A blocking L4 gate (a coverage, secret, CVE, lint, build or test failure) may be bypassed only when the override-check job confirms all 3 conditions:

The policy enables override (override.enabled: true).
The person who triggered the run is in override.authorized_users. This is a list of GitHub usernames in the project's vfa-policy.yml (not case-sensitive, @ is optional). This person is github.triggering_actor (the user who pushed, updated the PR or clicked Re-run). The core default is an empty list, so nobody can override until the project adds people to it.
A reason of at least 10 characters, taken from the PR body.

authorized_users is read from vfa-policy.yml on the PR's base branch, not from the PR itself, so a PR cannot add its own author. To add or remove people, use a separate PR and get it reviewed, like any policy change.

When all conditions are met, every gate still runs, but in warn-only mode, and the security-gates status check (the final verdict job) is always green. This is true even when the checks job fails on a step that no gate covers (setup, scanner install, and so on). If a gate was actually bypassed, the checks job writes one line to override-audit.log (ts / actor / reason / repo / pr / layer / bypassed gates). The log is uploaded as the override-audit artifact, and telemetry records status=warn. The security-gates job audits a failure outside the gates as "bypassed": ["checks:failure"]. Clean runs write no audit entry. For step-by-step instructions, see 40-procedures/l4-override.md.
> ⚠️ Remaining gaps (waiting for COE / Dev Director): when an authorized user pushes or re-runs, the override applies at once, with no separate confirmation per PR (such as a label); the "reason" is the whole PR body (an existing PR template already has more than 10 characters); the audit log is only a run artifact (it expires after the retention period), with no central store; layer is still read from the PR's vfa-policy.yml, so consumer repos need CODEOWNERS on that file, or a PR can lower its own layer to L3.

Current list (30-registry/gate-policy.yml):

enabled: true
authorized_users: []
require_reason: true