Alert fatigue usually starts when every signal is treated as equally urgent. The opposite failure is worse: a serious issue becomes one more yellow warning in a long list. A small decision model gives each class a stable meaning and keeps the release owner visible.
PASS: no unresolved issue in the scope you ran.
Use PASS when the candidate completed the selected checks, no blocking or review finding remains, and the accountable reviewer is comfortable with the stated scope.
The release may continue to the next required approval. Record the exact file or folder, scan time, rules, tool version, and reviewer.
“PASS” alone is weak. “PASS for the three files in Final Pack under baseline rules v1” is auditable.
A mechanical preflight cannot prove every fact, permission, contract term, or recipient expectation.
REVIEW: the signal may be valid, but intent matters.
Use REVIEW when software can locate the condition but cannot safely choose the outcome. Common examples include an external workbook link, a hidden sheet, speaker notes, an unsupported quantitative claim, or language that may be intentional in context.
Name the person who can decide, the evidence they need, and the time by which the decision must be made.
artifact-1.pptxConfirm whether the recipient should receive the notes. If not, remove them from a copy and rerun the check.
BLOCK: do not send this candidate yet.
Use BLOCK for a condition that crosses a release gate: a credential pattern, unresolved client placeholder, internal-only instruction, spreadsheet error value, forbidden term, or another explicitly blocking policy.
Fix the issue or obtain an explicit, accountable exception. Then rerun the exact delivery candidate before release.
Deleting visible text does not make a real exposed secret safe again.
Do not manually flip BLOCK to PASS without checking the changed file.
An exception is a decision with evidence, not a muted alert.
Sometimes a finding is a false positive or an accepted risk. Preserve the finding and attach a narrow disposition instead of deleting the rule or hiding the result.
Use a controlled value such as false positive, accepted risk, or remediated.
“Known issue” is not enough. Explain why this occurrence is safe for this release and who approved it.
Require an explicit elevated override and keep it visible in the private report.
Keep the release record small enough to use.
Exact relative path or release folder and a stable package hash when appropriate.
Rules, file types, exclusions, tool version, and scan time.
PASS, REVIEW, or BLOCK; unresolved findings; dispositions; accountable reviewer; next action.