Routed to Emergency CAB on Oct 4, 2026, 5:57 AM — risk 0.34. Out-of-cycle review by the emergency board. Re-run only if the underlying evidence has changed.
Signal 34 → Effective 60/100. Multi-veto Stack lifted band because 4 specialists blocking (Back-out, Downtime Impact, Connectivity Impact…).
Firewall rule update on production payment gateway — new PSP egress endpoint
We are updating the firewall ruleset on the production payment gateway to allow egress to a new payment service provider endpoint ahead of the Q4 settlement cutover. The change adds outbound rules on the perimeter firewall pair and updates the associated TLS inspection policy so the new PSP certificate chain is trusted. DNS conditional forwarding for the PSP domain is also being updated, and the load balancer health check target changes to the new endpoint. The firewall appliances are being moved to the vendor's current firmware release as part of the same window, since the TLS inspection feature we need is not available on the installed version. Transaction logging continues through the existing pipeline. Card data remains in scope for PCI-DSS. Some merchant-facing traffic may be briefly affected during the rule reload. Changes are managed in the network IaC repository. Checkout, order service, refunds batch and the merchant portal all route through this gateway.
Authenticating…
Intake complete: 3 TCR(s), 0 downstream CIs. Type=code_deploy. Historical failure rate raw=0.00 — 0/94 prior code_deploy changes failed.
Selected 6 specialist(s): ['connectivity_impact', 'security', 'infra_impact', 'backout', 'hardware_compat', 'downtime_impact']. The prose describes firewall rule and firmware changes affecting connectivity, security (PCI‑DSS), infrastructure, required backout plan, hardware compatibility, and brief downtime.
No scan target (no PR link, no declared software versions). Security cannot be assessed for this CR.
The change has no downstream blast radius and no window collisions, making it an isolated update. No impact concerns identified.
No back-out plan attached. A rollback procedure is required before approval for this change type.
The change request involves only firewall rule and firmware updates with no hardware component modifications. Hardware compatibility checks are not applicable, resulting in no concerns.
The change acknowledges possible brief traffic impact but fails to quantify downtime, does not document failover or redundancy, and provides insufficient detail on impact to tier‑1 customer‑facing services, which is a serious concern for a production payment gateway.
The firewall egress rule for a new PSP lacks explicit CIDR and port documentation, expands the blast radius at a tier‑1 boundary, and introduces a firmware upgrade on perimeter devices. These gaps raise serious security and compliance concerns that merit CAB attention before approval.
Each row is one check the AI ran. Importance is how much that check matters. Severity is what the AI found, on a 0–10 scale (0 = nothing concerning, 10 = serious). Points is how much it added to the risk score.
| Check | Importance | Severity | Points |
|---|---|---|---|
| Service criticality | 12% | 10/10 | 12 |
| Rollback feasibility | 8% | 9/10 | 7 |
| Downtime impact | 6% | 8/10 | 5 |
- 1.Service criticality added 12 of 34 points — severity 10/10, importance 12%
- 2.Rollback feasibility added 7 of 34 points — severity 9/10, importance 8%
- 3.Downtime impact added 5 of 34 points — severity 8/10, importance 6%
- highBack-out plan missing · from backout
- highDowntime not quantified · from downtime_impact
- highNo failover or redundancy documented · from downtime_impact
- highInsufficient impact analysis for tier‑1 services · from downtime_impact
- highMissing explicit CIDR and port definitions · from connectivity_impact
- + 2 more in the agent breakdown
- Multi-veto stack: 4 specialists fired HIGH findings — lifted to Emergency CAB
- Signal 'Service criticality' raw 1.00 ≥ veto threshold 0.70
- Signal 'Rollback feasibility' raw 0.90 ≥ veto threshold 0.70
Authenticating…
- CTASK0010004 · Network — Apply firewall ruleset and TLS inspection policy
- CTASK0010005 · Software — PCI-DSS scope review and PSP certificate validation
- CTASK0010006 · Database — Validate checkout and settlement flows post-cutover
# CAB Review Pack — CHG0030034
**Change:** Firewall rule update on production payment gateway — new PSP egress endpoint
**Business unit:** Network
**Requested by:** unknown
**Decision:** **route_emergency_cab** → Emergency CAB
**Risk:** high (score 0.34)
**Generated:** 2026-10-04T05:57:58Z
## Executive summary
This CAB request proposes a firewall rule update on the production payment gateway to allow egress to a new PSP endpoint, requiring immediate emergency approval (route_emergency_cab, risk score 0.34).
Key risk drivers include a multi‑veto stack of four specialist findings, service criticality at 1.00, rollback feasibility at 0.90, and downtime impact at 0.80—all exceeding veto thresholds and justifying emergency status.
Critical findings—no artefact scanning, missing back‑out plan, unquantified downtime, lack of failover documentation, and insufficient tier‑1 impact analysis—must be resolved before deployment.
## Top risk drivers
- VETO: Multi-veto stack: 4 specialists fired HIGH findings — lifted to Emergency CAB
- VETO: Signal 'Service criticality' raw 1.00 ≥ veto threshold 0.70
- VETO: Signal 'Rollback feasibility' raw 0.90 ≥ veto threshold 0.70
- Service criticality (weight 12%, raw 1.00)
- Rollback feasibility (weight 8%, raw 0.90)
- Downtime impact (weight 6%, raw 0.80)
## Evidence
- **intake** (succeeded, score 0.00): Intake complete: 3 TCR(s), 0 downstream CIs. Type=code_deploy. Historical failure rate raw=0.00 — 0/94 prior code_deploy changes failed.
- **agent_planner** (succeeded, score 0.00): Selected 6 specialist(s): ['connectivity_impact', 'security', 'infra_impact', 'backout', 'hardware_compat', 'downtime_impact']. The prose describes firewall rule and firmware changes affecting connectivity, security (PCI‑DSS), infrastructure, required backout plan, hardware compatibility, and brief downtime.
- **security** (succeeded, score 0.00): No scan target (no PR link, no declared software versions). Security cannot be assessed for this CR.
- **backout** (succeeded, score 0.90): No back-out plan attached. A rollback procedure is required before approval for this change type.
- **hardware_compat** (succeeded, score 0.00): The change request involves only firewall rule and firmware updates with no hardware component modifications. Hardware compatibility checks are not applicable, resulting in no concerns.
- **infra_impact** (succeeded, score 0.00): The change has no downstream blast radius and no window collisions, making it an isolated update. No impact concerns identified.
- **downtime_impact** (succeeded, score 0.80): The change acknowledges possible brief traffic impact but fails to quantify downtime, does not document failover or redundancy, and provides insufficient detail on impact to tier‑1 customer‑facing services, which is a serious concern for a production payment gateway.
- **connectivity_impact** (succeeded, score 0.80): The firewall egress rule for a new PSP lacks explicit CIDR and port documentation, expands the blast radius at a tier‑1 boundary, and introduces a firmware upgrade on perimeter devices. These gaps raise serious security and compliance concerns that merit CAB attention before approval.
- **service_criticality** (succeeded, score 1.00): Highest-criticality CI touched: Tier 1 (customer-critical). prod-payment-gw-01
- **change_window** (succeeded, score 0.30): Planned on a weekend slot — slightly elevated risk.
- **coordination** (succeeded, score 0.45): 3 teams must coordinate: Database, Network, Software. 3 TCRs in flight.
- **arbitrator** (succeeded, score 0.00): [confirmed] The verdict is unambiguously correct. This is a Tier-1 production payment gateway change (PCI-DSS in scope) involving perimeter firewall rule changes, a TLS inspection policy update, and a firmware upgrade on the firewall pair — with a completely empty back-out plan. Four independent specialists fired HIGH findings (backout 0.90, downtime_impact 0.80, connectivity_impact 0.80, service_criticality 1.00), and the decision step correctly applied the multi-veto stack lift plus the service-criticality and rollback-feasibility severity vetoes to route to Emergency CAB. No specialist re-run could plausibly lower the band: the missing back-out plan alone is a veto, and the Tier-1 criticality alone is a veto. The security specialist's 0.00 ('no scan target') is the only soft spot, but re-running it could only raise risk further, not lower it — the band is already at the maximum routing severity short of reject, so the outcome is defensible regardless. Confirm and move on.
## Back-out plan
## Audit trace
- intake: 90 ms, in=0/out=0 tokens
- agent_planner: 1588 ms, in=962/out=325 tokens
- security: 0 ms, in=0/out=0 tokens
- backout: 0 ms, in=0/out=0 tokens
- hardware_compat: 1027 ms, in=750/out=177 tokens
- infra_impact: 1659 ms, in=542/out=124 tokens
- downtime_impact: 1979 ms, in=789/out=506 tokens
- connectivity_impact: 2467 ms, in=765/out=648 tokens
- service_criticality: 0 ms, in=0/out=0 tokens
- change_window: 0 ms, in=0/out=0 tokens
- coordination: 0 ms, in=0/out=0 tokens
- arbitrator: 10742 ms, in=2151/out=689 tokens