Package governance is the set of policy controls that decide which software packages may be used, approved, or blocked in an organization. It sits on the trust boundary for dependency intake, before a package is added to a manifest, lockfile, or build system. Common controls include allowlists, approved registries, internal package catalogs, provenance checks, and required review workflows.
This matters because packages can enter a supply chain as quickly as a developer or AI assistant can suggest them. If a dependency is accepted without validation, it may be unknown, unreviewed, or even malicious, and then flow into CI/CD, caches, and downstream services. Strong package governance helps stop risky software before it becomes part of the build, supports software bill of materials accuracy, and gives defenders a way to enforce policy at selection time rather than after deployment.