---
updatedAt: 2026-08-23T06:07:37.000Z
agentTools:
  siteIndex: https://docs.jfrog.com/llms.txt
  projectIndex: https://docs.jfrog.com/security/llms.txt
---

# How to Enforce Compliance Policies Using Catalog Labels

 **Use Case:** A compliance team wants to ensure that only **approved OSS packages** are used in development and that high-risk packages are blocked.

**Steps:**

1. **Create Labels for Package Management**
   * Go to **Package/Version > Labels** in JFrog Catalog.
   * Click **Add a Label**, name it `"Approved"` for safe packages.
   * Create another label called `"Restricted"` for high-risk packages.
2. **Apply Labels to Packages**
   * Search for specific OSS packages used in your repositories.
   * Assign `"Approved"` to secure packages.
   * Assign `"Restricted"` to packages with **compliance risks** (e.g., GPL-licensed software if your organization restricts GPL usage).
3. **Define Curation Policies**
   * Navigate to **JFrog Curation** in the JFrog Platform.
   * Create a policy that **blocks packages labeled `"Restricted"`** from being downloaded.
   * Create a policy that **allows only `"Approved"` packages** for internal use.
4. **Automate Compliance Enforcement**
   * Use [Catalog GraphQL](https://docs.jfrog.com/integrations/docs/catalog-onemodel-graphql) to programmatically assign labels to new OSS packages.
   * Set up notifications to alert teams when a **new package violates the compliance policy**.