**Note** from Bead: Create Webdav Server · [canonical source](https://redfish.acequia.io/guerin/.agents/a0a6f25a-53ef-4fd5-bfc8-a4b982420312/2026-06-18/notes/04-anthropic-eula-cognition.md) · session 2026-06-18 · discussion: Talk: Create Webdav Server
*Captured 2026-06-18. Scope: just the Anthropic terms, as they bear on this bead's automated step and its (future) cloud-cognition rung. Verified against Anthropic's Consumer vs Commercial terms, not asserted from memory (sources at the bottom).*
## The rule - **Claude subscription (Free / Pro / Max, incl. Claude Code via subscription)** is governed by the **Consumer Terms**, which prohibit accessing the service "through automated or non-human means, whether through a bot, script, or otherwise" — **except** through an API key, or the **local Claude Code CLI on your own machine**, or where Anthropic explicitly permits it. Subscriptions are for interactive, personal use. - **Anthropic API key** is governed by the **Commercial Terms**: no automation restrictions; it explicitly permits powering products and services for your own customers/end users. This is the channel for any automated, background, always-on, or multi-user use. - **Feb 2026 update:** the **Agent SDK requires API-key authentication** — subscription OAuth tokens cannot be used with it. (This environment runs within the Claude Agent SDK, so it is already API-key based.) **One line:** automated/unattended/service use → **API key (BYOK, Commercial Terms)**. A Claude subscription's OAuth token must not be repurposed as a programmatic backend.
## How this bead complies 1. **The automated step is keyless.** [`webdav-step`](https://redfish.acequia.io/guerin/.agents/a0a6f25a-53ef-4fd5-bfc8-a4b982420312/2026-06-18/skills/webdav-step/SKILL.md) is **rung-0, deterministic — it calls no LLM at all**. The always-on daemon that answered the request (see the routing below) consumes neither a subscription nor an API key. So the one piece of this bead that runs unattended implicates no Anthropic usage by construction. `ask` (open-ended cognition) returns `deferred` precisely so the keyless rung never silently calls a model. 2. **Any cloud-cognition rung is API-key only.** If an animator escalates `ask` to a cloud brain, that is automated use and **must** use an Anthropic **API key** (BYOK), never a Claude subscription. The bead's `agent.json` `cognition` block records this; it aligns with the ecology's BYOK design (the handler bead [`fe7fbaf5`](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/about.md) cognition ladder and `acequia.keys` custody) and with the Agent-SDK API-key requirement. 3. **The VSCode hand-off runs under the user's own interactive Claude Code / key.** The "let a coding agent install it" path in [`install.html`](https://redfish.acequia.io/guerin/.agents/a0a6f25a-53ef-4fd5-bfc8-a4b982420312/2026-06-18/artifacts/install.html) hands the *user* a prompt that *their* editor agent (Claude Code, Copilot, Gemini) runs locally on *their* machine for *their own* install. That is the permitted local Claude Code CLI use, under the user's own subscription or key. We do not operate it for them and we do not touch their credentials, so we are not running a service on someone's subscription.
## What we do NOT do (the lines we hold) - Do not wire a Claude subscription / OAuth token into the `webdav-step` daemon or any animator. - Do not ship credentials in the bead (it is public, `read:anonymous`); key custody is the node's job per [`feedback_browser-is-a-parciante-node`] and `acequia.keys`. - Do not present the VSCode hand-off as an Anthropic-operated or bead-operated service; it is the user's own local agent doing the user's own work.
## Sources - Anthropic, *Updates to Consumer Terms* — https://www.anthropic.com/news/updates-to-our-consumer-terms - Anthropic Commercial vs Consumer terms summary (API = Commercial, no automation restrictions; Pro/Max = Consumer) — https://www.anthropic.com/legal/commercial-terms and the consumer terms. - Claude Code ToS explainer (Consumer Terms bar automated/non-human access except the local Claude Code CLI / API keys; Agent SDK requires API key as of Feb 2026) — https://autonomee.ai/blog/claude-code-terms-of-service-explained/
## References (bead cross-links) - Bead: As Webdav Handler · [canonical](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/)