Windsurf AGPL Code Indemnity: What Is Covered and What Remains Your Exposure

Indemnity is a remedy, not a control

A vendor IP indemnity allocates financial and legal responsibility if a third party alleges that generated output infringes its rights. It operates after the fact. It does not stop a suggestion from reproducing copyleft code, and it does not record which suggestions developers accepted into a repository.

This distinction matters for regulated enterprises because auditors and regulators usually ask what a system was allowed to do and what it did. A contract can inform the first question only weakly and cannot answer the second. NIST's withdrawn draft of the Generative AI Profile notes that organisations may update third-party contracts and warranties, including with GAI-specific indemnity clauses, and treats this as one risk control among several, alongside monitoring whether controls are effective. As a withdrawn draft, its wording is not final guidance, but the framing is useful: contract terms and operational controls are complementary.

For Windsurf, the practical consequence is that indemnity analysis and technical control design should proceed in parallel. Neither substitutes for the other.

How to read an indemnity programme for AGPL scenarios

AI coding assistant indemnity programmes generally turn on a small set of drafting choices. Read each one against the AGPL scenario rather than against general assurances.

First, how covered output is defined. Some definitions are limited to unmodified suggestions, and an indemnity framed around copyright or other infringement claims may not clearly address a licence-compliance obligation. Second, required settings. Coverage may depend on code-matching or public-code filters being enabled, which raises the question of whether administrators can enforce them centrally or users can switch them off. Third, exclusions, such as output that was modified, combined with other code, used outside the vendor's tooling, or used with knowledge of a problem. Fourth, procedural duties, including prompt notice, cooperation and vendor control of the defence.

Whether any of this extends to copyleft or network-copyleft output, or is silent on it, is a matter for the executed agreement, the current terms that apply to Windsurf under its present contracting entity, and counsel. Public terms and enterprise agreements can differ, so the signed document governs. This guide does not state what those terms say.

• Covered output: Does the definition reach suggestions that reproduce or derive from licensed code, and is licence-compliance exposure addressed or only infringement claims?
• Required settings: Which filters must be on for eligibility, and can they be locked at organisation level?
• Exclusions: Treatment of modified output, combined code, use outside the tool and known issues.
• Procedural duties: Notice, cooperation and defence control obligations on the customer.
• Contracting entity: Which entity's terms apply and how the enterprise agreement relates to public terms.

Why AGPL is a distinct risk

The GNU Affero General Public License is a copyleft licence. Like the GPL, it conditions distribution of modified versions on making corresponding source available under the same licence. Its distinguishing feature is Section 13, which extends source-offer obligations to modified software that users interact with remotely over a network. The AGPL's text and counsel's reading of it are the authority here.

That difference changes the exposure profile. With permissive licences, the usual obligation is attribution. With GPL code, obligations are commonly tied to distributing the software. Most enterprise software is delivered as a hosted service or internal network application and is never distributed in the traditional sense. AGPL-derived code inside such a service can therefore raise disclosure questions that distribution-based analysis would not.

For architects, the point is not to predict outcomes in any case. It is that AGPL provenance should be known before code is merged, because the cost of finding it later, after it has been built into a deployed service, is higher than the cost of controlling it at generation. Whether a specific use triggers obligations is a legal determination.

Evidence to retain

Enforcement is only defensible if it can be demonstrated. Regulated enterprises should decide in advance what evidence shows that licence policy was applied, and validate that design with counsel and audit.

Useful records include the policy version in force at the time, the generation event and the identity of the user or agent, the licence classification result, and the decision taken. Retention period, data residency and export into the organisation's own systems should be configurable, because evidence that sits only in a vendor's tooling is hard to produce on demand. NIST materials on secure software development and trusted source code supply chains frame this kind of traceability as recognised practice, and it should be mapped to the full NIST Generative AI Profile and SSDF community profile once your team has reviewed them.

Trussed produces audit-ready evidence as a by-product of enforcement, mapped to frameworks including NIST, and supports self-managed deployment in the customer cloud with configurable retention and data residency. The principle holds regardless of tooling: evidence should be generated by the control itself rather than reconstructed afterwards.