What Is a Quality Gate? Definition, Criteria, and Common Mistakes

A quality gate is a defined checkpoint with fixed criteria that a change must pass before it is handed on. It is not a recommendation and not a metric, but a barrier: criteria met means proceed, criteria not met means stop. This clarity is the entire value: a gate that can be bypassed is just a report.

What Is a Quality Gate?

The term comes from project management and originally referred to a milestone at which defined deliverables had to be in place before the next phase could begin. In software development, it has taken on a narrower, technical meaning: an automated check in the delivery chain that aborts the process if it is not met.

Three properties make a gate a gate:

• The criteria are fixed in advance. Not negotiated case by case, but formulated as a rule.
• The decision is binary. Passed or not. "Borderline, but it's urgent" is not a valid answer for a machine to give.
• It is binding. A failed gate stops the process. Otherwise it is just a notice.

Which Criteria Belong in a Quality Gate?

Only criteria that a machine can decide unambiguously. Everything else belongs in review, not in the gate.

Criterion	Sensible threshold
Test run	no failing tests, no exceptions
Coverage of changed lines	not below the existing project value
New static analysis findings	none above the defined severity
Known vulnerabilities in dependencies	no new critical ones
Secrets in the source code	none, a violation always aborts
New duplicates	none above the defined block size

The decisive distinction is in the second column: the thresholds apply to new and changed code, not to the existing codebase. A gate that evaluates the legacy codebase blocks everything on day one and gets switched off on day two.

Where in the Workflow Should a Quality Gate Sit?

At several points, with increasing strictness and decreasing frequency.

• At commit time (seconds): formatting, obvious errors, secrets. Whatever fails here costs nothing.
• At the pull request (minutes): tests, static analysis, coverage, dependencies. The actual gate.
• Before deployment (the hard barrier): everything before that, plus the questions that only matter here: is there a migration involved, is it reversible, is there a rollback path, was something included that should never end up on a server?

The last point is often forgotten because it does not look like code quality. It is the most expensive one: a wrongly shipped configuration file or an irreversible migration is the only mistake on this list that can take a system down for hours. Details in Quality Gates in the CI/CD Pipeline.

Why Do Quality Gates Fail in Practice?

Because of four mistakes that all have the same effect: the gate gets bypassed instead of used.

• Too many criteria at once. Anyone who starts with fifteen rules blocks every single process and gets switched off within a week. Start with three.
• Evaluating the existing codebase instead of what's new. The most common setup mistake, see above.
• Bypassing without a trace. There has to be a way to override a gate, otherwise the first special case blocks operations entirely. This override must be logged and carry a name. A silent bypass makes the gate worthless.
• Criteria that never decide anything. A gate that has been green for a year straight is not checking anything. Either the threshold is too lax or the criterion is irrelevant to the current way of working.

Why Have Quality Gates Become More Important for AI Code?

Because review capacity is not keeping pace with generation speed. A person does not review more lines per hour today than three years ago, but significantly more are being generated.

The result is a shift that a person cannot see in a single diff: more duplication, less cleanup (figures and where they come from), and a threshold in the pipeline reports it immediately. This is exactly what a gate is the right tool for: it does not compare the line, it compares the state.

Frequently Asked Questions About Quality Gates

What Is the Difference Between a Quality Gate and a Definition of Done?

The gate checks mechanically and decides in binary terms. The Definition of Done is the team's agreement and also includes points that no machine can judge. The gate enforces the technical part of the Definition of Done; see Definition of Done.

Do I Need SonarQube for a Quality Gate?

No. Any CI pipeline can abort on a failure, and that is already a gate. A platform provides history, threshold management, and reporting, but it is not a prerequisite.

How Many Criteria Should a Gate Have?

Three to start: no failing tests, no new critical analysis findings, no secrets in the code. Expand once these three are consistently green.

What If a Gate Blocks Urgent Work?

Then it is overridden with documentation, a name, and a reason, and the case is followed up afterward. If bypasses pile up at the same spot, the criterion is wrong, not the urgency.

A gate only works if it stands in front of the step, not next to it. That is exactly how Code Guardian is built: seven gates for deployment, migration, new dependencies, data conclusions, findings, decision questions, and legal text, six of them backed by a hook that actually halts the process.

Sources

• GitClear, The Maintainability Gap: 2026 AI Code Quality Research.
• ISO/IEC 25010:2023 (quality characteristics that gate criteria can be aligned with).

As of: July 27, 2026. General professional overview.