Watch five signals: block rate, override rate, scan duration, scan error rate, and time from block to fix. A gate that never blocks may be misconfigured, one that blocks constantly gets bypassed, and slow or flaky scans erode trust. Review them monthly.
The five signals
| Signal | Healthy looks like | Unhealthy looks like |
|---|---|---|
| Block rate | Some blocks, mostly on real new issues | Zero for months, or a majority of runs |
| Override rate | Rare, with reasons | Frequent, or spread across the same teams |
| Scan duration | Stable within budget | Creeping up with no change in scope |
| Scan error rate | Close to zero | Timeouts, auth errors, rate limits |
| Time from block to fix | Hours to days | Weeks, or fixes via exceptions |
Interpreting zero blocks
A gate that never blocks might mean a clean codebase, or it might mean an empty scope, a bad config or a check that always returns success. Prove the gate works by seeding a known test finding in a canary repo and confirming the gate catches it every day. This is a heartbeat for your control.
Interpreting many blocks
A high block rate right after launch is normal. If it persists, review the rules: are they firing on old debt, low risk issues or noisy rules? Consider gating on new findings only, and tune severity thresholds. Gating on new code only often calms a rollout.
Alerts worth setting
- Canary repo gate did not block the seeded finding.
- Scan error rate above a small threshold for an hour.
- Median scan duration above budget for three days.
- Override count above a team level baseline.
- Required check not reporting on a protected branch.
Decide the failure policy
When the scan errors, does the gate block, pass or retry? Decide per tier and document it. See block or pass when the scanner is down.
Share the view
Put these on a dashboard visible to developers and to the platform team. Gate health is a developer experience measure as much as a security one.
Try it yourself
Click through the pull request gate demo, then think about which of the five signals each screen would feed.
Click through it at your own pace, or open it full screen.
Quick check
What is a canary finding?
A deliberately planted, harmless issue in a test repo that the gate must catch. If it passes, the gate is broken.
How often should we review gate metrics?
Monthly for trends, with alerts for sudden changes.
Safeguard policies, gates and guardrails provide the enforcement point, and a free scan is available at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
