CI/CD, policy as code, and controlled promotion

Chapter 4 of 6

Decisions and stop conditions#

Resolve every __REQUIRED_*__ value in the artifacts tree. Decide:

1. The repository, protected default branch, approved full SHA, and full-SHA action revisions.
2. The tenant, stage workload client IDs, exact resource-group scopes, four federated credential names, and four observed OIDC subjects. Do not reconstruct a subject from an example.
3. The apply reviewers, prevent-self-review settings, production ref restriction, administrator bypass setting, and GitHub plan support.
4. The Bicep, APIM policy, unit-test, evaluation, smoke-check, routing, and release-store source paths.
5. The immutable agent and component versions, canary or blue-green strategy, allowed selectors, release ID, and approved temporary workspace.
6. The framework path for the release agent, the duplicate-review outcome, the reviewing role, and the inventory record it compared.

Stop before a change when:

• a sentinel remains; an action uses a floating tag; or a component uses latest or current;
• the SHA is outside the protected default branch, workflow content comes from another ref, or a digest can change between stages;
• a client secret, broad repository permission, inherited Azure assignment, or wider-than-resource- group workload role is present;
• an OIDC subject differs from the exact GitHub environment subject;
• secret scanning, push protection, required reviewers, prevent-self-review, the production ref rule, or disabled administrator bypass is unavailable or inaccessible;
• evaluation records, the enabled policy, or the generated blocked test do not match the release;
• the security attestation is pending, unauthorized, incomplete, version-mismatched, missing its report location, worse on aggregate or any risk row, unable to block prohibited actions, or payload-bearing;
• the smoke check is missing, failed, for another commit or workspace, exposes sensitive input, retains payload, reuses trace IDs, or cannot show stable bounded ingestion;
• what-if contains unrelated deletion, replacement, scope drift, or unexplained expansion;
• the framework path sits outside the approved list without an approval reference, or the duplicate review chose an existing agent; or
• the existing governed-agent or APIM route cannot preview and restore the selected selector pair. Keep 100% on the previous approved selector.

No AI-quality signal restores a release automatically.

Agent portfolio decisions#

control-definition.json carries two decisions that no pipeline system can reconstruct.

Set agentPortfolio.frameworkPath to native-platform when the agent runs on its source platform's supported path, or to microsoft-agent-framework or semantic-kernel for a hosted agent or custom runtime. other-by-exception needs an approval reference in frameworkExceptionApprovalReference. Record the supporting team or role alias in frameworkExceptionSupportOwnerRole. Every other path keeps N/A in both fields.

Set agentPortfolio.duplicateReviewDecision after comparing the release agent's business purpose, use cases, tools, data sources, and source platform against the enterprise agent inventory. A search or similarity tool can suggest matches; the portfolio owner decides. Use new-capability when nothing overlaps, approved-overlap when the owner accepts a deliberate overlap, and reuse-existing when an agent in the inventory already does the job. Record the deciding team alias in duplicateReviewOwnerRole and the compared record in reviewedAgentInventoryReference. Keep the agent description, tools, data sources, and runtime configuration in their owning systems.

The release gate reads these values on every promotion. reuse-existing stops the run: promote the existing agent instead.