Gate Deployments in CI/CD

Use a governance policy as a deployment gate to prevent a project from shipping when it doesn't meet your organization's requirements.

The gate assesses every control in the project's assigned policy, including controls inherited from its base policy. It passes when every control above Low importance passes.

Before you begin

Assign the project to a governance policy before running the gate. The assess endpoint returns an error when the project doesn't belong to a policy.

Run the deployment gate

Run the gate from your CI/CD pipeline using the confident-ai CLI, which the Confident AI SDK installs for both Python and TypeScript, or call the public API directly.

confident-ai gate

npx confident-ai gate

curl -X POST "https://api.confident-ai.com/v2/governance/assess" \
  -H "CONFIDENT_API_KEY: <PROJECT-API-KEY>"

The CLI exits with code 0 when the policy passes, 1 when it fails or can't be assessed, and 2 on bad usage, so a failing policy stops the pipeline. Pass -q to print nothing and leave the verdict to the exit code.

All three call the POST /v2/governance/assess endpoint using the project's API key, which the CLI reads from CONFIDENT_PROJ_API_KEY. The response says whether the policy passed and names the policy it was assessed against:

{
  "success": true,
  "data": {
    "passed": false,
    "governancePolicy": {
      "id": "<GOVERNANCE-POLICY-ID>",
      "name": "EU AI Act"
    }
  },
  "deprecated": false
}

Example: evaluate, red team, and gate a project

The following GitHub Actions workflow installs DeepEval, DeepTeam and the Confident AI SDK, runs code-based evaluations, runs code-based red teaming, and then evaluates the project's deployment gate:

name: Governance deployment gate

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  governance:
    runs-on: ubuntu-latest
    env:
      CONFIDENT_API_KEY: ${{ secrets.CONFIDENT_API_KEY }}
      CONFIDENT_PROJ_API_KEY: ${{ secrets.CONFIDENT_API_KEY }}
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install DeepEval, DeepTeam and the Confident AI SDK
        run: pip install -U deepeval deepteam confident-ai

      - name: Run code-based evaluations
        continue-on-error: true
        # test_llm_app.py uses DeepEval to define and run evaluation tests.
        run: deepeval test run tests/test_llm_app.py

      - name: Run code-based red teaming
        continue-on-error: true
        # red_team.py uses DeepTeam to define and run a risk assessment.
        run: python tests/red_team.py

      - name: Run governance deployment gate
        run: confident-ai gate

Replace tests/test_llm_app.py with your DeepEval test file and tests/red_team.py with the Python file that calls DeepTeam's red_team() function. DeepEval and DeepTeam read the project's API key from CONFIDENT_API_KEY and the gate reads it from CONFIDENT_PROJ_API_KEY, so both are set from the same secret.

GitHub Actions runs steps within a job sequentially, so the deployment gate runs after the evaluation and red teaming results have been uploaded. The validation steps use continue-on-error to guarantee that the final gate still runs when either assessment reports a failure; the gate then makes the final deployment decision from the policy's controls.

Next steps

• Governance Policies — create policies, assign projects, and configure inheritance
• Governance Controls — define the requirements enforced by the gate

Last updated on October 17, 2026