The problem
“Show me how this change was reviewed.”
Compliance reviewers ask for evidence that a change was reviewed, against which policy, and why any exception was made. Teams need that answer ready for every merged change — available on request, rather than reconstructed after the fact.
Having it on hand for any commit is what turns an audit from a scramble into a lookup.
How it works
A complete, append-only record.
Every gate decision is recorded and bound to the change it judged. When a team chooses to ship past a finding, the override is captured too — a named person and a reason drawn from a defined set, appended to the same record.
For any merged change you can show who reviewed it, against which policy, on which commit, and the reason for any exception. The record is append-only, so the history stays intact — and it maps directly to a SOC 2 change-management sample.
- Every decision is recorded and bound to the change it judged
- Overrides carry a named person and a reason from a defined set, appended to the record
- Append-only, so the history stays intact for review
- Ready to answer a SOC 2 change-management sample on any merged change
Evidence ready for your auditor.
Install the CLI for a local verdict, or turn on the GitHub App to gate every pull request.