License policy

A license policy is a set of rules about which open-source licenses the software you ship may include. It usually names licenses that are banned, such as strong copyleft licenses in a product you distribute, and sometimes ones that need legal review first.

What it is

Every open-source dependency comes with a license, and each license sets terms: attribution, sharing source code, patent grants. A license policy turns your organisation's position on those terms into a list that tools can check. Policies are normally written with SPDX license identifiers, such as MIT, Apache-2.0 or AGPL-3.0-only, so there's no doubt about which license is meant.

To enforce a policy you need to know what's in the software, which is what an SBOM records.

Why it matters

One transitive dependency under an incompatible license can create an obligation you didn't plan for. Checking licenses at release time, automatically, is cheaper than finding the problem in a customer's audit. AI agents make this more pressing: an agent asked to add a feature may add a package nobody reviewed.

In AI CodeOps

A license policy is an option on the release check your CI calls, POST /api/release/check. Pass the licenses you don't allow in disallowedLicenses:

curl -s -X POST "https://console.aicodeops.dev/api/release/check" \
  -H "Authorization: Bearer $WORKSPACE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"pullRequestURL":"https://github.com/acme/checkout/pull/42","disallowedLicenses":["GPL-3.0","GPL-3.0-only","AGPL-3.0","AGPL-3.0-only"]}'

For each project the change touched, AI CodeOps reads the latest SBOM's license summary and denies the release if a disallowed license has at least one component. The reasons read like this:

Disallowed license "GPL-3.0-only" in checkout (2 components)
No SBOM recorded for checkout, so its licenses can't be checked

The details come back in licenseViolations, for example [{ "projectID": "checkout", "license": "GPL-3.0-only", "count": 2 }].

Things to know:

• No SBOM, no pass. With a license rule set, a project with no recorded SBOM is denied.
• Exact IDs. The match ignores case but is otherwise exact. The SPDX list deprecated GPL-3.0 in favour of GPL-3.0-only and GPL-3.0-or-later, and generators differ in which they write, so list each form you want to ban.
• Project, not commit. The check reads the project's current SBOM. Record a new one when dependencies change.
• API only. The per-session quality gate doesn't check licenses, and the Review & Gate → Release gate page has no license field. Set the rule in the API call.

The full options are on the API page.

Related terms

• SBOM: where the license summary comes from.
• CycloneDX: a format whose component entries carry SPDX license IDs.
• Software composition analysis (SCA): tools that detect licenses in your dependencies.