A build that breaks policy stops before deploy

Deploy gates are OPA policy you can read, version, and test. The rule that blocks a release lives in a file, with thresholds that can differ per environment. A build with no scan result does not coast through; missing evidence is a block, not a pass. Key points:

• The gate decision points at a policy and a finding, so it is something you can read rather than a judgment call someone has to defend.
• Thresholds are tier-aware: production can demand more than staging, and the gate enforces it on every run.