An acceptable use policy (AUP) is a set of rules that defines how a platform, service, or system may be used. It tells users what is allowed, what is restricted, and what kinds of behavior can lead to warnings, throttling, suspension, or account termination. In cybersecurity, an AUP is a basic governance control because it turns vague “don’t abuse the system” expectations into explicit, enforceable limits.
AUPs matter because many attacks start as policy violations before they become technical incidents. For example, an attacker may use a cloud service, API, or AI platform for phishing, spam, credential abuse, scraping, malware support, or high-risk dual-use work that the provider forbids. Defenders rely on AUPs together with logging, access reviews, rate limits, and content monitoring to spot misuse and prove enforcement. In AI security, AUPs are especially important because generated outputs can be copied, stored, and reused downstream after the original session ends.