What is a promotion gate?
A promotion gate is a check that an infrastructure or configuration change must pass before it advances between environments, for example staging to production; it normally calls for approval and assesses policy or coverage conditions.
Why it matters
NIST SP 800-128 and similar change management guidance call for review and approval before a change takes effect. Many audits also look for approval by someone other than the author. When configured to do so, a promotion gate checks this where the change becomes live, and it records the result.
How compliance.tf applies it
Within compliance.tf, each project environment is bound to a config snapshot, and promotion means binding a different snapshot to that environment. Protected environments, with production protected by default, run the gate before anything changes. It checks that the candidate snapshot is approved, that the promoter is not its publisher when segregation of duties is enabled, and, depending on an organization setting, whether the candidate leaves framework clauses uncovered. Each check either blocks the promotion or warns. Promotion and gates owns the full list of checks, the preview that runs the same gate without changing state, how waivers are frozen at promotion, and what rollback keeps.
The promotion and its audit record are written as one atomic operation. Separation of duties is disabled by default.
Where it ends
The gate runs only on protected environments; binding to an unprotected one is a direct action. A warn result appears in the preview response, not in the audit record, so keep the preview if the warning must stay on file. A clean preview reserves nothing: the gate is evaluated again when the promotion is made.