Licensing
August 11, 2026 ยท View on GitHub
ACS ships under two licenses. Code and machine-readable schemas use the Apache License 2.0. Prose documentation uses Creative Commons Attribution-ShareAlike 4.0 International. This matches how the OWASP GenAI Security Project licenses its guidance and its code.
Copyright 2025-2026 The OWASP GenAI Security Project and the ACS contributors.
What each license covers
| Path | License | SPDX identifier |
|---|---|---|
specification/** | Apache License 2.0 | Apache-2.0 |
.github/** | Apache License 2.0 | Apache-2.0 |
pyproject.toml, uv.lock, mkdocs.yml, .vscode/** | Apache License 2.0 | Apache-2.0 |
| Code samples embedded in any Markdown file | Apache License 2.0 | Apache-2.0 |
docs/** | CC BY-SA 4.0 | CC-BY-SA-4.0 |
README.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, CONTRIBUTORS.md, STYLE.md, SPEC_REVIEW_PRINCIPLES.md, LICENSING.md | CC BY-SA 4.0 | CC-BY-SA-4.0 |
Full texts live in LICENSE for Apache 2.0 and LICENSE-DOCS for CC BY-SA 4.0. Attribution details live in NOTICE.
Code samples inside the documentation carry the Apache 2.0 grant, not the ShareAlike obligation. Copy a JSON payload or a hook definition out of docs/ into a proprietary agent and nothing forces you to open-source the result.
Why the split
Documentation under CC BY-SA 4.0 stays free to copy, translate, and adapt. Adaptations carry the same license forward, so derived guidance stays open.
Code and schemas under Apache 2.0 give implementers an express patent grant. Building an ACS-conformant agent does not expose you to patent claims from the people who wrote the schema. MIT is silent on patents, which is the reason ACS moved off it.
Apply the license to your own work
For a source file:
# SPDX-License-Identifier: Apache-2.0
# Copyright 2026 <your name or organization>
For a document derived from ACS prose:
Adapted from the Agent Control Standard, licensed under CC BY-SA 4.0.
Source: https://github.com/GenAI-Security-Project/agent-control-standard
Contributing
Contributions land under the license that governs the file you touch. Sign your commits with git commit -s to certify the Developer Certificate of Origin. See CONTRIBUTING.md.
Trademarks
These licenses cover copyright. They grant no rights to the OWASP name, the OWASP GenAI Security Project name, the Agent Control Standard name, or any associated logo. Describe your implementation as ACS-conformant. Do not imply endorsement.
License history
Releases up to and including v0.1.0 were published under the MIT License. That grant stands. Anyone who obtained ACS under the MIT License keeps their rights under it. Contributions merged after the relicense are governed by the terms on this page.