Audit Verdicts Are Runtime State

A review gate does not control a workflow just because it produces an artifact. If the verdict can change what happens next, the system has to parse it, store it, route from it, and fail closed when it is missing or unclear.

Opening

A review gate can look solid from the outside. There is an audit file. There is a verdict. There may even be a clear written explanation of what should happen next.

But the workflow is only governed if the system actually listens to that verdict.

Problem

The common failure mode is subtle: a process writes a review result, then advances as if the existence of the review is the same thing as acceptance.

That is not a gate. It is documentation next to the gate.

In a governed workflow, the important question is not only, "Was a review produced?" The sharper question is, "Did the verdict change the workflow state?"

Story / Example

Imagine an automated workflow with a planning review. The review can return four outcomes:

| Verdict | Meaning | | --- | --- | | Accept | Continue to the next stage | | Needs fix | Rework the plan with the review findings | | Blocked | Stop until the blocker is resolved | | Unknown | Fail closed because the system cannot safely route |

If the workflow writes the review but never parses the verdict, every outcome can collapse into the same behavior: continue.

That is how a reviewed process becomes verdict-blind.

Lesson

Any verdict that can change sequencing must become runtime state.

That usually means four things:

1. Parse the verdict exactly at the boundary.
2. Store a durable machine-readable state token.
3. Route the next action from that token.
4. Test each verdict path, including blocked and unknown outcomes.

The exact tokens matter. Prose such as "looks good" or "probably fine" is useful for humans, but it is not enough for automation. The workflow needs an explicit state it can enforce.

Broader Implication

This applies beyond software delivery. It applies to approval flows, compliance checks, content review, customer operations, finance controls, and any process where a review is supposed to determine what happens next.

If the review result is advisory, keep it advisory.

If the review result is authoritative, make it part of the state machine.

Closing

A gate that does not change state is only a note in the margin.

Audit verdicts are runtime state. Treat them that way.