Last reviewed: 2026-08-04
License policy
Set allow and deny license policies, record scoped allowances, and enforce license checks on pull requests without treating results as legal advice.
License decisions you can review
License policy compares licenses identified for dependencies against your organization’s allow and deny rules. Use it as a repeatable engineering gate before a dependency reaches production.
The Licenses tab, license compliance score, license PR checks, and the Quality Gate threshold Must match organization license policies share the same policy evaluator.
Configure and enforce
Define an allow or deny policy that reflects approved terms. Review unknown or multi-licensed packages rather than assuming a match. Enable the license PR check to surface violations on proposed changes.
Matching is SPDX / alias exact (case-insensitive, known aliases). Substring matches do not count: MIT-0 is not MIT. To allow MIT-0, append it to the whitelist, or use a scoped allowance / override for that package.
When a package or license needs an exception without changing the org rule for everyone:
- Scoped allowance (triage+ for project unit / repository; admin for package@org) with a required reason.
- Append to whitelist (admin) to allow a license organization-wide via policy.
- Override / honor (triage+) when the string to evaluate is wrong, then policy is re-checked.
Saving these decisions updates live license status and scores. It does not spend scan credits or rewrite persisted ScanResult / PR check history until the next natural license scan.
Edge cases
A dependency can expose more than one license; a transitive package can fail the check. Inspect the dependency path before changing a policy. A project-unit allowance must not silently authorize other units in the same repository. Organization-wide license approval belongs on the whitelist policy, not as a license×organization allowance.
Not legal advice
License output supports your review process; it is not legal advice. Involve qualified counsel for ambiguous licenses, redistribution obligations, or contractual requirements.