Deployment Boundary And L3 Approval — Claude Code Guide

Layer 3 is the go or no-go decision

Green tests, lint, and review do not automatically authorize production. Layer 3 is the responsible approver’s team decision for a specific release or production action, not another test.

The model has three layers: Layer 1 checks local diff and reviewer-agent conclusions, Layer 2 runs CI checks, and Layer 3 decides release and accepts consequences.

Deployment boundary

Protected branches, required checks, environment approvals, and deny rules should make bypassing the deployment boundary technically difficult. A prompt reminder is not enough.

Evidence package for a release gate

• Risk classification.
• Layer 1 review and Layer 2 CI results.
• Staging smoke logs.
• Rollback description and check.
• Capability envelope.
• Named approver.
• Actions that are not delegated to Claude.

Risk: review-required
CI: passed
Staging smoke: passed
Rollback: verified in test environment
Envelope: read + bounded analysis only
Approver: named human owner
Not delegated: production deploy, tag, publish

High-risk actions are not automatic

• Production deployment.
• Destructive database migration.
• Secret rotation.
• Force push to a protected branch.
• IAM or repository-permission changes.
• Feature rollout in a money path.

Rollback is required before deployment

For a release changing a refund flow, Claude may prepare descriptions and evidence, a reviewer agent may analyze code, and CI and staging may provide signals. The release owner still decides whether production release is permitted.

1. Define a stable tag or another return point.
2. Describe how to cancel the version or disable a feature flag.
3. Assign a rollback owner.
4. Check recovery in a safe environment.
5. Record remaining impact on data, migrations, and integrations.
6. Then let the approver make a separate go or no-go decision.