A computer-implemented method, performed by a processor, of controlling a potentially unacceptable software component (215, 231) intended for a repository environment which includes a software repository, comprising: providing, in a policy storage, a pre-defined repository policy (223, 225A, 225B) associated with a repository environment which defines risks deemed unacceptable, and the pre-defined repository policy defines, for each of the risks, an action to take for the risk, wherein the actions to take for the risks are selected from at least a pass action and different does-not-pass actions, wherein the actions are pre-defined programmatic steps; determining, by the processor, from a risk match unit, risks which match the software component; evaluating, by the processor, the risks which were determined to match the software component, to determine the actions, as defined in the pre-defined repository policy (223, 225A, 225B), to take for the risks determined to match the software component; characterized in that the repository policy (223, 225A, 225B) is configured to specify the programmatic steps for each of the different does-not-pass actions, and a user can configure a combination of the different does-not-pass actions for the risk via interaction with displayed selectable programmatic steps, the selectable does-not-pass actions can be selected from block, quarantine, warn, and/or suggest alternative; the action to take is specific to a type of the risk and defines how to dispose of the software component; following, by the processor, the pass action, defined in the pre-defined repository policy (223, 225A, 225B), wherein the pass action includes to serve the software component, when the risk of the software component (215, 231) is evaluated to pass the predefined repository policy; following, by the processor, the combination of the does-not-pass actions, which is a pre-determined set of the does-not-pass actions already configured, defined in the pre-defined repository policy (223, 225A, 225B), when the risk of the software component (215, 231) is evaluated to not pass the pre-defined repository policy. providing, in a policy storage, a pre-defined repository policy (223, 225A, 225B) associated with a repository environment which defines risks deemed unacceptable, and the pre-defined repository policy defines, for each of the risks, an action to take for the risk, wherein the actions to take for the risks are selected from at least a pass action and different does-not-pass actions, wherein the actions are pre-defined programmatic steps; determining, by the processor, from a risk match unit, risks which match the software component; evaluating, by the processor, the risks which were determined to match the software component, to determine the actions, as defined in the pre-defined repository policy (223, 225A, 225B), to take for the risks determined to match the software component; characterized in that the repository policy (223, 225A, 225B) is configured to specify the programmatic steps for each of the different does-not-pass actions, and a user can configure a combination of the different does-not-pass actions for the risk via interaction with displayed selectable programmatic steps, the selectable does-not-pass actions can be selected from block, quarantine, warn, and/or suggest alternative; the action to take is specific to a type of the risk and defines how to dispose of the software component; following, by the processor, the pass action, defined in the pre-defined repository policy (223, 225A, 225B), wherein the pass action includes to serve the software component, when the risk of the software component (215, 231) is evaluated to pass the predefined repository policy; following, by the processor, the combination of the does-not-pass actions, which is a pre-determined set of the does-not-pass actions already configured, defined in the pre-defined repository policy (223, 225A, 225B), when the risk of the software component (215, 231) is evaluated to not pass the pre-defined repository policy.