Example
Illustrative release decision
A worked example of how GoSentrix qualifies evidence, evaluates policy, and produces an explicit outcome for a consequential software release.
The scenario
A regulated financial-services team wants to release a payment-service update. The release policy requires:
- All critical and high findings from the primary SAST scanner are remediated or explicitly accepted.
- Container scan results are no older than 48 hours.
- Any AI-generated code in the change has a reviewer attestation.
- Each accepted-risk exception has CISO approval recorded.
The evidence that enters
- SAST scanner reports one high-severity finding in the payment path.
- Container scan is 36 hours old and reports no critical issues.
- AI-provenance hook shows 12% of the changed lines were AI-generated.
- Developer marked the high finding as fixed and linked a commit.
- No exception request is open for this release.
How GoSentrix evaluates
Qualify the SAST finding
The high finding is corroborated by the container scan. It is not automatically dismissed.
Verify the fix claim
GoSentrix checks the linked commit. The fix verification record shows the finding is no longer present in the new artifact.
Check freshness
The container scan is within the 48-hour window.
Check AI provenance
The AI-generated code has a reviewer attestation in the pull request.
Evaluate exceptions
No exception request is open, so no approval record is required.
The outcome
Proceed
All required evidence is present and satisfies the active policy version. The decision record preserves the evidence snapshot, the policy version, and the reasoning. If an auditor or incident later asks why the release was cleared, the basis is available.
What would change the outcome
- If the container scan were older than 48 hours, the decision would escalate until a fresh scan was provided.
- If the high finding fix could not be verified, the outcome would be Stop or Require authorization.
- If the AI-generated code lacked reviewer attestation, the decision would escalate.
- If an exception request were open without CISO approval, the outcome would be Stop.
Explore release-evidence verification.
See how GoSentrix would qualify evidence, evaluate your policy, and preserve the basis for your release decisions.