Blocking a Bad Change

Rules reading a field that no longer exists produce no denial, which looks exactly like a clean estate. Validate reports against an expected schema at ingest, test the normaliser against stored real samples, and push a deliberately bad artifact through the real gate.

Regenerating a baseline overwrites it with whatever the current scan reports, so a finding the branch just introduced is recorded as pre-existing and stops counting as new. The gate then passes truthfully while a real regression ships.

Read a concentrated override rate as a defect report on the rule, not on the teams. A rule routinely waved through is too broad, badly placed, or blocking work the organisation has already decided to accept.

Keep one definition and generate both copies from it, decide which direction they may differ, and always tighten the early copy first. The tolerable skew is the early check passing something the cluster later denies, never the reverse.

Because conformance is nearly free at creation and expensive to retrofit. A new service can be scaffolded conformant immediately, so blocking is fair; an existing one would need unfunded rework, so the same rule only reports.

Give de-enforcement the same ceremony as enforcement: every downgrade carries an owner, a reason and an expiry, and each rule's live enforcement state is inventoried. Findings routed to a channel with no consumer are not a control.