Licenses and usage rights: what an agent may reuse

The component code of most public design systems is under a permissive license: IBM Carbon and Adobe Spectrum under Apache 2.0, Ant Design, shadcn/ui, Chakra UI and GitHub Primer under MIT, the GOV.UK Frontend code under MIT. Both licenses let you use, change and ship the code in a commercial product. Both ask that the license text travel with it: MIT asks for the notice in all copies or substantial portions, and Apache 2.0 for a copy of the license to go to anyone who receives the work.

An agent does not do this by itself. It copies the component and leaves the notice behind. The simplest fix is to install the package rather than paste its source, so the license stays in the package.

Watch for a license field that points somewhere you cannot see. Salesforce’s @salesforce-ux/design-tokens 4.1.0 names its license as “SEE LICENSE IN LICENSE.txt”, and on the day this was checked the published package held no such file. Ask the maker before you reuse a package like that.

Fonts are licensed one by one, and the design system’s code license does not cover them.

• The SIL Open Font License lets you bundle and embed a font, change it and pass it on, but not sell it by itself, and a changed version may not keep a Reserved Font Name. IBM Plex, the typeface of IBM Carbon, is under the OFL with “Plex” reserved.
• GOV.UK’s GDS Transport is for services on service.gov.uk. The GOV.UK Design System tells services publicly on any other domain to use another typeface. An agent that copies GOV.UK Frontend whole into a service elsewhere brings the wrong font with it.

An icon set can come with tighter terms than the components around it.

• Shopify’s Polaris icons come with a grant that starts like MIT and then narrows. Its rights may only be used for apps that integrate or work with Shopify, and a stand-alone app has to look distinct from Shopify’s own products.
• Google’s Material icons are under Apache 2.0.

An agent reaching for “the icon the docs used” may be reaching for a set your product is not allowed to use.

A server an agent calls is governed by its provider’s terms, which can differ from the code’s license. IBM’s Carbon Builder skill is under Apache 2.0, while the hosted Carbon MCP service has Terms of Use of its own. Read them before a whole team connects.

List what an agent may use in your written guidance for agents: which packages, which icon set, which fonts, and that nothing is copied from anywhere else. A check can then fail any import outside the list.

A custom system avoids most of this because the rights are yours. When Simbolik builds one, the client gets the system, the reasoning behind it and a runbook, with owner access from day one, and can own it outright. The free Simbolik Design System’s llms.txt puts its code under MIT and its Figma file under CC BY 4.0. Work with Simbolik (opens in a new tab) for a system whose rights are yours from the start.