Passport FAQ

Short answers to the questions people ask most about guardrails, evidence, passports and the pipeline check.

Can a solo developer use this?

Yes, all of it except writing an organisation’s guardrail policy. Create a studio and you have the two gates with seed checklists already mapped to controls, the evidence ledger, the passport, exceptions, a signed passport at every release approval, the deploy token and the pipeline check. You decide both sides of an item yourself; the record says one person did, and nothing refuses it. Start by opening a work package’s Passport tab.

Why does my environment read “not read”?

Either a workflow file could not be read at all (Pipelines not read), or a deploy job names its environment in a form the Studio does not follow (environment not read). The Studio reads workflow files with a different YAML parser from the one GitHub runs them with, and where the two could disagree it reads nothing rather than vouch for the wrong thing. The page names the file and the reason. The usual fixes are to put a value on one line or in a block, write out anything shared through anchors, quote a name like on or yes, and name the environment plainly. The full list is in Wire a Pipeline to the Passport.

What happens when an exception expires after release?

Nothing that has happened is undone: the release stays approved and the deployment stands. From that day the item is unmet again. Anyone verifying the signed passport is told an exception has run out — the expiry is inside the signed record and is judged against the day of the check — and the next deploy of that release in an enforced environment is held. Renew the exception or meet the item, then issue the passport again.

What if our subscription lapses?

Work in flight is not stranded. Without the Enterprise contract an organisation cannot create, edit or activate a guardrail policy, switch on must be a named role, or declare or lengthen a retention period. Everything else carries on: reading policies, retiring one, the version already applied to your studios’ work packages, release rules, the exceptions register, legal holds, releasing a studio, and every passport already issued. A studio’s own ledger, passport, exceptions and signing do not depend on the organisation’s contract at all.

Is the passport I see on the tab signed?

No. That is the live view, assembled each time, and it says not signed yet. The signed versions are listed with it.

Does a valid signature mean the release is clean?

No. It means the record is exactly as issued. What the record says — an unmet item, an unknown control, an exception that has run out — is reported beside the signature and is never hidden by it.

Why does a control read Unknown when the item is ticked?

Because the ledger holds no decision for it against the current version of the work package. The work package may have changed since the item was decided, or the item may predate the ledger. Decide it again on the current version.

Why does provenance say “unknown” or “seen”?

The passport names a producer only for a pull request head the Studio published itself. A head pushed by someone else, or by a cloud agent, is recorded as seen. The passport does not infer who made it from a runner’s name.

Does each agent have its own credentials?

No. The passport names the agent, but the Studio’s own runner commits with the publishing person’s GitHub account, and the passport says which account that was.

My pipeline was not generated by the Studio. Is it held?

No. DevOps → Pipelines lists its deploys as having no passport check. You can add the same job to it; until you do, nothing refuses a deploy from it.

I pinned an action to a commit and now the check reads “changed”.

That is a known gap. Pinning to a commit is good practice, but the Studio cannot yet tell whose commit it is from the file alone, so it stops vouching for that job. The check still runs.

Can evidence be deleted, by us or by you?

The application cannot edit or delete an evidence entry or an issued passport, and nothing removes them when a retention period ends or a studio is deleted. How a request to erase a person’s name from an entry that cannot be changed is met has not been settled; contact support if you have one.

Does a sample review hold a release?

Never. A pending sample or a concern is shown and stops nothing.

Who sees the notice that evidence was not recorded?

The studio’s owner, in the product. It is not emailed, and members do not see it. Everyone sees the Saved notice on their own save.

Are scan results in the passport?

No. CI check runs and statuses are, and so is the fingerprint of a bill of materials a pipeline reported. Security and dependency scan results are not recorded as evidence.

Can the organisation choose who approves in my studio?

No. It names roles; each studio’s owner says which of the studio’s roles answers for each and who holds it. The organisation sees that mapping, with a count of holders and whether the owner is one of them.