Controls and evidence Required

Prove every production change was reviewed

For every production deploy, keep a link to the commit, the pull request, an approval by someone other than the author, and the passing checks.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Protect the main branch as the main branch rule describes. Let the deploy job record the commit and pipeline ID. Once a quarter, a script lists every deploy and fetches its pull request and reviews from the code host API. Emergency changes without review get a review within one working day, recorded the same way. SOC 2 criterion CC8.1 and ISO/IEC 27001:2022 control A.8.32 cover change management.

Example

export const isIndependentlyApproved = (pullRequest, reviews) =>
  reviews.some(review => review.state === 'APPROVED' && review.user.login !== pullRequest.user.login);

def is_independently_approved(pull_request: dict, reviews: list[dict]) -> bool:
    return any(review["state"] == "APPROVED" and review["user"]["login"] != pull_request["user"]["login"]
               for review in reviews)

How to check

The quarterly script fails on any deploy without a merged pull request or a passing check run. It also fails without approval from someone other than the author.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/change-evidence.