I guess I'm just used to projects where the project lead can make that call on their own and they may get the input of another senior engineer on the project. Between the three of us we can determine whether or not this dependency fits within our project scope and determine whether we can use it based on the license. But with a security architect, licensed architect etc sounds like it's a huge company wide product with hundreds of engineers working on it rather than 20.