An AI-picked dependency still has a licence

GitHub announced general availability of open-source licence compliance on October 16. The feature is available to Enterprise Cloud customers, including data-residency customers, for repositories with GitHub Code Security enabled.

An enterprise policy and repository ruleset can require licence compliance results before merging. Pull requests that add or change dependencies receive annotations for policy conflicts. GitHub also provides a package-compliance API that coding agents can use when selecting dependencies. An enterprise licence-manager role can review exception requests.

Our reading: package selection is a product decision as well as a coding decision. Giving an agent access to the organisation’s policy could reduce avoidable rework, because a working implementation may still use a dependency the team cannot accept under its own rules.

For a pilot, choose a repository with a known dependency list. Check that policy failures reach the right reviewer and that exceptions have a clear owner. Treat the result as a check against the configured policy, rather than a blanket conclusion about every obligation attached to shipping the software.