License obligation workpaper

What does the license obligation workpaper produce?

Organize declared component license obligations for specialist approval.

Use the exact local files and task-specific inputs listed below. Preparation and review stay in this browser. Inspect all findings before preparing the finalized pack.

What do you need before you start?

• Define the authorized source population and your review rules.
• Keep the unchanged original files and record the snapshot and exclusions.
• Review missing and invalid inputs before preparing the finalized pack.

What information do you enter?

Select the actual local sources and freeze the task-specific inputs below. Keep source files and complete findings private.

• Exact source records. Exact headings component_id, component_version, license_expression, distribution_scope, source_ref
• Approved field or relationship rules. Exact headings license_term, obligation_id, obligation_text, distribution_scope, approved_by, approval_ref
• Review reference. Customer-controlled review identifier.
• Responsible reviewer. Owner of the supplied facts and selected method.
• Observation date. Real YYYY-MM-DD date.
• Source and version scope. Name actual population, selected source versions and known omissions.

What you can download

Every result must identify its supplied facts, assumptions and unresolved items.

Fictional review report (PDF). Editable review (DOCX). Complete fictional pack (ZIP). Requires tailoring and responsible review. Samples use the finalized renderer.

How does the license obligation workpaper work?

1. 1
   Select the actual sources

   Exact source records. Exact headings component_id, component_version, license_expression, distribution_scope, source_ref

2. 2
   Freeze the review rules

   Parse bounded SPDX-style AND, OR, WITH and parenthesized license expressions. Match each exact license term and distribution scope to approved obligation records. Preserve alternative OR branches rather than representing every alternative as mandatory. Missing approvals, unknown terms and conflicting obligation text remain unresolved. This workpaper supplies no license interpretation or compatibility decision.

3. 3
   Inspect complete findings

   Review all source-linked results and unresolved items. Free JSON and CSV preserve complete results.

4. 4
   Keep recoverable work

   Original files and exact input strings save in this browser. Restore validates identity, schema and actual file hashes before replacing current work. Earlier browser work and historical purchases remain separate.

5. 5
   Prepare the finalized pack

   Prepare seven core files and the exact selected attachments, then download them free. Review the fictional sample below.

Method and sources

Apply the steps above to the supported inputs. Use the listed source sections to review the rule basis, assumptions and limits.

• Common Format and MIME Type for CSV FilesSupports CSV interchange only. It specifies no approved domain population, legal criterion or task decision. Sections 2 and 3 describe comma-separated fields, escaping, headers and the text/csv media type.RFC Editor. Reviewed 2026-10-09.
• SPDX license expressionsSupports expression organization only. Obligation text, applicability, alternatives and compatibility require customer specialist approval. Annex D defines simple identifiers and the AND, OR and WITH operators used in bounded license expressions.SPDX. Reviewed 2026-10-09.

Common questions

What still needs review?

Working results use exact local sources and explicitly selected versions. Originals remain unchanged in this browser. No source authenticity, population completeness, vulnerability exploitability, legal applicability, license conclusion, consent validity, food safety or external submission is established.

Each source supports at most 10 MB. Table sources support 5000 rows, 50 fields, 100000 cells and 5000000 parsed characters. JSON documents support depth 40 and 100000 nodes.

Working artifacts are produced only when their required named checks pass. Complete findings remain available even when an artifact is withheld.

Related working records

The related workspace contains working administrative records. Open it for the related administrative task.

Related tools

Browse all cybersecurity tools.

• Vulnerability report normalizerCombine scanner exports into a consistent structure. Try a free example, then review your inputs and the result. No account or payment required.
• Vulnerability deduplicatorMerge repeated findings while preserving source evidence. Try a free example. Review your inputs and result. No account or payment required.
• Remediation SLA trackerCalculate remediation due dates, overdue intervals and completion outcomes under your approved severity and timing rules. Review the result.
• Vulnerability exception packAssemble compensating controls and approval evidence. Try a free example, then review your inputs and the result. No account or payment required.
• SBOM validatorCheck required fields, identifiers and structural consistency. Try a free example. Review your inputs and result. No account or payment required.