Implement a manual approval gate for production deployment in pipeline-as-code

WHAT THIS TESTS: The interviewer wants to know if you understand that manual approval is not an escape hatch from automation but a controlled, auditable stage within it. They are looking for governance patterns that prevent unilateral production changes while keeping the pipeline as the single source of truth. This includes identity, authorization, timeouts, observability, and failure handling.

A GOOD ANSWER COVERS: First, define the gate in code, not in a side channel. In Azure Pipelines this means using pre-deployment conditions or environment protection rules; in GitHub Actions or GitLab CI it means environment reviewers or protected environments. Second, bind the approval to identity and least-privilege RBAC so only specific users or groups can grant approval, and require that the approver is not the same person who triggered the deployment. Third, set technical boundaries: a timeout so the deployment does not wait indefinitely, an escalation path such as paging an on-call rotation, and a re-evaluation policy if health signals change while waiting. Fourth, ensure auditability by logging who approved, when, and under what pipeline run ID, storing these logs immutably outside the pipeline workspace. Fifth, pair the gate with automated safety mechanisms such as rollback on timeout or automated post-deployment health checks so the human gate does not become a single point of failure.

COMMON WRONG ANSWERS: Saying you would have someone run a script locally to approve or deploy. Proposing an approval via email or chat with no programmatic enforcement in the pipeline. Ignoring timeout and escalation, which means a deployment can stall forever. Treating approval as a replacement for automated testing or canary analysis. Failing to mention audit trails or non-repudiation requirements.

LIKELY FOLLOW-UPS: How do you prevent an approver from approving their own change? What happens if the approver is unavailable for four hours? How would you implement this in a multi-region deployment where each region needs separate sign-off? Can you automate the approval away once certain SLOs are met?

ONE CONCRETE EXAMPLE: In Azure Pipelines you enable a gate in the pre-deployment conditions of a production stage. You configure an Invoke REST API gate or a manual approval gate tied to an Azure DevOps environment with protection rules. You set a delay before evaluation to allow incident management systems to log any new priority-zero bugs, then require approval from the Release Managers group. You configure a timeout of sixty minutes and re-evaluation every five minutes so that if Azure Monitor alerts fire during the wait, the gate fails and the deployment halts. All approvals and gate outcomes are written to the pipeline run logs and retained according to compliance policy.

Source: learn.microsoft.com