practice

Deployment Gate

also called Quality Gate, Approval Gate

A condition a change must satisfy before it advances, whether evaluated by a machine or signed by a person.

governancecdcontrols

Gates are where delivery speed and control meet, and most organisations get the mix wrong in a predictable direction: too many human gates, too few automated ones.

An automated gate is a condition — coverage threshold, no critical vulnerabilities, error budget not exhausted, performance within budget, policy checks passing. It is fast, consistent and auditable, and it scales to a thousand deployments a week.

A human gate is a judgement, and it is worth its latency only where judgement is genuinely required: a first-of-kind change, an irreversible migration, a regulated release requiring named accountability. Where a human gate exists because nobody has automated the check, it is performing security theatre at the cost of hours per change, and — the part the research is blunt about — approval by someone unfamiliar with the change correlates with worse outcomes, not better ones.

The useful reframing for a review board that will not let go: replace the gate with an equivalent automated control plus an exception path, and measure both. Most gates cannot survive being asked what they have caught in the last year.