CI/CD security gates without slowing delivery to a halt

Security gates fail when they are optional in production paths and mandatory in paths nobody uses. Put scanning and policy checks on the promotion path that actually ships.

Pair gates with rollback. A pipeline that blocks bad builds but cannot recover a bad release is only half a delivery system.

Document owners for exceptions. Temporary waivers without expiry become permanent risk.