Open Source Governance and Policy

A relicense is no longer a rare event. As of August 2023, HashiCorp moved Terraform, Vault, Consul, Nomad, and Packer to the Business Source License. As of March 2024, Redis adopted a dual Redis Source Available License and Server Side Public License model. Elasticsearch and Kibana moved to the Server Side Public License and the Elastic License in 2021. Each change reached software that was already running in production. The teams that absorbed the change quietly were the ones with governance in place. The teams that learned about it from a vendor letter were not.

Open source governance and policy closes that gap. It turns the decision about what enters your stack from an unrecorded engineering habit into a controlled, auditable process. The point is not to slow delivery. The point is to know, at any moment, what governs the software you ship, so that the next license change is a managed event rather than a surprise.

What open source governance and policy covers

We build governance as an operating system, not a binder. The engagement produces a license policy that states plainly which licenses are allowed, which require review, and which are blocked, mapped to your tolerance for competitive use restrictions, copyleft obligations, and commercial license demands. We pair the policy with an allowlist your developers can actually use and an exception path for the cases that need judgment.

From there we wire approval gates into your build and procurement flows. A new dependency, direct or transitive, is checked against the policy before it merges. A vendor that signals a license change triggers a review before the renewal, not after. The controls live where the work happens, so compliance is the default path rather than a separate task someone has to remember.

How governance catches the next relicense early

A relicense becomes expensive when it is discovered late. By the time a source available term reaches an audit, the component is woven through production, the negotiating leverage has shifted to the vendor, and the cost to cure has grown. Governance moves discovery to the front of the line. A continuously refreshed software bill of materials gives you the live map, the policy gives you the rule, and the intake gate gives you the moment of decision. When a project signals a change, you see which systems touch it within hours, not after a quarter of investigation.

This is also where governance connects to the rest of your risk program. The same map that satisfies a regulator is the map that lets you flag a relicensed component before it becomes a finding. Read more in our pillar on open source governance and SBOM, which sets out the full operating model.

Built to your risk tolerance, not a template

A bank that redistributes software carries different exposure than an internal platform team. A software vendor that ships open source to customers faces copyleft and attribution obligations an end user does not. We calibrate the policy to your business model and your appetite for risk, then document the reasoning so the rules hold up when someone asks why a license is blocked. The deliverable is a governance program your engineering, procurement, and legal stakeholders can each defend in their own language.

We work only from the buyer side. We do not resell tooling, we take no vendor commission, and we are paid only by you. That independence is the whole point: the policy reflects your interests, not a tool we are incented to sell. You can read more about why our independence matters.

Where governance fits in the wider program

Governance is the prevention layer. It sits alongside the work we do to map and contain exposure that already exists. If you have not yet mapped your dependency tree, start with our pillar on open source license risk. If a specific vendor change is the pressure point, see HashiCorp and Terraform licensing or Redis, Elastic, and database relicensing. When a change has already landed and you need a path out, the pillar on relicensing exposure explains the options. Governance makes sure you do that mapping once and then keep it current.

GOVERNANCE IN PRACTICE