---
title: "Prove every production change was reviewed · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/controls-and-evidence/change-evidence
updated: 2026-10-20
licence: "All rights reserved"
---

# Prove every production change was reviewed

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)
- Rule: For every production deploy, keep a link to the commit, the pull request, an approval by someone other than the author, and the passing checks.
- How: Protect the main branch as the [main branch rule](https://agentwranglers.se/playbook/engineering/version-control-and-review/protect-the-main-branch) describes. Let the deploy job record the commit and pipeline ID. Once a quarter, a script lists every deploy and fetches its pull request and reviews from the code host API. Emergency changes without review get a review within one working day, recorded the same way. SOC 2 criterion CC8.1 and ISO/IEC 27001:2022 control A.8.32 cover change management.
- Check: The quarterly script fails on any deploy without a merged pull request or a passing check run. It also fails without approval from someone other than the author.

Example:

```js
export const isIndependentlyApproved = (pullRequest, reviews) =>
  reviews.some(review => review.state === 'APPROVED' && review.user.login !== pullRequest.user.login);
```

```python
def is_independently_approved(pull_request: dict, reviews: list[dict]) -> bool:
    return any(review["state"] == "APPROVED" and review["user"]["login"] != pull_request["user"]["login"]
               for review in reviews)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/change-evidence`.

- Previous: [Keep evidence where nobody can change it](https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store)
- Next: [Keep every policy short and owned](https://agentwranglers.se/playbook/compliance/controls-and-evidence/policies-owned)
- [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)