VocalHyre
Sign up

CI/CD · Ship safely, repeatedly

What are deployment gates and when should they block a release?

Harddeployment gatesslopolicyUpdated Oct 2026
Quiz this track

Short answer

Deployment gates are automated checks that must pass before or during promotion, such as tests, security policy, SLO health or required approval. They should block on measurable risk and fail closed rather than being advisory.

A gate encodes a release policy. Good gates are objective, fast enough not to destroy flow, and tied to a real failure mode. A gate that nobody understands or that can be bypassed without a record is security theatre.

  • Correctness gates: required tests, type checks and migration checks
  • Security gates: vulnerability thresholds, secret detection and signature verification
  • Reliability gates: error budget, SLO burn rate and canary analysis
  • Compliance gates: required reviewers, change tickets or separation of duties
  • Every gate needs an owner, a clear failure message and an audited bypass path
text
http_error_ratio = errors_5m / requests_5m
gate_passes = http_error_ratio <= 0.02
gate_action = gate_passes ? promote : halt
A gate can evaluate an error-ratio expression and halt promotion when it exceeds two percent.
Beware gates that only measure activity, such as requiring a fixed number of approvals. They create delay without reducing the specific risk unless the reviewers have the context and time to catch it.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Which gates would you make blocking versus advisory?
  2. 2How do you handle a false positive in a security gate?
  3. 3What is an error-budget-based deployment gate?
  4. 4How do you audit a bypass?

Say it in the interview

Deployment gates are automated release policies covering correctness, security, reliability and compliance. I make them objective and tied to a real failure mode, and I prefer fail-closed behaviour for production promotion. Each gate needs an owner, a useful failure message and an audited exception path. I avoid gates that only measure activity, because they add delay without reducing risk.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

MediumWhat deployment strategies are available and how do you choose?EasyHow should production approvals work?MediumHow do you monitor a deployment in progress?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live CI/CD mock interview and get scored feedback on depth, clarity and confidence.

Start a free CI/CD interviewBrowse all questions