The gate that only logs

What it looks like. A required checkpoint exists, fires on every relevant action, and produces an artifact. Nobody can remember the last time it stopped anything. The review runs, but after the action it nominally gates. Compliance is measured by whether the artifact exists.

Why it fails. The control's authority comes from its ability to block. Once it only logs, the audit trail keeps reporting a gate that is no longer there — and the record is now evidence against investigating, because it looks clean.

Instead. Anchor each checkpoint to its specification and measure its blocking rate, not its completion rate. A gate whose block rate reaches zero is a finding. Pair every audit query with a behavioral probe of the same property.