By KYN AI Advisory Team — AI implementation specialists, Singapore
In a custom agent project, you should own four things: your data, the code and configuration built for you, the prompts and rules the agent uses, and the cloud account the system runs in. Most disputes arise because the contract is silent or vague on one of them. At KYN, every system runs in a cloud account in the client's name, rights in the custom code and configuration pass on full payment, and the client can revoke KYN's role while everything keeps running. Ask any vendor for the same four answers in writing.
What are the four things to own?
| Item | What it is | What to get in writing | |---|---|---| | Your data | Customer records, documents, messages, logs | You own it. Vendor uses it only to deliver the service | | Code and configuration | What was built for you | Rights pass to you on full payment | | Prompts and rules | Instructions, checks, approval logic | Delivered to you in readable form, versioned | | Cloud account | Where the system runs | In your name, with the vendor as a revocable role |
A packaged product usually gives you less. You may own your data but not the logic, and exporting may be limited. That is a trade-off for speed. Know it before you sign.
Who owns the data?
You do. The harder question is where it is, and who else touches it.
Ask five things:
- In which cloud account and region is it stored?
- Which model providers receive any of it, and under what data-use terms?
- Is any of it used to train a model?
- Who at the vendor can read it, and is that access logged?
- How is it deleted at the end of the contract?
If your data includes personal data about people in Singapore, the PDPC's guidance on the Personal Data Protection Act applies to how you and your service providers handle it. A vendor processing data for you is a data intermediary, and you remain responsible for the data. Hong Kong, Indonesia and Malaysia have their own regimes. Get advice for each country you hold data in.
Who owns the prompts?
This is the least settled point in the market, so write it down.
A prompt is an instruction to a model. In a good agent, the prompts are only part of the logic. The rest is rules in code: what the agent may do, what needs approval, what it checks before it sends. Together they are your process, written down.
Ask for these terms:
- all prompts, rules and checks delivered in readable form, in version control;
- no dependence on a vendor-hosted prompt you cannot export;
- a change log showing who changed what and when;
- the right to modify them yourself or hire someone else to.
If the vendor keeps the prompts in its platform and you cannot read them, you do not own your process. You rent it.
Who owns the code?
Look for the following clauses:
- Assignment on payment. Rights in the custom code and configuration pass to you on full payment. Until then, you hold a licence to use it.
- Third-party and open-source parts. These keep their own licences. A vendor should list them.
- Vendor tools. A vendor may keep rights in its general-purpose libraries and reuse them. That is normal. Make sure the licence you get to those is perpetual and covers your use.
- Source delivery. You receive the source, not only the running system.
Ask: "If we stopped paying you tomorrow, what could we run, change and hand to another engineer?" The answer reveals the real position.
Who owns the cloud account?
This is the most practical test. If the system runs in the vendor's account, they hold the keys. If it runs in a cloud account in your name, you hold them. The vendor operates through named roles that you can revoke.
At KYN the account is yours from day one. People and agents have named accounts through the cloud provider's identity service. There are no shared logins. Agents have their own restricted accounts. Every action is logged with the actor. If you revoke our role, the system keeps running.
What happens when the contract ends?
Plan the exit before you start. A good exit plan has five parts:
- a list of every component and where it lives;
- credentials and access held by you, not the vendor;
- documentation sufficient for another engineer to take over;
- a data export in an open format;
- a handover period, with a price.
Ask for it as an appendix to the contract. Vendors who build for ownership find this easy. Vendors who build for lock-in will resist it. See how to evaluate an AI agent vendor: 15 questions and questions to ask before hiring an AI agent consultancy.
What about the model provider?
The model is a service you call, not something you own. Your agent will send some text to a model provider. Check three things: the provider's data-use terms for API traffic, where processing takes place, and whether you can switch providers without rebuilding. A well-built agent keeps the model behind a thin layer so a change is configuration, not a rewrite.
Sierra, an agent vendor, publishes material on its own agent data platform, which shows that data handling is now a product topic. Read the vendor's terms for any hosted agent you consider.
What clauses are worth adding to the contract?
Add five short clauses. A data clause that states you own your data and that the vendor uses it only to deliver the service. A deliverables clause that lists source code, prompts, rules, configuration and documentation. An access clause that keeps the cloud account and credentials in your hands. A change-log clause that records every change to prompts and rules. An exit clause that sets a handover period, a data export in an open format and a price. Have your lawyer review the wording for each country you operate in. Most vendors who build for ownership will accept these without argument.
Where KYN fits
KYN builds custom systems for SMEs in Singapore, Hong Kong, Indonesia and Malaysia. The cloud account is in your name. Rights in the custom code and configuration pass to you on full payment. You can revoke KYN's role and everything keeps running. We use row-level security in the database and restricted accounts for agents.
The first 14 days are a review of your stack and interviews with your team. A full build ships in under 90 days. Pricing is a one-off build fee and a monthly retainer of at least twelve months, quoted after the review. See infrastructure and security.
Frequently asked questions
Do we own the AI model?
No. The model belongs to its provider, and you pay to use it. You own your data, your code, your prompts and rules, and the system that calls the model.
Can another firm take over the system?
Yes, if you hold the cloud account, the source and the documentation. That is why ownership terms matter more than the first quote.
Is a hosted agent product always worse on ownership?
Not always. It is a different trade. You get speed and lower setup cost, and you give up control of the logic and the record. Decide which matters for the task.
Checked 30 October 2026.
Curious whether Marketing agents fits your business? Talk to KYN on WhatsApp — no forms, just a conversation.
