Severity thresholds
"No criticals" blocks a library nobody calls and passes a medium on the login route.
Gate on what is reachable,
not on a severity count.
A gate that blocks every critical blocks nothing for long, because teams route around it. SecurityVault gates evaluate policy over the ontology — is it reachable, is the workload exposed, is there an approved exception — and fail closed when they cannot answer.
OPA
Rego evaluation
Direct or via the visual builder; every error is a deny.
2
Gate surfaces
Pull-request annotations and pipeline gate evaluation.
3
Exit codes
0 success · 1 policy failure · 2 API error, from the esos CLI.
Ed25519
Signed decisions
Canonical payload, auditor-verifiable public key.
The problem
Most gates lie.
01
02
Fail-open by default
When the scanner is down the build goes green, so the gate is only as reliable as the least reliable tool.
03
Overrides without a trail
A retry with the check disabled leaves no record of who decided what.
04
Comment storms
Every push re-posts every finding until developers mute the bot.
05
Gate in one CI, not the other
Policy lives in a YAML file per pipeline and drifts between them.
06
No exception model
Risk acceptance happens in Slack and expires never.
How SecurityVault does it
Policy over the graph, decisions on the record.
Inputs
The gate input carries the findings on the change, their reachability hints, the subject's exposure edges and any active exceptions. Policy reasons about all of them.
Evaluation
OPA runs over a structured input; an evaluator error is
DENY with OPA_EVALUATION_FAILED. No configuration turns that into an allow.Pull requests
PR scans supersede earlier runs on the same head; results go up as SARIF and as annotated comments through a per-organisation rate limit with every attempt recorded.
Pipelines
esos --fail-on high ci scan or POST /api/v2/ci/gate/evaluate; exit codes map to allow, deny and error so a pipeline can tell a policy denial from an outage.Overrides
Break-glass on a scan requires an authorised principal and is written as an audited event; it never rewrites the original decision.
Exceptions
Owner, expiry, approver chain, optional dual control. An expired exception stops satisfying the policy.
What it rests on
The platform underneath.
Policy
OPA · Rego
Hand-written or compiled from the visual builder.
Ontology
Reachability and exposure
Inputs the gate can actually use.
CI/CD
GitHub · GitLab · Bitbucket · Azure DevOps · Jenkins
Webhooks, OIDC principals, SARIF.
CLI
esos ci scan
Exit codes for gates, SARIF and JUnit output.
Audit
HMAC chain
Every decision and override recorded.
Admission
Cosign webhook
Refuse unsigned images at the cluster.
See it on your stack
Put a real gate on one pipeline.
We wire one repository, one policy and one pipeline, then show you the decision record.