Home › Research › Enterprise Agreements › Agreement stack workflow

Agreement stack workflow

How this was built. This workflow and the enterprise agreement section of this site were built and are maintained with an OpenClaw instance – the AI assistant platform run by Gareth Spanglett. The assistant researches the primary sources, keeps the registry and site data current on a schedule, and drafts the updates; every change is reviewed before it ships.

Monthly change-check on the vendor agreement stacks (Microsoft, Google) documented in the IPC report Beyond the Initial Agreement – the recurring control against privacy drift.

Owner: Legal Admin (legal domain agent) · Trigger: Monthly scheduled run: the Microsoft stack and the Google stack are each checked, then a combined synthesis. · Workflow snapshot 2026-11-04

The interactive map needs JavaScript. The same content is listed below.

Execution flow

Trigger – Monthly scheduled run: the Microsoft stack and the Google stack are each checked, then a combined synthesis.
Step 1 – Read the run state and the agreement registry (Legal Admin)
Step 2 – Check each instrument against its source (Legal Admin)
Delegation – the Legal Admin fans the instrument checks out to 73 lanes, each in its own isolated session.
Step 3 – Record version, date and a change note (Legal Admin)
Step 4 – Update the activity log on the Microsoft and Google stack pages (Legal Admin)
Step 5 – Write the monthly run report (Legal Admin)
Step 6 – Deliver report and changes for human-in-the-loop review. (human-in-the-loop)
Output and Publish – The agreement registry, updates to the Microsoft and Google stack pages, and the report and changes routed for human-in-the-loop review.

Delegation topology

The AI orchestrator delegates to the Legal Admin, which checks each instrument in its own isolated session.

MS-01 – Microsoft Customer Agreement (MCA)
MS-02 – Enterprise Agreement (EA/EAS/SCE)
MS-03 – Products and Services Agreement (MPSA)
MS-04 – Microsoft Product Terms (site)
MS-05 – Product Terms – Summary of Changes
MS-20 – Universal License Terms for Online Services
MS-07 – Privacy & Security Terms (General · Core Online Services · EU Data Boundary Services · EU Data Act)
MS-11 – Product Terms Glossary
MS-06 – Products & Services Data Protection Addendum (DPA)
MS-08 – SLA for Online Services (consolidated)
MS-09 – Enterprise AI Services Code of Conduct
MS-12 – Microsoft Privacy Statement
MS-13 – Microsoft Services Agreement (MSA)
MS-17 – Product Terms data-residency – M365 Copilot
MS-21 – Subprocessor lists
MS-22 – Professional Services DPA
MS-B01 – Azure Preview Supplemental Terms
MS-23 – EU Data Boundary documentation
MS-24 – Customer Copyright Commitment (incl. required mitigations)
MS-25 – GitHub Customer Agreement + GitHub DPA
MS-BING – Bing grounding under Copilot/Foundry
MS-15 – Enterprise data protection in M365 Copilot (Learn)
MS-18 – Microsoft Licensing Resources & Documents
MS-26 – Azure Legal Information
MS-B02 – Azure Government / Azure China boundary
MS-27 – Bing enterprise-grounding Terms of Use
MS-28 – Microsoft Web IQ Terms of Use
MS-29 – Microsoft IQ product terms
MS-30 – Agent 365 product entry (incl. integrated-service data flows)
MS-31 – Microsoft 365 product entry
MS-32 – Power Platform product entry (incl. Copilot Studio)
MS-33 – Microsoft Azure product entry (Foundry Models; abuse monitoring)
MS-34 – Foundry model-specific terms (+ linked provider policies)
MS-35 – Microsoft APIs Terms of Use
MS-36 – GitHub Offerings product entry
MS-37 – Standard Contract for Microsoft Marketplace
GO-01 – Google Cloud Terms of Service (consolidated)
GO-02 – Google Cloud Master Agreement – Block.one LLC ↔ Google LLC (SEC exhibit)
GO-03 – Cloud Data Processing Addendum (Customers)
GO-04 – Google Terms of Service
GO-05 – Google Privacy Policy
GO-06 – Workspace entry point → GO-01
GO-07 – Google Cloud Acceptable Use Policy
GO-08 – Google Workspace Service Level Agreement
GO-09 – Workspace / Cloud Identity subprocessors
GO-10 – Cloud Identity Terms of Service (archived 30 Jan 2025)
GO-11 – GO-01 §4.3 – Generative AI Safety and Abuse for GCP Services
GO-12 – Google Workspace Service Specific Terms
GO-13 – Adjacent consumer layer (grouping note)
GO-14 – GCP Service Specific Terms
GO-15 – Generative AI Prohibited Use Policy
GO-16 – Agentic AI Responsible Use Guidelines
GO-17 – GCP subprocessors
GO-18 – SCC modules (grouping note)
GO-19 – Google Cloud SLA directory
GO-20 – Generative AI Indemnified Services list
GO-21 – Regional modifications
GO-22 – Google Cloud Privacy Notice
GO-23 – Supplemental Google Cloud Privacy Notice
GO-24 – Service Data Addenda (Workspace / Education / GCP)
GO-25 – Advanced AI Safety Addendum
GO-26 – Abuse monitoring documentation
GO-27 – OpenRouter ZDR / Google Safety Retention
GO-28 – GCP Technical Support Services Guidelines
GO-29 – Google Cloud Services Summary
GO-30 – Workspace Services Summary
GO-31 – GCP Services with Data Residency
GO-32 – Workspace Data Regions Page
GO-33 – Google Contracting Entity
GO-34 – Direct-ToS exemptions for resold customers
GO-35 – Gemini API Additional Terms (AI Studio / developer API)
GO-36 – Workspace generative-AI Privacy Hub
GO-37 – Google Cloud terms change summary

Method

How a run works

Each month the workflow re-checks every instrument in both stacks against its own source, records version, date and a change note, and updates the stack pages and the monthly run report. It ends with the report and recorded changes delivered for human-in-the-loop review.

Sources. Read-only web research: the vendor change-log and summary pages first, then the instruments themselves (Microsoft Product Terms Summary of Changes, DPA, Privacy & Security Terms, subprocessor lists; Google Cloud and Workspace terms, Privacy Hub, subprocessor lists). Where a vendor site blocks automated access, a fallback browsing route is used.

Controls

Evidence and limits

Verification. Every change cites the original source URL; no entry is marked verified without opening the source; when a source is unavailable the run is recorded as partial and prior values are retained.

Scope. Read-only. Any external action (contacting a vendor, accepting terms) requires human-in-the-loop approval.

Output and Publish. The agreement registry, updates to the Microsoft and Google stack pages, and the report and changes routed for human-in-the-loop review.

The monitoring notes on this site track published developments in vendor terms. They are informational and are not legal advice.

See the results

The workflow feeds the registry, the stack pages and the interactive stack map.

Enterprise Agreements Interactive stack map