Responsible AI at Grovity

At Grovity, the language model is not the solution: it is one component inside an orchestration layer that controls what information each AI agent receives, which actions it can take, and under which rules it responds. This statement summarizes the principles and controls with which Grovity designs and operates AI agents.

• Bounded behavior. Each agent operates within a business scope defined by the Client, with configurable guardrails about what it can and cannot do.
• Grounding. Responses are based on the Client's approved knowledge and on data retrieved from authorized systems, not on the model's free knowledge.
• Human oversight. Agents can hand a conversation over to a human, and the Client remains in control of its agents' behavior.
• Transparency. End users must be informed that they are interacting with an AI system.
• Privacy by design. Only the data necessary for each task is sent to the models, and Client data is not used to train them.
• Traceability. Agent configuration, instructions, and operation are versioned and recorded.

Control	Description
Restricted actions	Agents can only invoke predefined business functions assigned to them, with typed parameters validated server-side. They never execute arbitrary code.
Knowledge scoped by tenant	Knowledge retrieval only queries the indexes of the responding agent's Client.
Separation of instructions	System instructions are kept separate from end-user content to reduce the risk of prompt injection.
Versioned configuration	The model, parameters, and instructions of each agent are versioned, so the configuration in effect at any time can be identified.
Governance and evaluation	Interactions can be evaluated and scored to detect deviations, and governance reports are available to the Client.
Human handoff	Conversations can be escalated to the Client's personnel.
Sensitive data exclusions	Payment card data is never included in prompts. Health data is processed only under the Health Data Addendum.

Grovity accesses language models primarily through Amazon Bedrock, within its AWS environment, and selects the model most appropriate for each agent. Depending on the Client's configuration, models from other providers are used through their enterprise APIs. The current providers are listed on the Subprocessors page. Under the enterprise terms of each provider, Client data, prompts, and outputs are not used to train their models, and Grovity does not train or fine-tune models with Client data.

No provider can guarantee that a system based on foundation models is free from bias or error, and Grovity does not make that claim. Grovity mitigates these risks by bounding agent behavior, grounding responses in approved knowledge, allowing more deterministic configurations where the use case requires them, and keeping humans in the loop. AI outputs can be wrong and should be validated before being relied upon for important decisions.

The Acceptable Use Policy prohibits using AI agents to provide medical, legal, psychological, or financial advice without the participation of a qualified professional, to make decisions with legal or similarly significant effects on individuals based solely on automated processing, or to impersonate real people. Use in health-related activities is subject to the Health Data Addendum.

Grovity provides the platform and its controls. The Client defines its agents' purpose, instructions, knowledge, and guardrails; informs its end users about the use of AI; supervises its agents; and responds to escalations.

Questions about Grovity's use of AI or requests for AI governance documentation for audit purposes: privacy@grovity.ai.