# License policies

> Mark licenses allowed, needing review, or denied, by SPDX id or by category; get findings for dependencies that break the policy; record legal approvals.

MergeHarbor knows the license of each package version in your inventories, from the lockfile or SBOM when it says, and otherwise from the package registry. **Vulnerabilities → Inventory → Licenses** lists the licenses in use, how many packages and repositories use each, and what your policy says about them.

## Set a policy

Under **Vulnerabilities → Settings → License policies → Edit policies**, give a decision to a license by its SPDX id (`GPL-3.0-only`) or to a whole category:

| Category         | Examples                           |
| ---------------- | ---------------------------------- |
| Permissive       | MIT, Apache-2.0, BSD-3-Clause, ISC |
| Public domain    | CC0-1.0, Unlicense                 |
| Weak copyleft    | LGPL-2.1-only, MPL-2.0, EPL-2.0    |
| Strong copyleft  | GPL-2.0-only, GPL-3.0-or-later     |
| Network copyleft | AGPL-3.0-only                      |
| Source available | BUSL-1.1, SSPL-1.0                 |
| Unknown          | no license found                   |

Each decision is **allowed**, **review** or **denied**, with optional instructions shown on the finding ("Ask legal before shipping", "Replace with an MIT alternative"). A rule for a specific license wins over its category.

Packages under a **denied** license become high-severity license findings; **review** licenses become medium findings. They have SLAs, owners, tickets and exceptions like every other finding. For a dual-licensed package (`MIT OR GPL-3.0-only`), the most permissive choice counts.

Without any policy, no license findings are created.

## Legal approvals

When legal clears a package, add an approval under **License approvals**: the package, optionally one version, and the license. The matching findings close, and the approval is recorded with who added it.