Gate behavior

A scanner emits a ScanOutcome: risk score, rationale, and optional match spans. The gate adds the scanner ID, display name, severity, and action to make a Finding.

Only findings with action BLOCK contribute to the aggregate. Their input to the configured score aggregator is:

The entry is safe when there are no blocking findings or when the aggregate is strictly below threshold. WARN and PASS findings are retained for review but do not contribute to the aggregate.

Scanners may restrict their accepted content_types. Before calling a scanner, the gate compares the entry’s type with that restriction. A non-matching scanner is recorded as skipped with its reason; it does not produce a finding or affect the aggregate.

When fail_fast is enabled, the gate stops after the first blocking finding whose severity-weighted score reaches the configured threshold. With it disabled, the gate runs every compatible scanner and returns all findings.

on_scanner_error determines how scanner exceptions affect the result:

The output GateVerdict includes is_safe, aggregate score, rationale, findings, and skipped scanners. See Score aggregators for the available combination strategies.