--- name: vendor-ai-review description: > Review vendor AI terms — agreement, addendum, or ToS AI provisions — against your governance positions; flag training-on-data, liability, model changes, and AI policy consistency. Use when user says "review this AI agreement", "check OpenAI terms", "what did we agree to with [vendor]", "vendor sent an AI addendum", "is this AI contract okay", or attaches vendor AI terms. argument-hint: "[vendor name, or attach the contract]" --- # /vendor-ai-review 1. Read `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. Confirm vendor governance positions are populated — if not, stop and direct to setup. 2. Use the framework below. 3. Confirm document type (AI addendum / main agreement AI provisions / ToS). If only an AUP was provided, ask for the full terms. 4. Term-by-term review: training on data, confidentiality of inputs, model changes, output IP, liability, incident notification, human review rights, use restrictions, audit rights. 5. AI addendum gap check if DPA exists but no AI addendum. 6. AI policy consistency diff vs. `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. 7. Output: bottom line, term-by-term, recommended redlines, if-they-won't-move routing. ``` /ai-governance-legal:vendor-ai-review openai-enterprise-agreement.pdf ``` --- ## Matter context **Matter context.** Check `## Matter workspaces` in the practice-level CLAUDE.md. If `Enabled` is `✗` (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: "Which matter is this for? Run `/ai-governance-legal:matter-workspace switch ` or say `practice-level`." Load the active matter's `matter.md` for matter-specific context and overrides. Write outputs to the matter folder at `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/matters//`. Never read another matter's files unless `Cross-matter context` is `on`. --- ## Purpose Vendor AI terms are where your governance positions actually get tested. The cold-start interview captures what you *want*. This skill checks what you *agreed to* — and flags the gaps between those two things. The direction here is always the same: we are the deployer or buyer reviewing the vendor's terms. This is the opposite posture from the DPA review controller/processor question — there's no flip. What varies is the *input*: - A standalone AI agreement or AI addendum (most structured) - A vendor's universal terms of service with AI provisions embedded (often buried) - An acceptable use policy (tells you what you can't do; says nothing about what the vendor can do with your data or outputs) - A combination — master agreement + DPA + AI addendum (common for serious enterprise AI vendors) When there's a DPA already in place, this review complements it — it's not a substitute. The DPA governs data protection obligations; the AI terms govern model-specific rights and risks. Both need to be reviewed. --- ## Load the playbook Read `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` → `## Vendor AI governance`. Also read `## AI policy commitments` — vendor terms can't be consistent with a use restriction our own policy imposes if we've agreed to something different. If `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` contains `[PLACEHOLDER]`, surface this bounce: > I notice you haven't configured your practice profile yet — that's how I tailor vendor governance positions to your practice. > > **Two choices:** > - Run `/ai-governance-legal:cold-start-interview` (2 minutes) to configure your profile, then I'll review tailored to YOUR positions. > - Say **"provisional"** and I'll review against generic defaults — US jurisdiction, middle risk appetite, lawyer role, no playbook — and tag every output `[PROVISIONAL — configure your profile for tailored output]` so you can see what I do before committing. ### Provisional mode If the user says "provisional," run the vendor AI review normally using these generic defaults: middle risk appetite, lawyer role, US jurisdiction, no playbook (flag all common vendor-AI risks from first principles rather than matching to configured positions). Tag the reviewer note and every finding block with `[PROVISIONAL]`. At the end of the output, append: > "That was a generic run against default assumptions. Run `/ai-governance-legal:cold-start-interview` to get output calibrated to YOUR practice — your vendor governance positions, your jurisdiction, your risk appetite. 2 minutes." --- ## Before reading the document If the user hasn't shared the actual vendor terms, ask: > "Can you share the vendor's AI terms? The most useful thing is the actual contract > language — the AI addendum if there is one, or the main agreement with AI provisions > highlighted. An acceptable use policy alone won't tell us what the vendor can do > with our inputs; it only tells us what we're allowed to do." If they share an acceptable use policy only: > "This is the acceptable use policy — it tells us what we can't do with the vendor's > AI. That's useful context, but it doesn't address the commercial terms: whether > the vendor can train on our data, what their liability is for AI errors, whether > they notify us when the model changes. Do you have the service agreement or AI > addendum?" --- ## The term-by-term review ### Core AI-specific terms (check every vendor AI agreement) Review each term below. For each, extract what the vendor's contract actually says and compare it against the position in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` → `## Vendor AI governance` (standard / acceptable fallback / automatic no). The default positions come from the team's playbook, not from this skill. | Term | What to look for | |---|---| | **Training on our data** | Does the vendor use our inputs to train, fine-tune, or improve models? Is there an explicit opt-out or prohibition? Is training opt-in or opt-out by default? | | **Confidentiality of inputs** | Are our prompts, documents, and data confidential? Any "quality review" or human-review carveouts that would let vendor staff read inputs? | | **Model changes** | Any notice obligation for material changes to the model? Version pinning available? | | **Output ownership / IP** | Who owns AI-generated content? Any license-back to the vendor on outputs? Any IP indemnity? | | **Liability for outputs** | Does the vendor accept any liability if the AI produces harmful, incorrect, or infringing outputs? Cap structure? Carve-outs? | | **Incident notification** | How and when are we notified if the AI system fails, is compromised, or produces systematic errors affecting us? | | **Human review rights** | Can we require human review of outputs in specific cases? Can we appeal or dispute an AI decision? | | **Use restrictions** | What are we prohibited from doing? Does it match what we actually want to use the tool for? Any definitional terms (e.g., "automated decision-making") that could sweep in our intended uses? | | **Audit / auditability** | SOC 2, third-party audits, bias testing results — any audit rights? | | **Subprocessors / model providers** | Does the vendor use sub-vendors for the model? Are they disclosed? Whose terms govern? | | **Data residency** | Where is our data processed? Where does it go for inference? | | **Term and termination** | What happens to our data when we terminate? Deletion timelines? | | **Stacked-vendor accountability** | Is this vendor the model provider (e.g., Anthropic, OpenAI, Google, Meta), or are they a deployer of someone else's model (e.g., a SaaS wrapper of Claude, ChatGPT, or Gemini) or a reseller of infrastructure-hosted foundation models (Anthropic-on-Bedrock, Claude-on-Vertex, OpenAI-on-Azure)? If the latter: there are TWO vendors' terms in play — the one you're reviewing, plus the upstream model provider's terms. Identify (a) whose terms govern training on inputs, retention, and safety, (b) who is contractually liable for model behavior, and (c) whether each upstream commitment (e.g., "no training on inputs") is flowed down to you, or remains between the vendor and the upstream provider only. Flag any clause where one party disclaims responsibility for the other (e.g., "Anthropic is not responsible for Bedrock or any other services it receives from AWS"; "Azure disclaims responsibility for OpenAI model outputs") and whether the counter-party's contract closes the gap. Do not review the two contracts in isolation. | If `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` doesn't define a position for a term on this list, ask: "Your playbook doesn't cover [term]. What's your default position, your acceptable fallback, and your automatic no? I'll add it to `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` so the next review is consistent." --- ## Playbook comparison For each term above, compare what we found to the positions in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. **Output format for each term:** > **[Term name]** > 🟢 / 🟡 / 🟠 / 🔴 > **Vendor says:** [summary of what the contract actually says] > **Our position:** [from `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`] > **Gap:** [specific delta — or "Aligned"] > **Proposed fix:** [specific redline language, or "escalate — outside fallback"] Use the severity ratings consistently (calibrated against `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` positions): - 🟢 **Aligned** — at or better than the standard position in the playbook. - 🟡 **Note** — within fallback but worse than standard; flag for awareness, not a blocker. - 🟠 **Significant** — outside standard position but within fallback; needs redline before signing. - 🔴 **Critical** — outside fallback; deployment should not proceed without resolution. Escalate per `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. --- ## AI addendum gap check **If the vendor has a DPA but no AI addendum:** > "There's a DPA in place but no AI-specific addendum. The DPA covers data protection > obligations but doesn't address: training on our data, model change notification, > liability for AI outputs, or incident notification for AI system failures. > > For a [Standard / Elevated / High] tier use case, this gap is [acceptable at > Standard tier / a blocker at Elevated or High tier]. Recommend requesting an > AI addendum or at minimum negotiating AI-specific terms into the next renewal." **If there are no AI terms at all:** > "There are no AI-specific terms in this agreement. The vendor is providing an > AI-powered service under general service terms — which means we have no > contractual protection on the highest-risk AI governance items (training, liability, > model changes). This is a 🔴 for any Elevated or High tier use case." --- ## AI policy consistency check Cross-check the vendor's terms against our AI policy commitments in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. Common conflicts: - Our policy prohibits vendor training on our data — the vendor's terms permit it by default. (Contract needs explicit prohibition or opt-out confirmation.) - Our policy requires human review for certain use cases — vendor's terms say AI outputs are final. (Workflow needs to impose the human step, not the vendor terms.) - Our approved vendor list doesn't include this vendor — or blocklist does. - Our policy requires disclosure to affected parties — vendor's terms impose a confidentiality obligation on AI system capabilities that would prevent disclosure. Flag every mismatch. One of them has to change. --- ## Redline granularity **Edit at the smallest possible granularity.** A redline is a negotiation artifact, not a rewrite. Wholesale clause replacement signals "we threw out your drafting" — it's aggressive, it forces the counterparty to re-read the whole clause, and it discards the parts of their drafting that were fine. Surgical redlines — strike a word, insert a phrase, restructure a subclause — signal "we have specific asks" and are faster to read, understand, and accept. Default to the smallest edit that achieves the playbook position: - Replace a **word** before a phrase. ("twelve (12)" → "twenty-four (24)") - Replace a **phrase** before a sentence. ("paid by the Buyer" → "paid and payable by the Buyer") - Restructure a **subclause** before replacing the sentence. (Add "(a)" and "(b)" to split a compound condition.) - Replace a **sentence** before replacing the clause. - Only replace a **whole clause** when the counterparty's version is so far from your position that surgical edits would be harder to read than a fresh draft — and when you do, say so in the transmittal: "We've replaced §8.2 rather than marking it up because the changes were extensive. Happy to walk you through the delta." When in doubt, smaller. A client who receives a surgical redline trusts that you read carefully. A client who receives a wholesale replacement wonders whether you read at all. ## Output **Before recommending signature of a vendor AI agreement (the version the company will execute):** Read `## Who's using this` in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. If the Role is Non-lawyer: > Signing this vendor AI agreement has legal consequences. Have you reviewed this with an attorney? If yes, proceed. If no, here's a brief to bring to them: > > [Generate a 1-page summary: the vendor and the use case, the key terms reviewed (data use, liability, auditability, model change, human review), where vendor positions diverge from policy, what's being accepted, what could go wrong, what to ask the attorney.] > > If you need to find an attorney, solicitor, barrister, or other authorised legal professional: your professional regulator's referral service is the fastest starting point (state bar in the US, SRA/Bar Standards Board in England & Wales, Law Society in Scotland/NI/Ireland/Canada/Australia, or your jurisdiction's equivalent). Do not proceed past this gate without an explicit yes. Review/redline drafts for attorney consideration do not require the gate — signature does. ```markdown [WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see `## Who's using this`] *This review is derived from vendor contract terms that are typically confidential under NDA, and it may itself be privileged. It inherits the source's confidentiality and privilege status. Distributing it beyond the privilege circle (e.g., forwarding to the vendor, sharing in an open channel) can waive privilege and breach the NDA. Mark, store, and route accordingly.* # Vendor AI Review: [Vendor Name] **Document reviewed:** [AI addendum / main agreement AI provisions / ToS] **Reviewed:** [date] **Use case(s):** [what we're deploying this vendor's AI for] **Governance tier:** [Standard / Elevated / High] --- ## Bottom line [Two sentences. Can we deploy under these terms? What has to change first?] **Issues:** [N]🔴 [N]🟠 [N]🟡 [N]🟢 --- ## Term-by-term [For each term above — vendor position, our position, gap, severity, proposed fix] --- ## AI addendum status [Present / Absent — and what that means for this deployment] --- ## AI policy consistency [🟢 Consistent | 🟡 Flags: list] --- ## Recommended redlines [Consolidated draft redlines. Review with counsel before sending externally. For critical issues where no fallback exists, flag for escalation rather than proposing language.] --- ## If they won't move [For each 🔴 and 🟠: the fallback from `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`, or "escalate — outside fallback" and routing per escalation table] ``` --- ## Practical notes **The training-on-data clause is the one most people miss.** Vendor AI terms have historically varied widely on whether API inputs can be used to train or improve models — some vendors permit it by default, others prohibit it, and many have changed their position over time. Do not assume any particular vendor's current stance without reading the specific agreement in front of you. This is almost always the most important term for any company with confidential or sensitive data, and it must be confirmed in writing, not assumed from reputation or prior experience. **Map the AI stack.** Modern AI deployments are layered. Before reviewing terms, map the layers: 1. **End-user SaaS application** (e.g., a legal tech tool, a CRM with AI scoring, a document assistant) — the tool your org signs up for 2. **API gateway / orchestration layer** (e.g., Azure OpenAI Service, AWS Bedrock, Google Vertex, LangChain-hosted) — often invisible, always has its own terms 3. **Model provider** (e.g., Anthropic, OpenAI, Google, Meta) — the LLM 4. **Hosted knowledge base / RAG source** (e.g., a vector database, a third-party data corpus, a retrieval service) — the data Claude reads from 5. **Additional subprocessors** — analytics, logging, fine-tuning partners Ask: "Walk me through the stack — what does [SaaS tool] use under the hood? Is it built on a cloud AI service? Does it call a model provider directly or through a gateway? Does it use a hosted knowledge base?" Then review terms at EACH layer, not just the top. Each handoff between layers is a flow-down risk. A commitment at layer 1 ("we won't train on your data") means nothing if layer 3's terms say otherwise and layer 1 never flowed the commitment down. **Flow-down test.** For each flagged stacked-vendor term — especially training-on-data, data retention, subprocessor changes, and liability — don't just flag "check upstream terms." DO THE CHECK: 1. **Search the contract for flow-down language.** Look for: "subprocessor obligations no less protective than," "flow-down of data commitments," "back-to-back terms," "Provider shall ensure that its subprocessors are bound by," "equivalent obligations." 2. **If present:** Quote it, verify it covers the specific flagged term, and flag whether it's enforceable (who can enforce it — you, or only the intermediate vendor?). 3. **If absent:** Produce a specific redline requiring it: > "Add to §[X]: Provider shall ensure that any third-party model providers, infrastructure providers, or subprocessors used in delivering the Services are bound by obligations with respect to [Customer Data / AI training / data retention / confidentiality] no less protective than those set forth in this Agreement, and shall be responsible for any breach of this Agreement caused by such third parties." 4. **Flag the gap with a severity:** 🔴 if the term is training-on-data or liability and there's no flow-down; 🟡 if the term is less sensitive or there's partial flow-down. "Escalate and check upstream" is where compliance dies. Produce the test and the redline. **Acceptable use policies flip the frame.** AUPs tell you what you can't do; they don't tell you what the vendor can do. Don't let a clean AUP review substitute for reading the data use and liability terms. **Renewals are leverage points.** If the current agreement is unfavorable and the vendor won't renegotiate mid-term, document the gaps now and flag them for the renewal. Flag to procurement: "This renewal should not close without AI addendum addressing [list]." **Builder context adds a layer.** If the company is a builder using a vendor's model as a foundation, the vendor's terms also govern what the company can offer its own customers. Some terms prohibit certain downstream uses. Check use restrictions against the product roadmap, not just current internal workflows. --- ## Close with the next-steps decision tree End with the next-steps decision tree per CLAUDE.md `## Outputs`. Customize the options to what this skill just produced — the five default branches (draft the X, escalate, get more facts, watch and wait, something else) are a starting point, not a lock-in. The tree is the output; the lawyer picks. ## What this skill does not do - It doesn't review the DPA provisions of the same agreement — run `/privacy-legal:dpa-review`, if the plugin is installed, for that. - It doesn't decide whether to accept terms outside the fallbacks. It routes those per the escalation table in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. - It doesn't evaluate vendor security posture beyond what's in the agreement — that's a security team function. --- Attribution added by YourAIKit. It is not part of the upstream file. - Source: https://github.com/anthropics/claude-for-legal/tree/main/ai-governance-legal/skills/vendor-ai-review - Credit: Anthropic, Claude for Legal (ai-governance-legal) - Upstream copy: anthropics/claude-for-legal at commit 4a6c651889c97cc9140580363c73e0eb17379c2b, ai-governance-legal/skills/vendor-ai-review/SKILL.md - Copyright: held by the upstream authors credited above - License: Apache-2.0. Full text: https://youraikit.com/licenses/anthropics-claude-for-legal-root/LICENSE - The full upstream license text (LICENSE) follows. License (LICENSE): ```text Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ```