Compliance, as it actually shows up in code.
Field notes on the ordinary pull requests that quietly break a control, and engineering on how we build a compliance reviewer worth trusting.
- Engineering
Three risk entries. Only one can be quantified.
CTRL+F on the rebuilt GRC Engineer site turns GRC engineering into a daily two-minute rep. Tuesday's puzzle is about risk registers that wear costumes. heygrc is the complementary read at the pull request.
- Engineering
SOC 2 never said a human has to approve your pull requests
The change-management criterion asks that changes are authorized, tested, and approved through a process you wrote down. It does not say by whom. The real blockers are separation of duties, the policy, the evidence, and the fact that a green code review is not a compliance review.
- Engineering
Shift compliance left
Security shifted left, into the pull request. Most compliance work still waits for the audit, and controls drift one commit at a time in between.
- Engineering
The third question a pull request asks
Is the code correct? Is it secure? Does it still meet the frameworks you are audited on? Three different questions, and the third rarely has an owner.
- Engineering
Cite the exact clause, or say nothing
A compliance finding you cannot verify is worse than silence. The unit of trust is the clause.
- Engineering
The control-breaking five
The five pull-request patterns we built heygrc to catch first. Each one looks like a reasonable change, and each removes a control a framework depends on.
- Field notes
The one-line PR that quietly broke ISO 27001 A.8.15
Compliance does not fail in the audit. It fails in a five-line pull request that looked like a cleanup.
- Field notes
Your AI agent doesn't read your SOC 2 policy
Coding agents write code that compiles, passes tests, and quietly widens a control. The policy PDF is not in their context window.
- Engineering
False positives are the only metric that matters for a compliance bot
A reviewer that cries wolf gets muted, and a muted reviewer catches nothing. For a compliance tool, precision is the whole game.
- Field notes
The EU AI Act is a code review, whether you like it or not
For high-risk AI systems, the Act's obligations are not policy. They are properties of the running system, decided in a diff.