Verified facts
- The feature covers Enterprise Cloud, including data residency, for repositories with GitHub Code Security.
- A ruleset can require license compliance results before merging; noncompliant dependencies require replacement, policy changes or exceptions.
- APIs manage the policy and check packages so agents can avoid proposing prohibited dependencies. Policy changes generate audit events.
What changes
Checks can happen before a package is proposed, not just at merge time.
Practical implication
Connect the compliance API to dependency selection and retain human review.
Availability
Belgium/EEA: the source specifies no explicit regional exclusion; availability depends on the account, plan and service region.
Limits and uncertainty
Automated policy does not replace legal interpretation of a license or understanding how the product is distributed.