Worst case — the least favourable assumption
This is not a product, it is a default posture. It applies in three situations:
- a team wants to adopt a component and does not yet know which products it will end up in;
- the component goes into a shared internal library reused by products in different scenarios;
- you are drafting a company licence policy, to apply before the use cases are known.
The assumption
Assume the worst, cumulatively:
| Question | Default assumption |
|---|---|
| Does a third party receive the software in executable form? | Yes |
| Does a third party interact with it over a network? | Yes |
| Is the product a locked-down consumer good? | Yes |
| Is the component linked to your code? | Yes, statically |
Under these assumptions every trigger is active at once.
The verdict per family
| Family | Verdict | Reason |
|---|---|---|
| Public domain | ● | No obligation, patents aside for CC0 |
| Permissive | ● | Attribution only, at no cost once automated |
| Weak copyleft, file (MPL, EPL) | ◐ | Acceptable if the file-separation discipline holds |
| Weak copyleft, library (LGPL) | ○ | Assumed static linking means supplying object files; v3 adds anti-lock-down |
| Strong copyleft (GPL) | ○ | Publishing the whole work’s source, plus anti-lock-down in v3 |
| Network copyleft (AGPL) | ✕ | Triggered by the network-exposure assumption |
| Source-available (BSL, SSPL, ELv2) | ✕ | Usage restrictions incompatible with a product you sell |
| Non-commercial content (CC-BY-NC, CC-BY-ND) | ✕ | Prohibited in a commercial product |
How to use it
This grid is what should feed the default allow list in the licence policy: a component on the allow list here is usable anywhere, with no further review. That is what lets teams move without calling Legal for every dependency.
Components marked ◐ and ○ are not banned: they go through the exception process, which requires naming the actual scenario and checking that the constraint is bearable there.
The reasoning to avoid. “This component is GPL but your product is SaaS, so you are fine.” True today, and false the day you ship an agent, a connector, an on-premises edition or an image published to a public registry. If the component enters a shared repository, the least favourable assumption among the derived products must apply.
The question that decides a case
Does this repository build one artefact, or several?
A repository producing both the backend and the client agent inherits the agent’s regime — the most constrained. Splitting repositories is not an organisational nicety: it is often the only way to keep freedom of choice over backend components.
What the CRA adds
Nothing directly — the Regulation does not address licences. But the due diligence on third-party components it requires includes examining the licence, and that examination is meaningless unless tied to a scenario. A diligence grid that records a licence without saying which product the component will enter demonstrates nothing.