Model License Policy

1. The real problem: downloadable is not the same as permitted for our use case

Assume three model artifacts are candidates for an internal commercial assistant. A is exact digest sha256:MODEL-A from a pinned revision and its model card says license: apache-2.0; B uses license: other with a custom license_name and license_link; C was copied into an internal mirror without preserving its license reference. The fact that all three files can be downloaded or executed proves no permission decision. The owned artifact is Model Artifact License Decision & Provenance Record v1.

2. Lesson boundary: an engineering policy gate, not legal advice

AIE-015 collects, binds, and routes evidence; it does not interpret ambiguous legal text as a lawyer. ALLOW, BLOCK, and REVIEW_REQUIRED are bounded automation outcomes for a declared use case under a declared policy oracle. BLOCK means the automated product path must not proceed under the current policy; it does not necessarily mean the activity is unlawful. Ambiguous, custom, or conflicting terms not explicitly covered by the oracle must remain under human review.

3. Bind the decision to exact artifact identity

A friendly name such as model-x-latest is not auditable identity. Record at least artifact_digest, source_revision, and source repository/reference. If the upstream revision or digest changes, the old decision remains historical evidence for the old artifact and must not migrate to the new artifact merely because the display name stayed the same.

4. License metadata is evidence, not an authorization oracle

Repository metadata is useful for discovery and provenance. Hugging Face model cards can record a license, and custom licensing can use license: other with license_name and license_link. That label alone does not prove the status of every dependency, dataset, adapter, notice obligation, or intended use. A product decision must bind captured evidence to an explicit policy version and use case.

5. SPDX normalizes identifiers; it does not grant permission

The SPDX License List provides standardized short identifiers and license expressions such as MIT OR Apache-2.0 for machine-readable communication of license information. This reduces naming ambiguity and makes evidence easier to compare. An SPDX identifier by itself does not decide whether your commercial use, redistribution, hosting, or modification is permitted; that conclusion requires the appropriate authority and policy.

6. Keep standard, custom, unknown, and conflicting evidence distinct

Do not collapse four different evidence states. STANDARD means metadata maps to a recognizable identifier/expression; CUSTOM means bespoke terms; UNKNOWN means required evidence is absent; CONFLICT means credible provenance records disagree. Even STANDARD is not automatically ALLOW. Custom, unknown, and conflicting states must route to human review or an explicit automated block according to policy.

7. Preserve license text/reference provenance with metadata

A reproducible decision needs more than license=.... Preserve the license text reference, URL, repository path, or pinned snapshot/reference where possible. If the artifact was mirrored, retain where the license reference came from and whether it belongs to the same source revision. A shared filename or a newer README must not be silently attributed to an older artifact.

8. Make the use case explicit and versioned

A license policy gate without a use case is underspecified. The record must state the question: internal commercial hosting, redistribution of weights, modification, API service, or attribution/notice handling. An ALLOW outcome is scoped only to that declared use. If the use case later changes from internal hosting to redistribution, re-evaluate even when the artifact digest is unchanged.

9. Separate the policy oracle from license metadata

The Lab uses an explicit synthetic policy oracle. That oracle states which automation outcome is permitted for the supplied evidence and declared use. The evaluator must not infer legal permission from the text Apache-2.0 or any other identifier. If the oracle does not cover a use, the result is REVIEW_REQUIRED; if it explicitly denies a use, the automated path is BLOCK.

10. Define the three decision states precisely

ALLOW means sufficient evidence exists for the exact digest/revision/use-case/policy-version and the approved synthetic policy oracle permits automated continuation. BLOCK means an explicit policy rule or a decisive evidence failure prevents the automated path. REVIEW_REQUIRED means evidence is custom, unknown, stale, conflicting, or outside the oracle scope and a human authority must decide. None is a universal legal conclusion.

11. Never resolve conflict by selecting the convenient record

If a model card reports one license while preserved mirror provenance or license text reports another, do not silently choose one. Preserve CONFLICT, stop automated continuation, and expose the exact evidence for review. The same applies to an unknown source revision or inconsistent license links.

12. Freshness and recheck triggers belong in the contract

License metadata, source revisions, and internal policy can change. Record policy_version, evidence capture references, and a recheck trigger. Typical triggers include a new digest or source revision, changed metadata/license link, a new policy version, a new use case, newly observed conflict, or review expiry. Do not overwrite historical decisions; append a new decision for the changed evidence.

13. Provenance makes the decision auditable

A strong record shows what artifact was evaluated, where metadata came from, whether an identifier was normalized, which text/reference was captured, which use case was declared, which policy version ran, which rule produced the outcome, and whether human review is required. Downstream systems may rely only on that bounded decision and must not widen ALLOW into “all uses are permitted.”

14. Lab: eight fixtures designed to break common shortcuts

Case 1 is the baseline: a standard identifier reaches ALLOW only because the synthetic oracle explicitly allows that exact use. Case 2 preserves a custom license as REVIEW_REQUIRED. Case 3 blocks the automated path for a mirror that lost license provenance. Case 4 proves that a new revision/digest with the same friendly name cannot inherit the old decision. Case 5 escalates conflicting evidence; Case 6 applies an explicit policy denial; Case 7 sends stale policy/evidence to review; Case 8 prevents reuse of an old decision bound to another digest.

15. Transfer and final checklist

In the transfer task, Artifact A is replaced by a new upstream revision whose license metadata changes from a standard identifier to other. Preserve the historical decision for the old digest, but require a fresh evaluation for the new digest and route the new artifact to REVIEW_REQUIRED. Checklist: exact digest and revision; captured metadata; SPDX normalization only when valid; custom name/link/text provenance; explicit use case; policy version; evidence state; bounded ALLOW/BLOCK/REVIEW_REQUIRED; human-review flag; decision scope; non-claims; and a recheck trigger. This lesson invents no legal permission.