A policy-as-code gate has run in warn mode for 18 months across 400 repositories. The dashboard shows 2,300 open violations. Leadership asks you to switch it to blocking next month. What happens if you do, and what is the sequence that actually works?

What happens if you flip it

Every pipeline with an existing violation fails on its next run, including the ones fixing something urgent. The violations were never triaged, so nobody knows how many are real. Within a day there is a queue at the exception process, and by the end of the week either the gate is reverted or a blanket waiver is issued, and a blanket waiver is worse than warn mode because it looks like compliance.

The second effect is subtler: policies that were never enforced have never been tested against reality, so a share of the 2,300 will turn out to be false positives from rules written against an idealised repository layout. Blocking on those destroys the policy engine's credibility in a way that takes a year to recover.

Why warn mode accumulated the debt

Warn mode has no forcing function. A warning that never stops anything is read once and filtered thereafter, so violations accrue at whatever rate the organisation creates them. The count is not a measure of risk, it is a measure of how long the gate has been advisory.

The sequence that works

1. Triage the rules, not the violations. For each policy: how many violations, how many are plausibly false positives, what is the actual harm. Expect a small number of rules to produce most of the count.
2. Delete or fix the rules that are wrong. A rule with 600 violations and no incident behind it is a bad rule, and removing it is a legitimate outcome.
3. Block on new violations only. Enforce for changed files or new resources, so the existing population is grandfathered and the number stops growing on day one. This is the single most effective step and it is usually available within a sprint.
4. Burn down the backlog with owners and dates, highest-harm rule first, tracked as work rather than as a dashboard.
5. Flip to blocking per rule as its backlog clears, not all at once.
6. Keep a time-boxed waiver path with an owner and an expiry, because there will be legitimate exceptions and an unavailable exception path produces a disabled gate.

When flipping straight to blocking is right

A brand-new rule with zero existing violations should be blocking from day one. That is the whole argument for enforcing at introduction: there is no backlog, no negotiation and no grandfathering. The cost of the approach above is paid entirely because the rule was advisory for 18 months.

Common weak answers

• "Announce a deadline and enforce it." Deadlines do not triage false positives, and the first false positive at the deadline costs the policy its authority.
• "Auto-fix everything." Fine for formatting; dangerous where the violation reflects a real design decision nobody has reviewed.