diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index c3a6b2d3..1bf1839b 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -32,6 +32,11 @@ Optional profiles tested:
 - [ ] ocr
 - [ ] distributed
 
+## Contributor License
+
+- [ ] The `license/cla` check passes, or DataFog has documented an exemption for
+      every contributor to this pull request.
+
 ## Notes For Reviewers
 
 Mention API changes, migrations, warnings, or release-note needs.
diff --git a/.gitignore b/.gitignore
index cf11a42c..d09383be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -60,6 +60,8 @@ docs/*
 !docs/Makefile
 !docs/make.bat
 !docs/optional-surfaces.rst
+!docs/cla-policy.md
+!docs/cla-administration.md
 !docs/agents/
 !docs/agents/**
 !docs/audit/
diff --git a/CLA.md b/CLA.md
new file mode 100644
index 00000000..f87687aa
--- /dev/null
+++ b/CLA.md
@@ -0,0 +1,181 @@
+# DataFog Individual Contributor License Agreement
+
+Version 1.0
+
+Thank you for your interest in contributing to open-source projects managed by
+DataFog, Inc. ("DataFog," "we," "us," or "our").
+
+This Individual Contributor License Agreement (the "Agreement") documents the
+rights granted by individual contributors to DataFog. It is a legally binding
+agreement, so please read it carefully before accepting it.
+
+This Agreement covers contributions to public software, documentation, and
+other open-source projects owned or managed by DataFog, including projects in
+the [`DataFog` GitHub organization](https://github.com/DataFog) that reference
+this Agreement (collectively, the "Projects"). You need to accept this Agreement
+only once unless DataFog publishes a new version and asks you to accept it.
+
+To accept this Agreement, follow the electronic signing instructions presented
+by DataFog's CLA service. The signing record will be associated with your
+authenticated GitHub account.
+
+If an employer or another entity owns or controls the rights in your
+Contribution, do not accept this individual Agreement on that entity's behalf
+unless you have authority to do so. Contact
+[`legal@datafog.ai`](mailto:legal@datafog.ai) for the entity contribution
+process.
+
+## 1. Definitions
+
+"You" means the individual who Submits a Contribution to us.
+
+"Contribution" means any work of authorship that is Submitted by You to us in
+which You own or assert ownership of the Copyright.
+
+"Copyright" means all rights protecting works of authorship owned or controlled
+by You, including copyright, moral, and neighboring rights, as appropriate, for
+the full term of their existence, including any extensions controlled by You.
+
+"Material" means the software, documentation, or other work that we make
+available to third parties as part of a Project. After You Submit a
+Contribution, it may be included in the Material.
+
+"Submit" means any form of electronic, verbal, or written communication sent to
+us or our representatives for the purpose of discussing or improving a Project,
+including communications through source-code control systems and issue trackers
+managed by or on behalf of us. Communications conspicuously marked or otherwise
+designated in writing as "Not a Contribution" are excluded.
+
+"Submission Date" means the date on which You Submit a Contribution to us.
+
+"Effective Date" means the date You electronically accept this Agreement or the
+date You first Submit a Contribution to us, whichever is earlier.
+
+"Media" means any portion of a Contribution that is not software.
+
+## 2. Grant of Rights
+
+### 2.1 Copyright License
+
+You retain ownership of the Copyright in Your Contribution and have the same
+rights to use or license the Contribution that You would have had without
+entering into this Agreement.
+
+To the maximum extent permitted by applicable law, You grant to us a perpetual,
+worldwide, non-exclusive, transferable, royalty-free, irrevocable license under
+the Copyright covering the Contribution, with the right to sublicense those
+rights through multiple tiers of sublicensees, to reproduce, prepare derivative
+works of, modify, display, perform, and distribute the Contribution as part of
+the Material, subject to Section 2.3.
+
+### 2.2 Patent License
+
+For patent claims, including method, process, and apparatus claims, that You
+own, control, or have the right to grant now or in the future, You grant to us a
+perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable
+patent license, with the right to sublicense through multiple tiers of
+sublicensees, to make, have made, use, sell, offer for sale, import, and
+otherwise transfer the Contribution and the Contribution in combination with
+the Material or portions of that combination. This license applies only to the
+extent that exercising the licensed rights infringes those patent claims and is
+subject to Section 2.3.
+
+### 2.3 Outbound Licensing
+
+If we include Your Contribution in Material, we may license the Contribution
+under any license, including copyleft, permissive, commercial, or proprietary
+licenses. As a condition of exercising this right, we also agree to license the
+Contribution under the license or licenses that we were using for the Material
+on the Submission Date.
+
+We may license Media in a Contribution under the license used for the relevant
+Project, a Creative Commons license, or another license that permits use of the
+Media with the Project.
+
+### 2.4 Moral Rights
+
+If moral rights apply to the Contribution, to the maximum extent permitted by
+law, You waive and agree not to assert those rights against us, our successors
+in interest, or our direct or indirect licensees.
+
+### 2.5 Our Rights
+
+You acknowledge that we are not obligated to use Your Contribution and may
+decide whether to include it in a Project.
+
+### 2.6 Reservation of Rights
+
+You reserve all rights not expressly licensed under this Section 2.
+
+## 3. Your Representations
+
+You confirm that:
+
+1. You have the legal authority to enter into this Agreement.
+2. You own, or have sufficient authority to license, the Copyright and patent
+   claims covering the Contribution as required to grant the rights in Section 2.
+3. The grant of rights in Section 2 does not violate rights You have granted to
+   third parties, including Your employer. If Your employer or another entity
+   may own rights in Your Contribution, You have obtained permission to make the
+   Contribution or that entity has completed DataFog's entity contribution
+   process.
+4. Each Contribution is Your original creation, except for third-party material
+   that You clearly identify along with its source and applicable license or
+   other restrictions.
+5. You will notify us of any facts or circumstances You become aware of that
+   would make these representations inaccurate.
+6. If You are under eighteen years old, You will contact DataFog before
+   accepting this Agreement and will follow any guardian-approval process
+   required by DataFog.
+
+## 4. Disclaimer
+
+EXCEPT FOR THE EXPRESS REPRESENTATIONS IN SECTION 3, THE CONTRIBUTION IS
+PROVIDED "AS IS." TO THE MAXIMUM EXTENT PERMITTED BY LAW, YOU DISCLAIM ALL
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. TO THE EXTENT A WARRANTY
+CANNOT BE DISCLAIMED, IT IS LIMITED TO THE MINIMUM DURATION PERMITTED BY LAW.
+
+## 5. Consequential Damage Waiver
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, YOU WILL NOT BE LIABLE FOR
+LOST PROFITS, LOST ANTICIPATED SAVINGS, LOST DATA, OR INDIRECT, SPECIAL,
+INCIDENTAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES ARISING OUT OF THIS AGREEMENT,
+REGARDLESS OF THE LEGAL OR EQUITABLE THEORY ON WHICH THE CLAIM IS BASED.
+
+## 6. Miscellaneous
+
+1. This Agreement is governed by the laws of the State of Delaware, excluding
+   its conflict-of-law provisions. The United Nations Convention on Contracts
+   for the International Sale of Goods does not apply.
+2. This Agreement is the entire agreement between You and us concerning Your
+   Contributions and supersedes prior agreements or understandings concerning
+   those Contributions.
+3. If You or we assign rights or obligations under this Agreement to a third
+   party, that third party must agree in writing to abide by this Agreement.
+4. A failure by either party to require performance of a provision in one
+   situation does not waive the right to require performance later.
+5. If a provision is found void or unenforceable, it will be replaced to the
+   extent possible by an enforceable provision closest to its original meaning,
+   and the remaining provisions will continue in effect.
+6. Electronic acceptance through DataFog's designated CLA service constitutes
+   Your signature. The electronic record identifies the Agreement version, Your
+   authenticated GitHub identity, and the time of acceptance.
+
+## Contact
+
+DataFog, Inc.<br>
+1209 Orange St.<br>
+Wilmington, DE 19801, USA<br>
+[`legal@datafog.ai`](mailto:legal@datafog.ai)
+
+## Template attribution
+
+This Agreement is adapted from the Harmony Individual Contributor License
+Agreement (HA-CLA-I), Version 1.0, with Outbound License Option Five selected.
+The Harmony template is licensed under the
+[Creative Commons Attribution 3.0 Unported License](https://creativecommons.org/licenses/by/3.0/).
+DataFog modified the template to identify the parties and Projects, support
+electronic acceptance, clarify third-party submissions and entity-owned work,
+and align the governing law and contact information with DataFog's published
+terms.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6e7e416e..fa0a9ad0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -121,6 +121,19 @@ By submitting a pull request, you license your contribution under the project
 [license](LICENSE). You also affirm that you authored the contribution or have
 the right to submit it under the project license.
 
+Before an external contribution can be merged, every contributor must sign the
+[DataFog Individual Contributor License Agreement](CLA.md) unless DataFog has
+documented another agreement covering the contributor and contribution. You
+retain copyright ownership; the CLA grants DataFog, Inc. broad, non-exclusive
+copyright and patent rights, including the ability to use the contribution in
+open-source, commercial, and proprietary distributions while continuing to
+offer it under the project's license in effect when it was submitted.
+
+If an employer or another entity owns or may own your contribution, contact
+[`legal@datafog.ai`](mailto:legal@datafog.ai) before signing or submitting it.
+See the [CLA policy](docs/cla-policy.md) for signing, exemptions, and entity-owned
+contributions.
+
 ## Contributors
 
 Thanks to early contributors including:
diff --git a/docs/cla-administration.md b/docs/cla-administration.md
new file mode 100644
index 00000000..301e707a
--- /dev/null
+++ b/docs/cla-administration.md
@@ -0,0 +1,84 @@
+# CLA Administration Runbook
+
+This runbook describes the rollout and ongoing administration of DataFog's
+Contributor License Agreement (CLA). The legal text should be approved by
+DataFog's counsel before the hosted integration is activated.
+
+## Service
+
+Use the SAP-hosted [CLA Assistant](https://cla-assistant.io/) integration. Do
+not use the archived `contributor-assistant/github-action` workflow.
+
+CLA Assistant uses a GitHub Gist as its agreement source. The reviewed
+[`CLA.md`](../CLA.md) in this repository is the source text for the initial
+Gist. Treat the Gist revision and repository version as one release: any
+substantive change creates a new agreement version and may require contributors
+to sign again.
+
+## Pilot rollout
+
+1. Obtain legal approval for `CLA.md`, including the entity name, Delaware law,
+   patent grant, and Outbound License Option Five.
+2. Create a public Gist owned by a durable DataFog administrative account using
+   the approved `CLA.md` contents.
+3. Sign in to CLA Assistant with that account and link the Gist to
+   `DataFog/datafog-python`.
+4. Configure exemptions only for verified DataFog personnel and trusted bot
+   accounts. At minimum, review Dependabot, Renovate, release automation, and
+   any account that commits generated changes.
+5. Open a pull request from a non-member test account and verify that:
+   - CLA Assistant requests a signature;
+   - signing is tied to the authenticated GitHub account;
+   - the `license/cla` status changes from failing to passing; and
+   - a new commit by another author causes the pull request to be rechecked.
+6. In the branch protection rule for `dev`, require the `license/cla` status
+   check. Apply the rule to administrators if the policy is intended to be
+   non-bypassable.
+7. Verify bot and internal-member pull requests pass using documented
+   exemptions.
+8. Merge the policy change only when the signing flow and required check have
+   both been tested.
+
+## Organization rollout
+
+DataFog currently uses GitHub Free, so organization-wide rulesets are not
+available. Repeat the following for every active public repository:
+
+1. Confirm its license, default branch, and contribution guide.
+2. Add links to the organization CLA and CLA policy.
+3. Enable CLA Assistant using the same agreement version.
+4. Protect the default branch and require `license/cla` before merge.
+5. Test an external pull request and an exempt bot pull request.
+6. Record the repository, protected branch, activation date, agreement version,
+   exemptions, and test pull request in the rollout inventory.
+
+If DataFog upgrades to GitHub Team or Enterprise, replace per-repository status
+configuration with an organization ruleset targeting the default branches of
+the covered public repositories.
+
+## Historical contributions
+
+Before relying on the CLA for commercial or proprietary relicensing of existing
+code:
+
+1. inventory historical commits and pull requests by non-DataFog contributors;
+2. distinguish original contributions from mechanical or third-party changes;
+3. obtain the current CLA from the relevant rights holder; and
+4. replace or isolate code where broader rights cannot be obtained.
+
+Do not assume that a newly signed workflow retroactively covers a contributor
+who has not accepted the agreement.
+
+## Records and continuity
+
+- Export the signer list and agreement-version records at least quarterly and
+  after every agreement update.
+- Store exports in access-controlled company storage, not in a public
+  repository.
+- Keep at least two DataFog administrators able to manage the integration and
+  its Gist.
+- Review exemptions quarterly and remove stale accounts.
+- Re-run the external-contributor test after changes to the CLA integration,
+  branch protection, repository ownership, or default branch.
+- Document any manual entity CLA or special authorization in the same
+  access-controlled legal record system.
diff --git a/docs/cla-policy.md b/docs/cla-policy.md
new file mode 100644
index 00000000..65abcf50
--- /dev/null
+++ b/docs/cla-policy.md
@@ -0,0 +1,74 @@
+# Contributor License Agreement Policy
+
+DataFog uses a Contributor License Agreement (CLA) to keep the origin and
+licensing of external contributions clear across its open-source projects.
+
+## What contributors grant
+
+Contributors keep ownership of their work. By signing the
+[DataFog Individual Contributor License Agreement](../CLA.md), an individual
+grants DataFog, Inc. a broad, non-exclusive copyright and patent license. The
+agreement allows DataFog to:
+
+- continue distributing the contribution under the open-source license in use
+  by the project when the contribution was submitted;
+- use and sublicense the contribution in other open-source, commercial, or
+  proprietary distributions; and
+- maintain, enforce, and evolve the project without seeking a new signature for
+  each contribution.
+
+The CLA does not transfer copyright ownership to DataFog.
+
+## Who must sign
+
+Every external contributor whose pull request will be merged must sign the
+current CLA unless DataFog has documented another agreement covering that
+contributor and the contribution.
+
+DataFog may exempt:
+
+- DataFog employees and contractors whose contributions are covered by a
+  written intellectual-property agreement;
+- organization members whose contributions are otherwise covered in writing;
+  and
+- trusted automation accounts that make mechanical changes and cannot sign.
+
+An allowlist is an administrative convenience, not a substitute for verifying
+that the contributor's work is covered by an appropriate agreement.
+
+## Employer- or entity-owned work
+
+An individual should sign only if they own the contribution or have authority
+to grant the rights in it. If an employer or another entity owns or may own the
+work, contact [`legal@datafog.ai`](mailto:legal@datafog.ai) before the pull
+request is merged. DataFog will use an entity CLA or written authorization when
+appropriate.
+
+## How signing works
+
+When an external contributor opens a pull request, DataFog's CLA service posts
+signing instructions and reports a `license/cla` status. The contributor signs
+once with an authenticated GitHub account. A new signature may be required if
+DataFog publishes a new agreement version.
+
+Maintainers must not merge an external pull request unless `license/cla` passes
+or the contributor has a documented exemption.
+
+## Agreement and signature records
+
+The agreement is versioned. DataFog retains or exports records sufficient to
+identify the signer, agreement version, signing time, and authenticated GitHub
+identity. The hosted CLA service may process the signer's GitHub identity and
+associated email under
+[SAP's CLA Assistant privacy notice](https://gist.github.com/CLAassistant/3a73e4cd729c9d0a6e30).
+
+Requests concerning a signature record or the CLA should be sent to
+[`legal@datafog.ai`](mailto:legal@datafog.ai).
+
+## Existing contributions
+
+The CLA workflow applies to new pull requests after activation. Existing
+contributions remain governed by the licenses and agreements in effect when
+they were submitted. If DataFog needs broader rights to an existing external
+contribution, it must obtain those rights from the contributor or replace the
+contribution.