Definition
A defensible release decision is one whose basis — evidence, policy version, and reasoning — is preserved and reviewable. Defensibility does not mean the decision was perfect or that the release will never have an incident. It means the organization can show what was known, what standard applied, and why the outcome followed.
Defensibility requires three elements: qualified evidence, the policy version active at the time, and recorded reasoning. If any element is missing, the decision is an assertion rather than a defended conclusion.
Why it matters
Software decisions are revisited. Regulators ask for evidence. Customers ask for assurance. Boards ask why a release shipped. A defensible release decision gives the people accountable for the decision a record they can stand behind. Without it, accountability collapses into memory and reputation.
Example
After a production incident, an executive asks why a release shipped with a known vulnerability. The team produces a decision record showing that the vulnerability was evaluated under policy version 2.1, that a compensating control was documented by a named reviewer, and that the decision was explicitly recorded as "proceed with accepted risk." That is defensible, even if the decision is later judged to have been wrong.
Related terms
- Release-evidence verification — The practice of determining whether the evidence behind a software release decision satisfies versioned policy.
- Policy-version binding — Associating a release decision with the exact version of policy that was active when the decision was made.
- Proof artifact — A record that can be independently examined to support or refute a claim about a software release.
- Evidence-backed release — A software release whose approval is supported by qualified evidence evaluated against versioned policy.