--- title: Licensing and usage terms description: Apply the recorded AIP Core license boundary and identify separate third-party and frontend terms kind: policy audience: evaluator appliesTo: "1.x" writingStandard: "aip-docs/1.0" lastReviewedRevision: "97be86e9efedf07ecf1783b03800f683f107fb04" --- # Licensing and usage terms This page is a plain-language guide to the legal files retained with AIP Core `1.0.0`. It is not legal advice and does not replace, modify, or grant rights beyond those files. If this page and a controlling license differ, the controlling license governs. Review the exact use, organization, affiliates, distribution, and applicable version with qualified counsel when the answer affects production or redistribution. ## Start with the controlling files | Material | Controlling source | | --- | --- | | AIP-owned material in AIP Core 1.0.0 | Root `LICENSE`, with attribution context in `NOTICE` | | Imported Model Context Protocol schema snapshots | `THIRD_PARTY_NOTICES` and `third_party/modelcontextprotocol/LICENSE` | | Rust and Python dependencies included in a built artifact | Each dependency's applicable license and notices, evaluated for the exact artifact closure | | Separate documentation frontend | That repository's own legal files or an explicit grant from its owner | The reviewed documentation frontend has no root `LICENSE`, `NOTICE`, or `THIRD_PARTY_NOTICES`. This page therefore describes AIP Core source terms; it does not assign those terms to the separate website or its assets. ## Identify the AIP Core license | Parameter | Recorded value | | --- | --- | | License | Business Source License 1.1 | | SPDX identifier used by the workspace | `BUSL-1.1` | | Licensor | WAI LLC | | Licensed Work | AIP Core 1.0.0 | | Copyright | Copyright 2026 WAI LLC | | Production-use threshold | Total Personnel must not exceed `10` | | Transition after first exceeding the threshold | `90` calendar days | | Change Date | `2030-07-21` | | Change License | Apache License, Version 2.0 | The root Cargo workspace declares `BUSL-1.1`. The CrewAI sidecar project also declares `BUSL-1.1`. The legal-file set is identical at the `v1.0.0` tag and at the pinned documentation review revision. The Business Source License notice states that it is not an Open Source license before its change condition applies. ## Decide whether the Additional Use Grant applies Use this decision path as a review aid, not as a substitute for legal advice. ### 1. Classify the use The root license grants rights to copy, modify, create derivative works, redistribute, and make non-production use of the Licensed Work. Production use is governed by the Additional Use Grant unless a separate commercial license applies. ### 2. Count Total Personnel The license defines Total Personnel as an aggregate across you and all Affiliates. The count includes: - you, when the license user is a natural person; - all employees and officers of you or any Affiliate; - every natural-person independent contractor or consultant who provides services to you or an Affiliate; - full-time and part-time people; - each natural person once. An Affiliate is an entity that directly or indirectly controls, is controlled by, or is under common control with you. Control means either more than 50 percent of voting interests or the power to direct management. Do not count only the team that operates AIP. The definition is organization- and affiliate-wide. ### 3. Apply the threshold If Total Personnel does not exceed ten, the Additional Use Grant permits production use without purchasing a commercial license. The grant expressly includes: - internal use; - self-hosted use; - use in products or services supplied to third parties. If Total Personnel is already greater than ten, this Additional Use Grant does not authorize production use. The license requires a commercial license or no production use. ### 4. Handle the first threshold crossing When Total Personnel first exceeds ten, the Additional Use Grant continues for 90 calendar days. That period exists to obtain a commercial license or cease production use. Record the first date above the threshold and the chosen transition outcome. The license ties this period to the personnel threshold, not to a deployment event. For commercial licensing arrangements, the source README directs readers to `hi@getaip.org`. ## Preserve obligations for copies and modifications The license applies to original copies, modified copies, and derivative works. It requires every original or modified copy to display the license conspicuously. Receiving the work from another party does not remove its terms. The license does not grant a right to the licensor's trademarks or logos, except for use expressly required by the license. It supplies the work on an “as is” basis and disclaims the listed warranties and conditions to the extent permitted by law. Use outside the rights currently in effect requires a commercial license or cessation. The text states that a violation automatically terminates rights under the current and all other versions of the Licensed Work. ## Apply the change condition per version For a specific version, the Change License takes effect on the earlier of: - its stated Change Date; or - the fourth anniversary of the first publicly available distribution of that version under the Business Source License. For AIP Core 1.0.0, the stated date is `2030-07-21` and the Change License is Apache License 2.0. The license applies separately to each version, and another version may have a different Change Date. Do not calculate the effective date from the source tag alone. If the version was publicly available before the recorded release date, the fourth-anniversary condition could occur earlier. Preserve the actual distribution history and review it with the controlling text. ## Keep imported MCP material separate The repository retains four byte-pinned Model Context Protocol JSON Schema snapshots from upstream revision `433d59ca12c6637a072a9de24e74f37d9f135854`. | Snapshot | SHA-256 | | --- | --- | | `2024-11-05` | `61cea2392d4f284092d09bc84b9ac488c0d5618ac2b38a56942fc5b99fd960ce` | | `2025-03-26` | `e720669548c8100a4282c49e580efd6ddf7f28899ea786fc8db251dbdb356131` | | `2025-06-18` | `b3db8f1ca839bc5171ceb4ba013fdf240c5a8a13d4653bb1bdf21f94677aa220` | | `2025-11-25` | `7b2d96fd95efd2216aa953606b83f5a740ddeaa5ebd3a5d27b45a8296545a118` | `THIRD_PARTY_NOTICES` points to a retained composite upstream license file. It describes an Apache-2.0 transition, legacy MIT contributions, and CC-BY-4.0 for upstream documentation other than specifications. Do not replace that composite text with the statement that every imported byte uses one license. The composite license file has SHA-256 digest `0382b0057770ca05e9c350a50aa3b1c1fea84da0bc81d723bf00b9aa841be58a`. Keep it and the applicable notices with redistributions of the imported material. ## Review dependency licenses for each distribution The Rust dependency policy allows these identifiers: ```text Apache-2.0, BSD-2-Clause, BSD-3-Clause, CDLA-Permissive-2.0, ISC, MIT, MIT-0, Unicode-3.0, Zlib ``` The release gate runs `cargo deny check`. Its configuration ignores the licenses of private workspace packages and checks dependency licenses against the allowlist. Publication hygiene separately checks the root Business Source License parameters and the CrewAI sidecar's declared license. These checks are useful controls, but they do not make `THIRD_PARTY_NOTICES` a complete notice bundle for every binary, container, Rust dependency, or Python dependency. Before distributing an artifact: 1. resolve the exact dependency closure for every platform and optional feature included in that artifact; 2. collect the applicable license texts, copyright notices, attribution, and source-offer obligations; 3. include the MCP schema notices when those snapshots are distributed; 4. compare the result with the artifact's SBOM and lockfiles; 5. retain the compliance output with the exact artifact digest. A passing dependency policy is not legal approval for a specific distribution. ## Verify the retained legal files The reviewed files have these SHA-256 identities: | File | SHA-256 | | --- | --- | | `LICENSE` | `bcd69f392245a1d9034dfab46820305bbd4879ad847cbc0a57a2c10b6cbc7f8e` | | `NOTICE` | `80a65f6645ca65fe2dd90db75cb9e7faac6a710586b10d7d27d3035675ecf7c6` | | `THIRD_PARTY_NOTICES` | `f392a969141fbad414b8e6c663c676b557e38972cff5371295ade6c77fc27782` | | `third_party/modelcontextprotocol/LICENSE` | `0382b0057770ca05e9c350a50aa3b1c1fea84da0bc81d723bf00b9aa841be58a` | For a release decision, compare these files with the exact source tag and with the legal materials inside every distributed archive or image. A checksum match confirms bytes, not legal suitability for the intended use. ## Complete the usage review Before approving a use or distribution, record: - the exact AIP Core version, commit, artifact digest, and material in scope; - whether the use is production or non-production; - the Total Personnel calculation, Affiliates included, calculation date, and reviewer; - any threshold-crossing date and the 90-day transition deadline; - the commercial-license identity, when applicable; - the controlling root and third-party license files and their checksums; - dependency notices and SBOM for the exact distributed artifact; - trademark or logo use reviewed separately from copyright permissions; - the applicable change condition for that specific AIP version. When a fact is missing or disputed, stop the approval and consult the controlling legal text and qualified counsel. ## Related documentation - [Release notes](release-notes.md) - [Release artifacts and verification](release-artifacts.md) - [Implementation status](implementation-status.md) - [Contributing](../../CONTRIBUTING.md) - [Security policy](../../SECURITY.md)