# Building a License Compliance Matrix for Municipal Data

Building a license compliance matrix for municipal data requires mapping each dataset’s URI, spatial extent, update frequency, and explicit license terms into a structured, machine-readable registry. This registry must automatically flag attribution requirements, redistribution restrictions, and derivative work limitations. Municipal GIS teams routinely inherit mixed-licensing environments where parcel records, zoning overlays, and IoT sensor feeds carry conflicting or ambiguous terms. Manual tracking quickly becomes unsustainable. A programmatic approach solves this by converting unstructured legal text into queryable boolean flags and automated compliance alerts. For foundational context on how these constraints impact spatial data pipelines, review Geospatial Data Licensing & Compliance Fundamentals.

# Core Schema & Required Fields

A functional compliance matrix must bridge legal obligations and operational metadata. At minimum, your registry should enforce the following schema:

Municipal datasets rarely ship with clean SPDX identifiers. You will encounter variations like Creative Commons Attribution 4.0 International, CC BY-SA 4.0, Open Government Licence v3.0, or ambiguous phrases like free for public use. Normalizing these into a consistent taxonomy is the critical first step toward automation.

# License Normalization & Rule Engine

Raw license strings must be mapped to a standardized compliance tier: Open, Restricted, Proprietary, or Unknown. The most reliable method combines regex pattern matching with a fallback dictionary. When a pattern matches, the engine assigns the corresponding SPDX identifier and evaluates boolean compliance flags against a predefined rule set. This logic feeds directly into Automated Attribution Mapping Workflows that generate citation strings for web maps, APIs, and bulk exports.

# Python Implementation: Parser & Matrix Generator

The following production-ready script uses pandas and re to ingest a raw metadata export, classify licenses, apply compliance rules, and output a structured matrix. It includes confidence scoring, missing-value handling, and deterministic status assignment.

import pandas as pd
import re
from datetime import datetime, timedelta
from typing import Tuple, Dict

# SPDX-normalized license mapping with case-insensitive regex patterns
LICENSE_MAP: Dict[str, str] = {
    r'(?i)cc\s*by\s*4\.0': 'CC-BY-4.0',
    r'(?i)cc\s*by-sa\s*4\.0': 'CC-BY-SA-4.0',
    r'(?i)odbl\s*1\.0|open\s*database\s*license': 'ODbL-1.0',
    r'(?i)public\s*domain|cc0|unlicense': 'CC0-1.0',
    r'(?i)open\s*government\s*licence': 'OGL-3.0',
    r'(?i)proprietary|all\s*rights\s*reserved|commercial\s*license': 'Proprietary'
}

# Compliance rule engine: maps license type to boolean flags & status
COMPLIANCE_RULES: Dict[str, Dict] = {
    'CC-BY-4.0': {'attribution_required': True, 'commercial_use_allowed': True, 'share_alike_trigger': False, 'compliance_status': 'Compliant'},
    'CC-BY-SA-4.0': {'attribution_required': True, 'commercial_use_allowed': True, 'share_alike_trigger': True, 'compliance_status': 'Review_Required'},
    'ODbL-1.0': {'attribution_required': True, 'commercial_use_allowed': True, 'share_alike_trigger': True, 'compliance_status': 'Review_Required'},
    'CC0-1.0': {'attribution_required': False, 'commercial_use_allowed': True, 'share_alike_trigger': False, 'compliance_status': 'Compliant'},
    'OGL-3.0': {'attribution_required': True, 'commercial_use_allowed': True, 'share_alike_trigger': False, 'compliance_status': 'Compliant'},
    'Proprietary': {'attribution_required': False, 'commercial_use_allowed': False, 'share_alike_trigger': False, 'compliance_status': 'Blocked'},
    'Unknown': {'attribution_required': False, 'commercial_use_allowed': False, 'share_alike_trigger': False, 'compliance_status': 'Unknown'}
}

def classify_license(license_str: str) -> Tuple[str, float]:
    """Normalize raw license string to SPDX ID and return confidence score."""
    if pd.isna(license_str) or str(license_str).strip() == '':
        return 'Unknown', 0.0

    clean_text = str(license_str).strip()
    for pattern, spdx_id in LICENSE_MAP.items():
        if re.search(pattern, clean_text):
            # Full match = high confidence; partial match = moderate
            confidence = 0.95 if re.fullmatch(pattern, clean_text) else 0.80
            return spdx_id, confidence

    return 'Unknown', 0.0

def build_compliance_matrix(df: pd.DataFrame) -> pd.DataFrame:
    """Apply normalization and compliance rules to a metadata DataFrame."""
    df['license_type'], df['metadata_confidence'] = zip(*df['raw_license'].apply(classify_license))

    # Map compliance flags using the rule engine
    rules_df = pd.DataFrame.from_dict(COMPLIANCE_RULES, orient='index')
    df = df.merge(rules_df, left_on='license_type', right_index=True, how='left')

    # Set audit date (12 months for compliant, 3 months for review/blocked)
    df['review_date'] = df['compliance_status'].apply(
        lambda s: (datetime.now() + timedelta(days=365)).strftime('%Y-%m-%d')
        if s == 'Compliant' else (datetime.now() + timedelta(days=90)).strftime('%Y-%m-%d')
    )

    # Clean up output columns
    output_cols = [
        'dataset_id', 'source_agency', 'license_type', 'license_url',
        'attribution_required', 'commercial_use_allowed', 'share_alike_trigger',
        'review_date', 'compliance_status', 'metadata_confidence'
    ]
    return df[[c for c in output_cols if c in df.columns]]

# Example usage:
# raw_data = pd.read_csv('municipal_metadata_export.csv')
# matrix = build_compliance_matrix(raw_data)
# matrix.to_csv('license_compliance_matrix.csv', index=False)

# Spatial Constraints & Pipeline Integration

Geospatial licensing rarely behaves like standard software licensing. Municipal datasets often tie usage rights to spatial boundaries or temporal validity. A zoning overlay licensed for internal planning may explicitly prohibit redistribution outside city limits, while real-time traffic sensor feeds may carry time-bound commercial restrictions. Your matrix should extend beyond boolean flags to capture:

• Spatial bounding boxes where license terms change across jurisdictions
• Temporal validity windows for datasets with sunset clauses
• Derivative work thresholds (e.g., aggregation limits for parcel data)

Align your metadata parsing with the ISO 19115 geographic information metadata standard to ensure spatial lineage and distribution constraints map correctly to license rules. Cross-reference ambiguous strings against the official SPDX License List to maintain legal accuracy.

Once generated, integrate the matrix into your data catalog’s CI/CD pipeline. Schedule automated validation runs against new dataset ingestions and flag any metadata_confidence scores below 0.75 for manual legal review. When license terms change mid-lifecycle, the review_date field triggers alerts to downstream pipeline owners, preventing accidental redistribution of newly restricted assets.

# Maintenance & Auditing

Store the matrix in a version-controlled repository alongside your attribution templates. Maintain a quarterly audit cycle where GIS data managers verify Proprietary and Unknown classifications against vendor contracts. This approach transforms legal ambiguity into deterministic, queryable infrastructure, ensuring municipal data products remain compliant without manual intervention.