1.The principle
GRACE gives you an agent with a shell, a filesystem and your code. That power is the product. These rules exist so that it stays available to everyone — including you.
The rules apply to you, and to anything you instruct the agent to do. Instructing the agent to break a rule is breaking the rule, and the transcript will say so.
2.Never allowed
- Attacking systems you do not own or are not authorised to test: scanning, exploiting, credential attacks, denial of service, or anything that would look like an attack from the outside.
- Building or distributing malware — ransomware, worms, bots, rootkits — regardless of intent.
- Uploading, processing or producing illegal content, including content that infringes copyright or other rights you have no licence to.
- Harvesting credentials, personal data or anything else you are not authorised to hold; working from leaked or stolen data.
- Wasting shared resources: cryptocurrency mining, mass spam generation, runaway loops, or otherwise treating the sandbox as free compute.
- Circumventing the Daily Allowance — extra accounts, shared credentials, or anything engineered to multiply what you paid for.
- Probing, scraping or reverse-engineering the Service itself, or attempting to reach another account’s workspace.
- Using the agent to breach contracts, yours or anyone else’s, including the terms of other services.
3.Security research
Good security work is welcome — on your own systems, or on any system whose owner has given you written permission. Keep the authorisation on file; if we ask, you show it.
Do not test GRACE itself without written permission from [email protected]. If you find something and report it to us in good faith — with reasonable time to fix it and no user data exposed — we will say thank you, not see you in court.
4.What happens if you break the rules
Gradually, unless it has to not be. Usually: a warning. Sometimes: a paused account. For serious violations: termination (with refunds, if any, decided case by case as described in the Terms), preservation of the relevant transcripts and logs, and reporting to the authorities where the law requires it.
We decide what counts as serious using the principle above, and we would rather explain a borderline call than leave these rules toothless.
5.Reporting violations
Report violations to [email protected]. If it is urgent or ongoing, say so in the subject line.