A workable license policy has three tiers: allow, review and deny. Allow covers licenses you accept without a conversation. Review covers licenses whose obligations depend on how you use them. Deny covers licenses your business model cannot meet. The tiers are only useful if each has an owner and a record.
Tier one: allow
These need only attribution or notices. Typical members are MIT, BSD style licenses and Apache 2.0, with the duties spelled out in each text. For Apache 2.0, the NOTICE file and the license copy travel with redistribution; see the Apache NOTICE checklist.
Allowed does not mean free of work. Someone still needs to ship the notices.
Tier two: review
Put here licenses whose obligations depend on use:
- LGPL and MPL 2.0, where linking and file level changes matter.
- GPL family licenses for components you only use internally, such as build tools.
- AGPL, where modification plus network use triggers a source offer.
- Source available licenses such as SSPL and BSL.
- Content licenses such as CC BY-SA.
- NOASSERTION, which is unknown rather than approved.
For each review, record the component, how it is used, who decided and when.
Tier three: deny
Deny what you cannot comply with. For a product shipped to customers as binaries, that often includes GPL and AGPL code linked into the product. For a hosted service, the list differs, so write the policy against your actual distribution model, not a generic template.
Also deny packages with no license information (NONE), until someone resolves them.
Make it enforceable
- Express the policy as identifiers, using SPDX ids and expressions.
- Run it at pull request time, so a new dependency with a review or deny license is visible before merge.
- Define the exception process: who may approve, for how long, and where it is recorded.
- Review the policy yearly, and when your distribution model changes.
Handling expressions
A package with an OR expression can often be taken under the allowed option. An AND expression requires meeting all parts, so evaluate the strictest. See reading SPDX expressions.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, plus policies and gates that you configure. Try the free scan to see your inventory first. Tier assignments are legal decisions for your organization.
Quick check
Where does NOASSERTION go?
In review. It means no statement was made, so the license is unknown, not approved.
Is the same deny list right for every company?
No. It depends on whether you ship binaries, host a service or both.
Sources
None cited beyond the linked posts. License texts for each tier are linked from those posts.
Last reviewed: 19 October 2026.
