Every act on a model now carries that model’s validation state back with it, in
a validation object on the response. Live scoring, training, score activation
and the score_records and train_model tools all return it, and it names the
gate when a gate was not reached or not cleared. The result is surfaced before
anything acts on it, for every org, and that part is not optional.
What is optional is what happens next. Your org sets a deploy policy. The
default, surface, proceeds with the state attached. block refuses live
scoring and activation on a model whose state is not passed, with a 409 and
the code deploy_blocked naming the gate. Training is never refused under
either policy, because retraining is the remedy for a failing gate. Timing
models are not graded by these gates and are never refused. Under block the
scheduled rescore skips a not-passed model rather than refusing it, and records
the skip on the run, in the audit log, and as a pause reading on the model.
Under both policies, every act on a model whose state is not passed is an
audit event, including the act that proceeded. A trail that recorded only
refusals would make an org that deploys on thin evidence look identical to one
that never did. Records are coalesced inside a 60 second window on the org, the
model, the act point, the state, and whether the act was refused.
The policy is read and set at /orgs/deploy-policy by an owner or admin. An
agent can read it and cannot change it.