A security gate has at least seven outcomes: pass, warn, block, override, expired exception pass, skipped and error. Define each one in writing before you measure anything. If two people count "fail" differently, your gate dashboard is comparing apples with oranges.
Why define states
Gate metrics are only as clear as the vocabulary behind them. Teams often log just pass and fail, then argue about what a "pass with exception" or a "skipped on docs change" should count as. Agreeing on states first makes every later chart cheaper to build and easier to explain to an auditor.
The seven states
| State | Meaning | Counts toward |
|---|---|---|
| Pass | Check ran, nothing crossed the line | Healthy runs |
| Warn | Check ran, finding shown, build continued | Noise and debt |
| Block | Check ran, finding stopped the merge or deploy | Gate effectiveness |
| Override | A person with authority released a blocked change | Exception counts |
| Pass by exception | Passed because a valid, unexpired exception covers the finding | Exception counts |
| Skipped | Check did not run by design, such as a docs only change | Coverage |
| Error | Check could not complete | Reliability |
Notice that override and pass by exception are different. An override happens after a block, at a point in time, by a named person. A pass by exception relies on a standing record that should expire.
Rules for the states
- Every gate run ends in exactly one state.
- Skipped needs a stated rule, and the rule is reviewed. Quiet skips are how coverage leaks.
- Error is never counted as pass. Treat it as a separate state even if your policy lets the build continue.
- Every override and pass by exception stores who, why, which finding and an expiry date.
- The state is recorded where it can be queried, not just printed in a log.
What to chart
- Share of runs by state, per week, per repository group.
- Blocks as a share of runs with findings. If this is near zero, the gate may be set too loose.
- Overrides per hundred blocks. If this is high, the gate may be set too tight, or people are bypassing it.
- Skipped runs by reason.
Compare each against its own history, since the right level depends on your code and risk.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what the gate shows when it blocks, and think about which state each moment would record.
Quick check
Is warn a failure?
No, but it is not a pass either. Warn runs show findings that did not stop the build, so they measure how much debt is flowing past the gate.
Do I need all seven states on day one?
No. Start with pass, block, override and error, and add the rest as soon as you have skips or exceptions.
How Safeguard fits
Safeguard provides policies, gates and guardrails over dependency and SBOM scan results, so gate decisions are tied to named policies and findings. You can run a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
