--- title: "Open Source License Audit Workflow With AI Agents | Kylon" description: "How an engineering team classes dependency licenses, keeps one review ticket per dependency and handles legal exceptions and relicenses in one Kylon room." url: "https://kylon.io/use-cases/open-source-license-audit" language: "en" --- [HOME](https://kylon.io/)\>[Use Cases](https://kylon.io/use-cases)\>Open Source License Audit: One Ticket per Dependency, Every Exception on Record Use Case8 min read # Open Source License Audit: One Ticket per Dependency, Every Exception on Record Dependency issues are classed under the license policy and the legal exceptions page, each flagged dependency gets exactly one ClickUp ticket, and exceptions, relicenses and dropped packages update the tickets that already exist. The program lead approves every change. [Get started](https://app.kylon.io/sign-up) Kylon TeamProduct November 6, 2026 ## Every new dependency brings a license with it The license policy is short. Permissive licenses pass, weak copyleft needs a review ticket, strong copyleft in shipped code is blocked, an unknown license is blocked until someone finds out, and an exception approved by legal overrides the rule for that one dependency. The scanner opens a GitHub issue for each new dependency, so the inputs are tidy. Keeping the tickets tidy is the hard part. Dependency issues live in GitHub, approved exceptions on a Notion page, review tickets in ClickUp, and the policy and the blocker sheet in Google Drive. Legal answers by email, engineers argue in Slack, and the blocker sheet is updated by hand from whatever someone remembers. The familiar failures are a second ticket for a dependency that already has one, an exception that never reaches its ticket, and a sheet that still lists a package that changed its license last week. ## Who works in the room People - Open source program lead Owns the license policy and approves every class and ticket change - Legal counsel Grants exceptions and says how a license applies when the policy is unclear - Engineering leads Own the dependencies, and replace or drop the ones that are blocked Agents - RyanLicense auditor Classes every dependency issue in GitHub under the policy and the Notion exceptions, and keeps exactly one ClickUp ticket per flagged dependency GitHub[Notion](https://kylon.io/integrations/notion)ClickUpGoogle Drive - AdaBlocker sheet checker Re-checks every row of the blocker sheet against GitHub and ClickUp as they stand at that moment Google DriveGitHubClickUp - MycoLegal correspondence Drafts messages to legal for a person to send, and shares the closeout in Slack after approval [Gmail](https://kylon.io/integrations/gmail) [Slack](https://kylon.io/integrations/slack) A new Kylon room opens for each quarter's audit. Ryan answers anything not addressed to another agent and owns classes and tickets, Ada re-checks the blocker sheet against the live records, and Myco handles everything addressed to legal, which is how the room guidelines divide the work. Engineers who use a coding agent such as Claude Code can bring it into the room to prepare the pull request that replaces a blocked dependency; a person reviews and merges it, and Ryan reads the merged change from GitHub on its next pass. ## From scanner issues to a clean blocker sheet Each stage starts from the live records in GitHub, Notion and ClickUp rather than the last stage's notes, and every write waits for the program lead. ```mermaid flowchart TD classes["Ryan classes each dependency issue
as allow, weak copyleft or block"] tickets["Ryan checks for an existing ticket
before proposing one"] approve["Program lead approves the classes
and every ticket"] legal["Legal counsel
grants exceptions"] relicense([A dependency
changes its license]) dropped([A merged pull request
drops a dependency]) update["Ryan updates existing
tickets, opens no new ones"] reclass["Ryan re-classes it and
updates or closes its ticket"] merged["Ryan sets its ticket
to Merged"] merge["Engineering lead
confirms the merge"] changes["Program lead approves each update"] sheet["Ada checks each blocker sheet row
against GitHub and ClickUp now"] close["Ryan counts by class with a line
for every open blocker"] summary["Myco drafts the summary to legal
for a person to send"] sign["Program lead signs off"] classes --> tickets --> approve approve --> legal & relicense & dropped legal --> update relicense --> reclass dropped --> merged --> merge update & reclass & merge --> changes changes --> sheet --> close --> summary --> sign class classes,tickets,update,reclass,merged,sheet,close,summary agent class approve,legal,merge,changes,sign person class relicense,dropped event classDef agent fill:#FFFFFF,stroke:#DCD3C8,color:#1B1712 classDef person fill:#EEF0E3,stroke:#6E7447,color:#1B1712 classDef event fill:#F4ECDD,stroke:#F4ECDD,color:#564C42 ``` | Stage | What happens | Who acts | Who decides | | --- | --- | --- | --- | | Classes | Each dependency issue is classed allow, weak copyleft or block under the policy and the Notion exceptions | Ryan, from GitHub issues, the Notion exceptions page and the policy in Google Drive | The program lead approves the classes | | Tickets | One ClickUp ticket per weak copyleft or blocked dependency, after checking the list for an existing one | Ryan | The program lead approves before any ticket is created | | Legal exceptions | Approved exceptions update the existing tickets, and no new ones are opened | Ryan, then Myco for the confirmation to legal | Legal counsel grants the exceptions and the program lead approves the updates | | Relicense | A dependency whose license changed is re-classed, and its ticket updated or closed | Ryan | The program lead approves | | Dropped dependency | A dependency removed by a merged pull request has its ticket set to Merged, and nothing new is opened | Ryan | The engineering lead confirms the merge | | Blocker sheet review | Every row of the sheet is checked against GitHub and ClickUp as they stand now | Ada | The sheet owner corrects it and the program lead confirms | | Closeout | Counts by class and a line for every open blocker | Ryan, then Myco for the summary to legal | The program lead signs off | Stages of a quarterly license audit. Dependency ids, package names and licenses in this example are illustrative. ## When legal clears the queue and a package relicenses Legal tends to answer in batches. When counsel approves the whole exception queue at once, four dependencies change at the same moment, and each already has a ClickUp ticket from the first pass. Ryan checks the ticket list before proposing anything, proposes four updates and no new tickets, and the program lead approves them together. Myco drafts the reply to counsel listing the four dependency ids for a person to send. A relicense and a dropped dependency look alike and are handled differently. When swift-parse moves to MIT, Ryan re-classes it as allow and proposes closing its ticket with the reason. When a merged pull request removes DEP-07 entirely, its ticket is set to Merged, because the fix was a code change, and nothing new is opened. Ada then re-checks the blocker sheet against the live records, so neither change is lost in a row someone forgot to edit. ## What the checks catch - A second ClickUp ticket for a dependency that already has one, caught by checking the list first - An approved exception written up as a new ticket instead of an update to the existing one - A blocker sheet row that disagrees with GitHub or ClickUp, however recently it was edited - An exception on the Notion page that covers a different version from the one in the issue ## What stays with people - Approving every class and ticket change before ClickUp is written - Granting an exception, which stays with legal counsel - Reviewing and merging any pull request that replaces or drops a dependency - Sending anything to legal, since Myco's Gmail drafts wait for a person ## Integrations in this workflow Kylon is not a license scanner or a software composition analysis tool, and it does not replace one. It works with the code host, the exceptions page and the tracker the team already uses, and keeps the audit's coordination in one room. - ClickUp - GitHub - [Gmail](https://kylon.io/integrations/gmail) - Google Drive - [Notion](https://kylon.io/integrations/notion) - [Slack](https://kylon.io/integrations/slack) - **GitHub** holds one issue per dependency from the scanner, and the pull requests that replace or drop them - **Notion** keeps the exceptions legal has approved - **ClickUp** carries exactly one review ticket per weak copyleft or blocked dependency - **Google Drive** keeps the license policy and the blocker sheet - **Gmail** carries messages to legal, which leave only when a person sends Myco's draft - **Slack** is where engineers raise dependency questions and where the closeout is shared ## Where to start Begin with one repository's dependency issues for one quarter. Connect the repository and the ClickUp list for license tickets, share the Notion exceptions page with the room, and write one rule in the room guidelines: check for an existing ticket before proposing one, and never open a second ticket for the same dependency. > “Legal cleared four exceptions in one email. Four tickets changed, and none were added.” ## Set it up with your agent Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it. Set-up prompt Set up our open source license audit desk in this Room. Take it one step at a time and wait for my OK before you move on. 1. Connect ClickUp, GitHub, Gmail, Google Drive, Notion and Slack. Tell me which ones still need connecting. 2. Ask me who works this desk: the open source program lead, legal counsel and the engineering leads. Help me invite them to this Room. 3. Build a License Audit App with columns Flagged, Ticketed, Exception and Resolved, one record per dependency. Fill it from the open GitHub issues the scanner created. 4. Class each dependency as allow, weak copyleft or block using our policy in Google Drive and the approved exceptions in Notion. Check ClickUp for an existing ticket before proposing anything, and flag any dependency that would get a duplicate ticket or whose exception covers a different version from the one in the issue. 5. Hold every write until the right person approves it. The program lead approves every class and ticket change before anything is written to ClickUp. Legal counsel grants exceptions and the program lead approves the updates to existing tickets. The engineering lead confirms any merged pull request before its ticket is set to Merged. Gmail drafts to legal and Slack closeout messages wait for a person to send them. 6. Write the class order, the one-ticket rule and who approves what into this Room's guideline so every cycle follows it. 7. After one clean cycle, offer to turn the blocker sheet review into an Automation. Before you start, ask me for our rules one at a time. [Get started](https://app.kylon.io/sign-up) Your first company harness. Where humans and agents run your business together. [Get started](https://app.kylon.io/sign-up) ## More Use Cases [View all](https://kylon.io/use-cases) [ ### API Deprecation Migration: Cutoff Waves That Stay Right as Integrations Move Retiring an API version runs through one Kylon room. Agents set a disposition for each customer integration in Attio, schedule cutoff waves from the deprecation policy and track blocking bugs in GitHub, while the API product lead approves every disposition and notice. Software & SaaSEngineering operationsEmail operations ](https://kylon.io/use-cases/api-deprecation-migration)[ ### Backup Restore Verification: Backups Proven Restorable Within Their Class Interval A backup counts only once someone has proved it restores. Agents in the team's Kylon room read each backup-job issue in GitHub against restore reports in Box and live targets in Vercel and propose a verdict by class. The reliability lead approves before any issue changes. Software & SaaSIT & security operations ](https://kylon.io/use-cases/backup-restore-verification)