Skip to content

Conformance Gate

Drift detection tells you when reality diverged from the approved design. The conformance gate goes one step further: it makes the approved design enforceable in your delivery pipeline, so a violating release is stopped before it ships rather than reported after.

Plan Availability

The conformance gate is available on the Large plan and above. Calls authenticate with an API key that has the compliance read scope.

Everything lives on Operate → Drift, in the Conformance Gate card, with copy-paste commands for each tool.

Three Ways to Enforce

One HTTP call in your release job asks: does this package have open drift at or above a severity threshold? If yes, the step fails and the release stops.

curl -f -H "X-Api-Key: $IA_API_KEY" -X POST \
  "$IA_API_URL/v1/analysis/conformance/packages/<package-id>/gate?fail_status=true"

Useful switches: a severity threshold to tune what blocks, and a refresh option that runs a fresh drift check first instead of trusting the last scheduled one. With the fail-status option the call returns an error status on a blocked gate, so a plain curl -f fails the pipeline step with no response parsing.

Before applying infrastructure changes, send the plan for evaluation against the approved design:

terraform show -json plan.out | curl -f -H "X-Api-Key: $IA_API_KEY" \
  -H "Content-Type: application/json" --data-binary @- -X POST \
  "$IA_API_URL/v1/analysis/conformance/packages/<package-id>/evaluate/terraform"

Creating infrastructure of a kind the approved design does not sanction, or destroying infrastructure that an approved capability depends on, comes back as a finding. Resource types the evaluator does not recognize are counted but never flagged; unknown is not treated as a violation.

Download the package's policy bundle and run it inside your own pipeline with OPA, no network call to IronArchitects at decision time. Bundles are signed; fetch the platform's public key from the API and verify provenance before trusting a bundle in CI.

The Governed Override

Acknowledged drift findings never block the gate. That is deliberate: when a human has looked at a divergence and accepted it, the pipeline should not keep failing on it. The acknowledgement is recorded, so the override is auditable rather than invisible.

Start Advisory, Then Enforce

Wire the gate into your pipeline as a non-blocking step first and watch it for a week. When the only findings appearing are ones you would genuinely stop a release for, flip it to blocking.