What we decided, when, and what we decided against.

Why

The alternative was a bespoke rule format, which is faster to build and would have been a mistake. Rego was chosen because regulated and Red Hat estates already run it: the gate had to be legible to the buyer's security team, not just to us. A proprietary policy language would have made every audit conversation start from scratch.

Why

Not because any of them was hard, but because the habit is the point. A team that starts recording decisions on day one still has the record in month four; a team that starts in month four has already lost the reasoning behind everything that matters most.

Why

Building the gate first, with only five rules behind it, forced every later feature to arrive through it. Retrofitting a mandatory gate onto a system that already works without one is a migration nobody ever finds time for.

Why

The default behaviour for a generator is to overwrite. That is fine on a greenfield repository and catastrophic on one carrying two years of hard-won customisation — which is exactly the estate worth selling to. Preserving by default cost us generation quality early on and bought the right to be pointed at a real repository.

Why

A gate that confirms a file exists is theatre. It passes on a syntactically valid workflow that could never run, which is precisely the failure mode AI-generated output produces — plausible shape, broken substance. Checking existence was the cheap version and we had shipped it; this decision replaced it.

Why

This is the decision that made ratchet-only layering possible at all. Merging the layers into one flat bundle would have been simpler and would have destroyed the property: once flattened, there is no way to prove which layer a rule came from, and therefore no way to prove a customer rule only tightened ours.

Why

A fixed chain would have made every new compliance domain a release. The contract meant SOC 2 could ship as an add-on later without touching the crew, and it is why specialist coverage is a packaging question today rather than an engineering one.

Why

Without scoping, a rule written for infrastructure output fires on application code and produces noise, and noisy gates get switched off. The scoping decision is what let the gate stay mandatory — a control people cannot disable is only tolerable if it is not wrong most of the time.

Why

The interesting half is the second one. Recording the migration triggers up front means the question gets answered from a document instead of re-litigated every time a new architect reads the codebase. It also keeps one security boundary rather than exposing a policy API inside the pod.

Why

Keyless was chosen over a long-lived signing key specifically so that there is no key to leak, rotate, or be asked about in a security review. The answer to "how do you protect your signing key" is that there is not one.

Why

The obvious commercial move was to resell inference at a margin. We chose against it: reselling would put customer prompts and source code through our billing relationship, and the moment we are a token reseller, the incentive to have agents talk more runs against the customer's interest.

Why

Drawing this line early is what makes the portability claim real rather than aspirational. A policy artifact that lives inside a proprietary product is a configuration file with extra steps; one that lives in a separately licensed repository can outlive the vendor relationship.

Why

The decision was that the system may never compose evidence it did not observe. An evidence generator that can write is a liability the first time an auditor asks how a number was produced.

Why

Enforcing our own convention through the same mechanism customers are subject to, rather than through a special case in the tooling, was the point. A governance product that exempts itself from its own gate is telling you what it actually thinks of the gate.

Why

This is why there is no inbound hole in a customer firewall and no shared secret store holding one tenant's credentials next to another's. It also settled the pricing question later: because LLM traffic goes from the customer's cluster straight to the provider, metering it was never an option we had.

Why

This was the decision point where speed and autonomy could have been traded for each other. Faster remediation is worth a great deal, and the merge step is where accountability lives, so the loop closes right up to the merge and stops.

Why

The tempting version auto-applies low-risk fixes. Every definition of "low risk" we tried was a judgement call dressed as a threshold, and a judgement call the customer did not make is exactly what this product exists to prevent.

Why

A score that rises because someone filled in a form is a vanity metric, and an auditor will find that out faster than the customer will. Scoring per application also stops one well-governed service from flattering an estate.