How to land Trivy gates: block CRITICAL first, then canary HIGH by repo and environment, while handling base-image noise and exception TTLs. For DevOps and security ops — sustainable image/dependency vuln gates without freezing builds. Where uncertain, follow official docs and the current product version; do not assume undelivered capabilities.