Automated Review Gates
Select review by changed effects as well as paths. File patterns can help route work, but do not prove risk classification.
| Changed effect | Relevant reviewer |
|---|---|
| Public API/consumer contract | API reviewer |
| Authentication, authorization or data access | Security reviewer |
| Schema, migration or storage compatibility | Migration reviewer |
| Applicable privacy/regulatory control | Compliance reviewer |
| Tenant-policy migration | Security and migration reviewers |
Review important designs before implementation and consequential implementation slices before integration. Missing required design scrutiny blocks approval, not safe investigation.
The four reference templates request the exact candidate/scope, observed versus expected behaviour, evidence status, affected cases, work/evidence references, uncertainty and proposed correction. Findings can be confirmed, hypothesis/pending evidence, not assessed, or rejected with evidence. Final dispositions follow §3.3.
Compliance review establishes applicable obligations with the qualified owner. Do not declare a legal violation from a checklist or confuse model agreement with independent evidence. Templates guide review; actual completion receipts establish that review happened.