Turn on a license gate in stages. Scan everything first, record existing findings as a baseline, run the gate in report only mode, then block only new violations on pull requests. Tighten later, tier by tier, with an owner and a date for each old finding. A gate that fails the whole backlog on day one gets disabled.
Why the naive rollout fails
If you enable a deny rule against a repository that already contains a denied license, every pull request fails, including ones that did nothing to dependencies. Developers learn the gate is noise and ask for it to be removed.
Staged plan
- Scan all repositories and export a full inventory with license values.
- Review the unknowns and the denied licenses first, since those need decisions.
- Store the current findings as a baseline, with an owner and a target date.
- Run the gate in report mode for two weeks and read the output.
- Switch to blocking for new findings only: a pull request fails when it adds or upgrades to a denied or unreviewed license.
- Work down the baseline by risk, then retire baseline entries as they are fixed.
| Stage | Behavior | Goal |
|---|---|---|
| Scan | No gate | Know what exists |
| Report | Comment only | Tune rules |
| Block new | Fail on new findings | Stop the bleeding |
| Burn down | Fix baseline | Reach zero exceptions |
Tune before you block
Review false positives. Expression handling is a common source: a dual licensed package with OR should not fail because one option is denied. Unknown licenses should go to review, not auto deny. See allow, review, deny tiers and how to baseline a new scanner.
Give developers a way out
Provide a request path for exceptions with a named approver and an expiry. See how to track exceptions for the register pattern.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a gate evaluates a change and note which results would block and which would only warn.
Measure the rollout with two numbers: how many baseline entries remain, and how many pull requests the gate blocked that turned out to be wrong. The first should fall every month. The second should fall to near zero after tuning. If the second stays high, fix the rules before adding strictness, because trust in the gate is what makes it last.
Safeguard supports policies and gates for pull requests, and you can start with a free scan to see your baseline.
Quick check
Should a new gate block on day one?
Usually not. Start in report mode, baseline old findings, then block new ones.
What about unknown licenses?
Route them to review rather than auto deny.
Last reviewed: 19 October 2026.
