Audit evidence for AI-written code
What gets recorded#
Every pull request is checked against your specs and guardrails, and the verdict lands as a check on the merge. Each decision records who reviewed, what was found, how it was resolved, and when.
- A recorded, independent review on every pull request
- Findings and resolutions retained per change
- Timestamps showing when review happened
- Exports suitable for SOC 2 change-management evidence
Why this matters where merges are consequential#
Prelint matters most where a merge can break more than a build — open infrastructure, industry alliances, the critical energy sector, and large open-source projects. In those settings product alignment is a security, compliance, and communications requirement, not a preference. That is why those teams run review on every change rather than sampling.
The control AI coding workflows are missing#
AI agents merge faster than human reviewers can read. Sampling-based oversight stops being credible when most pull requests are machine-authored. A recorded review on every change keeps the evidence complete regardless of who or what wrote the code.
Related#
- Security overview — isolation, retention, and access
- Working with AI coding agents
- How reviews work