Additional Terms: Workflows
Effective Date: April 16, 2026
Cloud Provider: All (cloud-agnostic)
Document ID: QUOME-LEGAL-WORKFLOWS-001
These Additional Terms govern your use of the Quome Workflows service ("Workflows"). These terms supplement the Terms of Service.
1. Service Description
Workflows enables you to define, execute, and schedule prompt-driven automated tasks. Each workflow run: (a) generates an execution plan using an AI provider (Claude, Gemini, or Codex), (b) provisions an ephemeral sandbox, (c) executes generated or persisted Python scripts in the sandbox, (d) collects output artifacts, and (e) tears down the sandbox.
2. AI-Generated Code
2.1 Nature of Generated Code
Workflows use AI models to generate Python scripts based on your prompts. AI-generated code is provided as-is, without warranty of correctness, security, or fitness for any purpose. You are responsible for:
(a) Reviewing generated scripts before persisting them for reuse;
(b) Ensuring generated code does not violate Applicable Law or third-party rights;
(c) Testing generated code in non-production contexts before relying on it for critical operations;
(d) Understanding that AI-generated code may contain errors, security vulnerabilities, or produce unexpected results.
2.2 Ownership
AI-generated scripts produced by Workflows are part of your User Content and are subject to the license terms in Section 4 of the Terms of Service. Quome does not claim ownership of AI-generated scripts produced for your workflows.
3. Ephemeral Credentials
3.1 Per-Run Service Accounts
Each workflow run creates an ephemeral service account and API key scoped to the resources declared in the workflow's required_grants manifest. These credentials:
(a) Are valid for a maximum of 2 hours from run start;
(b) Are automatically revoked and destroyed at run teardown;
(c) Grant access only to the specific secrets, databases, and storage buckets declared in the manifest;
(d) Are not shared across workflow runs.
3.2 Secret Injection
Secrets declared in the required_grants manifest are made available to the sandbox via the Quome SDK. Secret values are fetched on demand from your cloud provider's secret manager — they are not pre-loaded into environment variables. You are responsible for ensuring your workflow's required_grants manifest follows the principle of least privilege.
4. Customer Responsibilities
(a) You are solely responsible for the accuracy and safety of your workflow prompts;
(b) You are responsible for reviewing persisted scripts and ensuring they are appropriate for your use case;
(c) You must not use Workflows to execute code that violates Applicable Law, accesses systems without authorization, or performs harmful actions;
(d) You are responsible for monitoring workflow run results and artifacts;
(e) Workflow scheduling (cron triggers, webhook triggers) may result in cloud infrastructure costs — you are responsible for managing trigger frequency.
5. Artifacts and Storage
Workflow run artifacts are stored in the GCS bucket provisioned for the workflow. Artifact retention follows your storage bucket's lifecycle configuration. Quome does not independently retain or delete workflow artifacts.
6. Third-Party AI Providers
Workflows use third-party AI providers for code generation. By using Workflows, you acknowledge that your workflow prompts and context may be transmitted to the selected AI provider (Anthropic, Google, or OpenAI) subject to that provider's terms and data processing agreements. Quome does not control how AI providers process your data beyond the terms of our agreements with them.
AWS and Azure sandbox execution environments for Workflows will be documented in separate Additional Terms when those providers reach general availability.