Evaluate and approve a release

A release candidate is one exact commit SHA in one environment for one application. Evaluation and deployment approval are separate records.

PASS

Every required control has fresh, verified, passed evidence for the candidate's connected repository, exact SHA and environment. No unresolved finding or active incident remains.

CONDITIONAL

All required evidence passes, and each remaining non-critical finding has an active exception approved by an independent owner. The exception needs a reason, an owner and an expiry no more than 30 days away. Critical findings cannot receive an exception.

BLOCKED

A candidate is blocked when required evidence is missing, expired, failed or unknown; a finding lacks an eligible exception; an incident remains active; or no required controls are configured. A clean-looking dashboard cannot override these rules.

Evaluate

Open Releases, enter the full SHA and environment, then evaluate. The decision stores control versions, evidence IDs, evidence hashes, blockers and applicable exceptions. The database calculates the verdict; a client cannot write PASS directly.

Independent approval

A different organisation owner must approve a passing or conditional candidate. The owner needs recent authenticator verification. The system recalculates the inputs at approval time. Changed evidence, requirements, exceptions, findings or incident state requires a new evaluation.

An approval expires within one hour and no later than the evidence freshness limit. Its validity must be checked again before use. BuildVouch does not deploy software.

Export the evidence pack

After recent authenticator verification, export a release pack. It includes the stored decision, its current validity, referenced evidence and hashes. The export itself is audited. Store the downloaded pack according to your organisation's evidence policy.

Review limitations

A verified source record confirms where a result came from. It does not guarantee that the source test was sufficient. Control owners must review test coverage and workflow trust before relying on a release decision.