Where gates are enforced today

The enforced gate is the scan-result gate: findings that break policy stop the build before it reaches deploy, and promotion forward is gated on signed, scanned builds. Key points:

• Frame enforcement around the scan-result gate and gated promotion, which hold the line on every run.
• Describe what the platform actually enforces. Do not claim a separate deploy-time policy gate blocks deploys; the enforced path is the scan-result gate and signed, scanned promotion.