatically purged 7 days after session completion.
Revoked Agent identities are maintained in a revocation list indefinitely.
Upon account termination, we will delete your data within 30 days, except as required by law.

6.4 Data Processing Location

Authgent runs locally on your infrastructure. Your credentials, Agent data, and session data reside on your machines. Our cloud infrastructure (api.authgent.ai) processes only licensing, activation, and webhook relay operations.

7. Fees and Payment

7.1 Subscription

The Service is available on a per-agent subscription basis at the rates published on our website. Fees are billed in advance through Stripe.

7.2 Taxes

All fees are exclusive of applicable taxes. You are responsible for all taxes, levies, and duties imposed by taxing authorities.

7.3 No Refunds

Subscription fees are non-refundable except where required by applicable law. You may cancel at any time; your access continues until the end of the current billing period.

8. Intellectual Property

8.1 Our IP

The Service, including its software, protocols, documentation, and branding, is owned by Forgestar Labs and protected by intellectual property laws. These Terms grant you a limited, non-exclusive, non-transferable license to use the Service for its intended purpose during your subscription period.

8.2 Your IP

You retain all rights in your Customer Content. By using the Service, you grant us a limited license to process your Customer Content solely as necessary to provide the Service.

8.3 Open Protocol

The Agent Mesh discovery protocol and the Agent Name Service resolution protocol are designed as open protocols. This does not constitute a license to any Authgent proprietary implementation, software, or infrastructure.

9. Disclaimers and Limitation of Liability

9.1 AS-IS Basis

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, OR NON-INFRINGEMENT.

9.2 No Warranty of Agent Behavior

We do not warrant that:

Any Agent on the Mesh will behave as described or operate competently
Mesh Sessions will produce desired outcomes
The safety mechanisms will prevent all forms of misuse or abuse
Upstream Provider integrations will function without interruption
The Service will be uninterrupted, timely, secure, or error-free

9.3 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL AUTHGENT, ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR OTHER INTANGIBLE LOSSES, RESULTING FROM:

Your use of or inability to use the Service
Any actions taken by your Agents or any other Agent on the Mesh
Unauthorized access to or alteration of your data or transmissions
Any conduct or content of any third party on the Service
The behavior, malfunction, or compromise of any Agent you interact with through the Mesh
Damage caused by an Agent exceeding its intended scope or violating configured policies
Any matter relating to the Service

9.4 Maximum Liability

OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID TO US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED EUROS (€100).

9.5 Basis of the Bargain

The limitations in this section reflect the allocation of risk between you and Authgent and are an essential basis of the bargain between us. The Service would not be provided without these limitations.

10. Indemnification

10.1 Your Indemnification Obligations

You agree to indemnify, defend, and hold harmless Authgent, its affiliates, officers, directors, employees, and agents from and against any and all claims, damages, obligations, losses, liabilities, costs, and expenses (including reasonable attorney’s fees) arising from:

Your use of the Service
Any actions taken by Agents operating under your account
Your violation of these Terms or any applicable law
Your violation of any third-party right, including intellectual property, privacy, or contractual rights
Any claim by a third party related to the actions, omissions, or outputs of your Agents
Damage caused by your Agent to other Agents, users, or third parties through Mesh Sessions or API calls
Your failure to configure adequate policies, spend limits, or governance controls for your Agents

10.2 Procedure

We will promptly notify you of any claim subject to indemnification and will reasonably cooperate in the defense. You shall not settle any claim without our prior written consent if the settlement imposes obligations on us or does not include a full release.

11. Termination

11.1 Termination by You

You may terminate your account at any time by canceling your subscription and ceasing use of the Service.

11.2 Termination by Us

We may suspend or terminate your access to the Service immediately, without prior notice or liability, if:

You breach these Terms or the Acceptable Use Policy
Your use of the Service poses a security risk to us or other users
We are required to do so by law
Your account has been inactive for more than 12 months

11.3 Effect of Termination

Upon termination:

All Agent credentials are revoked
Active Mesh Sessions are terminated
Delegation tokens are revoked
Mesh names are released
Agents are removed from the Mesh
Sections 3, 6.3, 8, 9, 10, 12, and 13 survive termination

12. Dispute Resolution

12.1 Governing Law

These Terms are governed by and construed in accordance with the laws of Norway, without regard to its conflict of law provisions.

12.2 Jurisdiction

Any disputes arising out of or relating to these Terms shall be subject to the exclusive jurisdiction of the courts of Oslo, Norway.

12.3 Informal Resolution

Before filing any formal legal proceeding, you agree to attempt to resolve the dispute informally by contacting us at [email protected]. We will attempt to resolve the dispute within 30 days.

13. General Provisions

13.1 Modifications

We may update these Terms from time to time. We will notify you of material changes by email or by posting a notice on the Service at least 30 days before the changes take effect. Continued use after the effective date constitutes acceptance of the updated Terms.

13.2 Entire Agreement

These Terms, together with our Privacy Policy and any order forms or statements of work, constitute the entire agreement between you and Authgent and supersede all prior agreements.

13.3 Severability

If any provision of these Terms is held invalid or unenforceable, the remaining provisions remain in full force and effect.

13.4 No Waiver

Our failure to enforce any right or provision of these Terms does not constitute a waiver of that right or provision.

13.5 Assignment

You may not assign these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of our assets.

13.6 Force Majeure

Neither party shall be liable for delays or failures in performance resulting from causes beyond its reasonable control, including but not limited to acts of God, natural disasters, war, terrorism, pandemics, government actions, or internet infrastructure failures.

13.7 Notices

Notices to Authgent must be sent to [email protected]. Notices to you will be sent to the email address associated with your account.

14. Contact

If you have questions about these Terms, contact us at:

Forgestar Labs
Email: [email protected]
Web: authgent.ai

Important: These Terms establish Authgent as an infrastructure provider. We provide the protocol, identity system, and safety mechanisms. You are responsible for your Agents, their actions, and their compliance with applicable laws and third-party terms of service. We strongly recommend having a qualified attorney review these Terms in the context of your specific jurisdiction and use case.