Please define "INBOUND" and "OUTBOUND" licenses. None of the open source licenses indexed by SPDX grant permission to relicense the derived work, so any work including them either is solely the original license, or an AND of the project's license and the original license (to the extent the project creates a derived work). This is a clear case for "AND" where both licenses must be complied with. SPDX expressions do not have additional , secondary meanings, like what is the preferred license, what license do we accept changes for this derived work under, etc. All those secondary meanings would, if any, would need to be spelled out explicitly by the project wishing for them to apply for that project. For example, if a project takes MIT licensed code and creates a derived work they wish to license as GPL, they must list the license as GPL AND MIT because their desire to license under the GPL does not override the MIT license nor the IP of the original author. To say that the GPL is a proper-superset of the MIT license would be taking a legal position that's more aggressive than has been taken in the past, and I don't think that the SPDX project wants to be in the position of creating a matrix that says what is a superset of what so you can 'reduce' the complexity of the SPDX-License-Expression using some set of rules.

As for "AND": IThe standard says the following:

'If required to simultaneously comply with two or more licenses, use the conjunctive binary "AND"..."

Since each license is given equal weight in this construct, I'd say that AND is commutative where A AND B == B AND A. The standard has no verbage to the contrary to suggest one is controlling when there's a conflict, for example. Nor any of the other problems that might result from them being non-commutative. The standard is not explicit that it is commutative, but common usage for AND is. In the absence of a more specific definition, common usage would dictate interpretation should this be litigated. I'll let the better legal minds here, though, chime in as to whether or not the SPDX standard, as written, would need any correction to its language to address this potential ambiguity.

Warner