The Apache Software Foundation sorts third-party licenses into three buckets for its own projects. Category A licenses may be included, category B licenses may be included under conditions, and category X licenses must not be bundled. The scheme is a useful model for any team writing its own policy.
The three categories
| Category | Meaning | Examples the ASF lists |
|---|---|---|
| A | May be included | Apache 2.0, MIT, BSD without advertising clause, ISC, zlib, Boost, The Unlicense |
| B | May be included under conditions | Weak copyleft such as MPL, EPL and CDDL, some fonts, some Creative Commons Attribution content |
| X | Must not be included | GPL 1, 2 and 3, AGPL 3, LGPL, SSPL, non-commercial and field of use licenses |
What the conditions in B are
For category B, the ASF says to label the third-party work, its license and its home page, for example in a README. It also says category B works should not be included in source releases, and that they may appear in convenience binaries. Weak copyleft licenses ask for some give back on changes to the licensed files, so the foundation wants users to know the terms differ from the rest of the project.
Category X is about bundling
Category X does not mean a tool can never touch GPL software. The ASF page says that using a GPL licensed tool during a build is acceptable if it does not affect the licensing of the project. It also allows a project to rely on a category X component for an optional feature, as long as users are told how to get and install it themselves.
Why this matters outside Apache
These rules are written for ASF projects and their release practice. Your product has different needs, and a different delivery model. Still, the three bucket idea carries over well:
- Name a short list of licenses you accept without review.
- Name a list that needs a person to look and a recorded reason.
- Name a list you block by default, with a path for exceptions.
That is the same shape as an allow, review, deny policy. See three tier open source license policy for how to adapt it.
Limits of borrowing someone else's policy
Check where your own rules differ. A hosted service and a downloadable app treat copyleft differently in practice, and the ASF distribution model is not yours. Treat the ASF page as an example, not as advice for your case.
Safeguard supports policies, gates and guardrails, so a team can decide which findings block a pull request and which only warn. A free scan is available if you want to see your own dependency list first.
Quick check
Does category X mean the license is bad?
No. It means the ASF does not want that code bundled in its releases. Many projects use those licenses on purpose.
Where can I read the ASF text itself?
On the ASF legal page listed in the sources. Read it directly, since categories are updated from time to time.
Sources
Last reviewed: 19 October 2026.
