A promotion gate is an automated check that runs between staging and production. It verifies that the artifact about to ship is the one that was tested, that its dependency list matches the staging record, and that no new blocking vulnerability has appeared since the scan. If any check fails, promotion stops.
Why a gate beats a convention
Teams often agree that production gets exactly what staging tested. Agreements erode under deadline pressure. A gate turns the agreement into a rule that runs every time and leaves a record.
Five checks worth automating
- Identity match. The artifact identifier, such as an image digest, in the production deploy request equals the one that passed staging. A different identifier means a rebuild.
- Scan record exists. The artifact has a dependency scan and an SBOM attached, produced after it was built.
- Composition match. The SBOM of the artifact equals the SBOM stored at staging sign off. Any difference is a stop.
- Fresh vulnerability check. Re-check the SBOM against current advisories, because new ones are published daily. A scan from last week is a snapshot.
- Policy check. Blocking rules, such as no critical findings that are reachable, or no unapproved licenses, pass for this artifact.
| Check | Catches |
|---|---|
| Identity match | Silent rebuilds |
| Scan record | Skipped scans |
| Composition match | Late dependency changes |
| Fresh vulnerability check | Advisories published after staging |
| Policy check | Rule violations |
What to do on failure
Give the gate three outcomes: pass, block, and override with a reason. Overrides need an approver who is not the author, and an expiry. Record each override with the finding it covers. Our post on human approval before automated remediation shows one way to wire approvals.
Avoid these mistakes
- Gating only on severity count. A single reachable critical issue matters more than ten unreachable low ones.
- Letting the gate pass when the scan service is down. Decide in advance whether you fail closed or fail open, and write it down.
- Running the gate on a different build than the one being deployed.
- Making the gate so slow that people route around it.
Roll out in stages
Start in audit mode: the gate runs and reports but does not block. Review results for two weeks, tune the policy, then switch blocking on for the highest severity rule first.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a gate can block a change and explain why. A promotion gate works the same way at a later stage.
What Safeguard does here
Safeguard supports policies, gates, and guardrails on dependency and vulnerability findings, with reachability analysis to keep blocks meaningful. Try the free scan at gold.safeguard.sh/scan.
Quick check
Should a gate fail closed or open?
For production promotion, most teams fail closed with a fast, documented override path. Decide it ahead of time.
Can a gate replace code review?
No. It checks dependency and policy facts. Review still covers logic and design.
Last reviewed: 19 October 2026.
