A team, with its product owner and security partnership, may elevate designated finding classes, components, or risk thresholds to blocking status. Wherever gating is enabled, an override path must exist. Exercising the override is not a failure of the mechanism. It is the mechanism completing: the business retains the authority to accept vulnerable code, and the override records who accepted what, and why (Accountability, Section 3.2.2.2).