SPDX normalization + policy-as-code + green/yellow/red decisions: automate 99% of open-source license verdicts so legal only handles the 1% that truly needs a human.