AI and MCP Policy

This policy applies to AI assistants, generated explanations or drafts, document and data analysis, MCP tools, APIs used by AI clients, and third-party model providers connected to WorkpaperOS.

AI may answer product questions from the verified Help Center, summarize permitted records, identify exceptions, prepare drafts, suggest mappings, and call approved tools within the active company and user's permissions.

An authorized person must verify source data, calculations, mappings, dates, parties, accounts, rates, and legal treatment. AI must not be the final approver for payroll, payment, journal posting, tax filing, audit opinion, employee discipline, access grants, or deletion of material business records.

Only information reasonably needed for the task should be provided to the selected model. Customers may use WorkpaperOS-managed AI or configure an approved provider and API key. Provider processing, location, and retention can differ, so administrators must review the provider's terms before enabling it.

MCP tools must enforce the same company scope, roles, validation, and business rules as the product. Write actions should return identifiers and results that can be verified in the WorkpaperOS UI, reports, or audit history. Sensitive actions may require explicit confirmation.

AI can misunderstand instructions, omit facts, or generate plausible but incorrect content. An answer is not guaranteed to reflect current law, a customer's complete records, or every product configuration. Verified Help Center content should be preferred for product usage questions.

Do not use AI or MCP to bypass access controls, discover another company's data, expose passwords or secrets, fabricate evidence, conceal accounting differences, make unlawful employment decisions, impersonate a person, or perform an action the user is not authorized to perform in the product.

WorkpaperOS may retain prompts, tool calls, results, approvals, errors, and security events as needed for service delivery, troubleshooting, auditability, and abuse prevention. Visibility and retention depend on company configuration, provider terms, and legal obligations.

Stop using an output that appears wrong or exposes unexpected data. Report the company, product, task, time, and affected record to accountants@etiendemcpa.com without including passwords, OTP codes, or API keys.