Dependency Approval

Policy

Obtain explicit user approval before adding a new dependency. This applies to packages, crates, libraries, vendored third-party code, and build/test tooling introduced as project dependencies. Changing the acquisition mechanism does not avoid the requirement.

A preferred-library catalog is a recommendation, not permission to install. Do not modify dependency declarations or implement code requiring the proposed dependency until the user approves it.

Procedure