needs-compliance

Dependency license compliance violations are identified by scanning direct and transitive dependencies against rules defined in docs/constraints.adoc. The scan flags direct, transitive, and unknown license conflicts, providing governance-ready audit reports and proposing remediation steps to the orchestrator.

Transitive dependency license analysis detects policy violations in nested packages within a software project. It matters for governance because it exposes hidden legal risks from indirect dependencies, ensuring comprehensive audits and enabling accurate remediation planning for all unknown or non-compliant licenses.

Yes, you can enforce specific licensing rules by defining them in a docs/constraints.adoc file. The compliance enforcement process reads these regulatory and governance constraints, applies them across the software project, and flags any direct or transitive dependencies that violate the specified policies.

Remediation for unknown or non-compliant dependency licenses is planned by running a compliance scan that identifies violating packages and proposes targeted remediation steps to the orchestrator. This workflow integrates remediation planning directly, ensuring all direct and transitive legal risks are resolved systematically.

Yes, the compliance scan works for projects with complex regulatory constraints and governance requirements. It reads rules from docs/constraints.adoc to analyze all dependency licenses, enabling comprehensive audits and ongoing enforcement tailored to your specific legal and regulatory environment.