## TL;DR

The allowlist tunes the scanner; production policy is a separate, stricter gate. Run both: the scanner with its allowlist for triage, and the policy check as the deploy gate, and reconcile the two lists.

## Error

```text
agent's scan passed the allowlist but failed production policy: config error
```

## Steps

1. Read the production policy failure: which rule fired that the allowlist suppressed. Expected: the gap named.
2. Decide: is the policy right (then the allowlist entry is wrong) or is the policy too strict (then request an exception). Expected: a verdict.
3. Align the two: allowlist entries that violate policy need policy exceptions, not silent scanner passes. Expected: one consistent story.
4. Run the policy check in CI before deploy, not just the scanner. Expected: the gate enforced.
5. Review allowlist versus policy quarterly; they drift. Expected: no silent divergence.

## When to use

- Allowlist passes but policy fails.
- Designing two-tier secret controls.

## When not to use

- Scanner misconfiguration (fix the scanner).
- Policy is simply wrong (change the policy).

## Tool compatibility

- Scanner allowlists; policy engines.

## Variant phrasings

### allowlist passed but policy failed

Reconcile the tiers.

### scan clean, deploy blocked

Policy is the gate.

## Why it happens

Two systems with two exception lists diverge; each thinks the other approved.

## Edge cases

- Emergency exceptions need expiry, or they become permanent.
- Policy checks must run on the same content the scanner saw.
- Document which tier owns which decision.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Tu9WLQUMZbqziqvs7Ol0Yw