Quality Gates as Decision Systems

C14.1 — Make the decision record inspectable

A governable gate records:

• the eligible work and decision scope;
• the policy and version applied;
• the evidence considered, including missing or stale evidence;
• the authorized decision maker or automated authority;
• the outcome: proceed, correct, except, stop, or escalate;
• the rationale and residual uncertainty;
• the decision time and effective period;
• affected parties, challenge, appeal, and override paths; and
• the downstream state needed for later review.

NIST authorization and control guidance supports evidence-bearing authorization packages, accountable officials, risk response, continuous monitoring, corrective actions, milestones, and ongoing decisions. NASA assurance guidance supports objective evidence, proportional independent challenge, timely findings, and closure tracking. These are normative control families, not proof that any implementation reduces risk.C14-S01C14-S02C14-S03C14-S04

Automation can serve routine decisions when policy, evidence, tolerance, attribution, and escalation are explicit. It does not remove authority. The actor or rule version, evidence inputs, policy, and accountable owner remain traceable. Uncertain, anomalous, consequential, or out-of-policy work must reach an authorized path that can correct or stop.

The DoD continuous-authorization guide illustrates a bounded design: continuous evidence, documented risk tolerance, automated promotion rules, residual-risk visibility, and event-triggered escalation. It is guidance, not a comparative outcome evaluation or universal automation prescription.C14-R01

C14.2 — Design proceed, correct, except, and stop as real paths

A gate with only approve and reject encourages hidden workarounds. Production decisions need distinct paths.

Proceed means the evidence satisfies the policy for the declared scope and period. It does not certify future operation or total quality.

Correct returns actionable findings, ownership, and a new evidence requirement. Correction should not become an unbounded queue or a silent rejection.

Exception is a time-bounded authorized acceptance of residual risk under explicit conditions. It is not a policy bypass or permanent debt label.

Stop prevents continuation where evidence, authority, consequence, or recoverability makes proceeding unacceptable. A stop should have an owner and conditions for reconsideration.

Escalate or appeal brings a decision to a different authorized perspective when evidence, application, conflict, or impact is disputed.

Procedural-justice research supports asking whether procedures are consistent, unbiased, accurate, correctable, representative, and explained. It does not validate a software gate or guarantee a fair outcome. The useful transfer is that voice, correction, explanation, and decision accuracy are part of integrity, not decorative communication.C14-A04

C14.3 — Govern the complete exception lifecycle

An exception record needs:

• eligible scope and affected assets;
• policy requirement and evidence gap;
• named authority and rationale;
• residual risk and affected parties;
• compensating control;
• start, expiry, and review dates;
• corrective action, owner, and milestone;
• closure evidence;
• recurrence relationship;
• appeal, override, and recourse; and
• policy-learning disposition.

Expiry without closure evidence is not closure. A renewed exception is not a new independent event when it represents recurrence. A compensating control is a claim requiring its own evidence.

GAO’s DLA audit examined 1,627 corrective-action plans across six systems. It reported 1,115 ongoing plans and 338 overdue plans requiring waivers, while the agency did not supply waiver evidence for those overdue plans. This is independent exception-control failure evidence: missing approval evidence, overdue remediation, and incomplete risk data. It does not provide an escaped-risk or waiver-effectiveness rate.C14-R08

GAO’s federal IoT audit examined six reported waivers and found approval, field, reporting, and administrative problems that led to corrections and policy recommendations. It supports reporting validity, approval integrity, correction, oversight, and policy-learning needs. It does not supply an eligible-device denominator, device-security outcome, or false-decision rate.C14-R09

The DLA and IoT records remain separate populations, periods, definitions, and audits. Their numbers must never be pooled.

C14.4 — Separate evidence tiers

The gate evidence ladder is:

gate activity
→ compliance record
→ decision and exception integrity
→ linked escaped outcomes
→ control-effectiveness analysis

The first three are supported by the current evidence. The final two require additional linked records.

Gate activity counts submissions, assessments, decisions, latency, or path. It shows volume and flow.

Compliance shows completion against a requirement. It can still be based on stale, incomplete, or incorrectly reported evidence.

Decision integrity tests valid evidence, policy, authority, rationale, reporting, exception duration, closure, recurrence, and appeal.

Escaped outcomes require linkage from a specific gate decision to a defined downstream observation window and valid outcome record.

Control effectiveness additionally requires the eligible denominator, credible truth labels or counterfactual, false-pass and false-fail analysis, escaped risk, costs and burdens, and review of alternative explanations.

Approval rate, completion, latency, and exception count cannot be converted into effectiveness. The current public cohorts lack linked outcomes and truth labels.

Open figure

Figure F14.1 production specification: Governable Gate and Exception Loop

Figure F14.1 — A gate routes work through proceed, correct, except, stop, and appeal paths. Activity, compliance, and integrity evidence are currently supportable. Linked escaped outcomes and effectiveness analysis are explicitly marked as additional evidence required.

C14.5 — Turn corrections and recurrence into policy learning

Policy learning requires an evidence-to-change link:

decision or exception
→ correction, recurrence, appeal, audit, or escaped outcome
→ finding
→ named policy/control change
→ effective version and owner
→ follow-up evidence

An audit recommendation shows learning potential. A corrected report shows an administrative change. Neither proves improved downstream outcomes. Follow-up must test whether the changed rule, data field, authority, training, automation, or review practice improved decision integrity or effectiveness.

Chapter 18 owns institutional policy authority and the Manufacturing PMO. This chapter owns the gate-level evidence that can inform that policy.

The governable-gate test

Leaders can ask:

1. Which decisions are eligible, and what is the denominator?
2. Which evidence, policy version, authority, and rationale produced each outcome?
3. Can work proceed, correct, except, stop, escalate, and appeal through explicit paths?
4. Does every exception carry scope, risk, control, owner, duration, review, closure, and recurrence?
5. Are automated decisions attributable and reversible within a declared boundary?
6. Are activity, compliance, integrity, escaped outcomes, and effectiveness reported separately?
7. Can downstream outcomes link to a decision and fixed observation window?
8. Which finding changed which policy, and what follow-up tests the change?

This is a decision framework, not a universal risk tier, automation share, approval-time target, exception duration, false-decision rate, or risk-reduction claim.

What to remember

A Quality Gate is a transparent decision service, not an opaque approval queue.

Auditability needs eligibility, evidence, policy, authority, outcome, rationale, time, exception lifecycle, appeal, and downstream linkage.

Proceed, correct, except, stop, escalate, and appeal are distinct paths.

Activity, compliance, decision integrity, exception governance, escaped outcomes, and effectiveness are distinct evidence states.

GAO DLA, GAO IoT, GOV.UK, and DoD records have separate roles and must never become a synthetic cohort.

Current evidence supports auditability and policy-learning potential. It does not prove actual risk reduction.

Make every gate decision traceable, every exception temporary and reviewable, and every effectiveness claim dependent on linked outcomes.