Refusing the Free Lane: A Red-Flag Gate You Can Run in CI

Description and use

An automated CI gate that refuses workloads exceeding a weighted red‑flag score, preventing costly overuse of free capacity.

Problem

Deciding whether to allow a workload to run on a free capacity lane can lead to costly retries, data exposure, and contractual violations.

Outcome

The harness automatically refuses workloads exceeding a score of 12, shadows those between 5 and 12, and admits others, preventing costly overuse of free capacity.

Workflow

• Load policy.json
• Load workload manifest
• Compute weighted score for each red‑flag flag
• Compare score to refuse and shadow thresholds
• Return verdict (refuse, shadow, admit) and exit non‑zero if refused

Evidence

The harness below uses only the Python standard library. It reads a policy file and a workload manifest, then exits non-zero on refusal.

Source

Seven red flags worth acting on ... Each flag below describes the workload, not a vendor.

Source