A computer-implemented method, performed by a processor, of controlling a potentially unacceptable software component intended for a repository environment which includes a software repository , comprising: providing, in a policy storage, a pre-defined repository policy associated with a repository environment which defines risks deemed unacceptable, and the pre-defined repository policy defines, for each of the risks, an action to take for the risk, wherein the actions to take for the risks are selected from at least a pass action and different does-not-pass actions, wherein the actions are pre-defined programmatic steps; determining, by the processor, from a risk match unit, risks which match the software component ; evaluating, by the processor, the risks which were determined to match the software component , to determine the actions, as defined in the pre-defined repository policy , to take for the risks determined to match the software component ; characterized in that the repository policy is configured to specify the programmatic steps for each of the different does-not-pass actions, and a user can configure a combination of the different does-not-pass actions for the risk via interaction with displayed selectable programmatic steps, the selectable does-not-pass actions can be selected from block, quarantine, warn, and/or suggest alternative; the action to take is specific to a type of the risk and defines how to dispose of the software component ; following, by the processor, the pass action, defined in the pre-defined repository policy , wherein the pass action includes to serve the software component , when the risk of the software component is evaluated to pass the predefined repository policy; following, by the processor, the combination of the does-not-pass actions, which is a pre-determined set of the does-not-pass actions already configured, defined in the pre-defined repository policy , when the risk of the software component is evaluated to not pass the pre-defined repository policy. providing, in a policy storage, a pre-defined repository policy associated with a repository environment which defines risks deemed unacceptable, and the pre-defined repository policy defines, for each of the risks, an action to take for the risk, wherein the actions to take for the risks are selected from at least a pass action and different does-not-pass actions, wherein the actions are pre-defined programmatic steps; determining, by the processor, from a risk match unit, risks which match the software component ; evaluating, by the processor, the risks which were determined to match the software component , to determine the actions, as defined in the pre-defined repository policy , to take for the risks determined to match the software component ; characterized in that the repository policy is configured to specify the programmatic steps for each of the different does-not-pass actions, and a user can configure a combination of the different does-not-pass actions for the risk via interaction with displayed selectable programmatic steps, the selectable does-not-pass actions can be selected from block, quarantine, warn, and/or suggest alternative; the action to take is specific to a type of the risk and defines how to dispose of the software component ; following, by the processor, the pass action, defined in the pre-defined repository policy , wherein the pass action includes to serve the software component , when the risk of the software component is evaluated to pass the predefined repository policy; following, by the processor, the combination of the does-not-pass actions, which is a pre-determined set of the does-not-pass actions already configured, defined in the pre-defined repository policy , when the risk of the software component is evaluated to not pass the pre-defined repository policy. <EOS>