An organisation's quality gates have accumulated and now block releases without reducing defects. How should the gate set be rationalised?
Show the full answer Hide the answer
The rationalisation
Evaluate each gate on two questions: what defect class does it catch, and has it caught one recently?
A gate that has not blocked a genuine defect in a year is costing lead time and providing confidence rather than assurance. Removing it is a quality improvement, because the attention it consumes moves to gates that work.
The categories
Keep and automate: - Tests, contract verification, static analysis for high-confidence categories. - Policy checks that are deterministic — encryption, exposure, region, destructive migrations. - Provenance verification. - Progressive-delivery health gates comparing canary against control.
Keep as human, with a named decider and bounded response time: - A business decision about timing. - A risk acceptance for something the automation flagged. - A go/no-go for a high-blast-radius or irreversible change.
Remove: - Approvals by people with no basis for judgement, which add delay and no risk reduction while creating an appearance of control that is worse than none because it is trusted. - Duplicate checks already performed earlier. - Gates added after an incident that a targeted automated check now covers. - Coverage thresholds, which drive tests that assert nothing where coverage is cheap and do not measure whether anything is verified.
The measurement that drives the decision
Lead time from merge to production, decomposed by gate, and escaped defect rate by class. Together they show which gates cost the most and which catch anything.
Most organisations have never measured either, which is why gates accumulate — each is added after an incident and none is ever removed.
The compliance reframing
The requirement is usually evidence of control, not a human approval. A pipeline enforcing separation of duties, recording who changed what, and blocking non-compliant changes produces continuous, complete, tamper-evident evidence, whereas an approval demonstrates that someone clicked.
Making that argument with the artefacts in hand is frequently what allows manual gates to be removed without weakening the control.