Skip to main content

Generated-code IP & licensing

When agents write most of the code, "who owns this and what licences taint it?" becomes a due-diligence question with real money attached — every RAPID-built product we sell will be asked it. This standard secures the answer up front: clean contractual IP position with AI vendors, automated licence hygiene on everything generated or imported, and per-file provenance so the claim is provable, not asserted.

Draft — Commercial and Legal ratification pending

The contractual positions below are targets to secure, not confirmations of current vendor terms. Legal must verify each clause against the actual agreements in force; Commercial must ratify the client-contract wording before it is used in a sale.

The contractual position with AI vendors​

What must be true in every AI-vendor agreement before its output ships in a product we sell:

  • Output ownership — the vendor assigns or disclaims all rights in generated output; we own what the tools produce for us, without licence-back or usage restrictions.
  • No training on our material — inputs and outputs are not used to train vendor models (the same clause the AI usage policy requires; it protects IP as well as data).
  • IP indemnity for output — the vendor indemnifies against third-party copyright claims arising from generated output, with any conditions (e.g. filters enabled, unmodified output) captured in our pipeline config so we don't silently void the cover.
  • Verified at intake, per vendor — these terms are checked in the tooling intake scorecard; a vendor without them doesn't generate shippable code.
Pending

Legal to confirm the current terms of each approved vendor against this checklist, and where indemnities are conditional, Engineering to confirm the conditions are met by our pipeline configuration.

Automated licence scanning​

  • All code is scanned — generated and imported alike — agents can reproduce licensed snippets as readily as they can pull licensed packages; both paths get the same automated check in CI (supply chain, CI/CD pipeline).
  • Snippet-level scanning for generated code — dependency scanning alone misses verbatim reproduction; generated code is checked against known-source corpora before merge.
  • SBOM with licence data on every build — SPDX licence identifiers throughout, so the licence position of any release is a query.
  • Findings block the merge gate — an unapproved licence is a build failure, not a report; exceptions go through a risk-acceptance record, time-boxed and signed.

Copyleft handling​

  • Allowed-licence list, maintained with Legal — permissive licences (MIT, BSD, Apache-2.0) pre-approved; everything else is named-decision territory.
  • No strong copyleft in shipped product code — GPL/AGPL code does not enter a product we sell without explicit Legal approval; the default answer is no.
  • Weak copyleft only within its terms — LGPL/MPL dependencies are acceptable only in usage patterns that don't propagate obligations (and the pattern is recorded in the ADR that approved them).
  • Copyleft found in generated output is treated as an incident — removed and regenerated, with the provenance trail used to check what else the same prompt/skill produced.

Provenance tagging​

  • Every file carries an origin tag — human, agent, or mixed — recorded via the commit-level AI provenance trail, not by hand.
  • Agent-origin records include model and session — so a vendor indemnity claim, a licence finding, or a client audit can be traced to exactly which tool produced which lines.
  • Mixed is honest — a human-edited agent file is "mixed", not laundered to "human"; the value of the tag is that it's true.

What this protects​

When a RAPID-built product is sold — as a product, or in an acquisition:

  • Due diligence passes — buyer or client IP review gets an SBOM, licence scan history and per-file provenance instead of a shrug; the OpenChain-style process story is the differentiator.
  • Warranties can be given — clean-IP and non-infringement warranties in client contracts are backed by evidence, and by vendor indemnities behind them.
  • No copyleft time bombs — nothing in the shipped product obliges source disclosure of client-facing IP.
  • The AI question is an asset — "agents wrote it" answered with a provable chain of ownership turns a procurement objection into a proof point (client transparency).

Standards referenced: SPDX, OpenChain.