Ayoub Fandi's new GRC Engineer issue is about change-management controls that still file a PR-approval screenshot while the approval itself means less. Agent output jumped. Review time did not. The green check still looks like 2020. What it attests does not.
He is right. We would add this. The move most teams will make is to put a human back on the PR. That still produces the same screenshot. It does not say what the human had to look at. And the written rule that says who must review billing, or payments, or anything with blast radius, can itself be commented out in a hotfix that everyone is happy to merge.
The screenshot cannot tell the two years apart
An approval on a pull request records that the workflow reached an approval step before merge. The screenshot does not record what the reviewer examined, how much attention they gave it, or which written rules they checked. That is still the artifact most change-management controls ask an auditor to sample, because it is the artifact the control definition still names.
Ayoub walks the decay from engineering's own reporting: more output, larger PRs, review as the new bottleneck. He points to a GitHub Blog article summarizing an external study: agent-authored changes showed more redundancy and technical debt, while reviewer sentiment was more neutral or positive. The screenshot your catalog still collects cannot tell those two years apart. The check is still green. The attention underneath it is not the same attention.
Putting a human back still files the same evidence
The tempting rewrite is to buy the time back: require a person, shrink the diff, add another approver. For some changes that is the right call. It is also the rewrite that leaves the control definition untouched. You still collect a screenshot of an approval. You still have not written down what that approval is allowed to attest.
Leftover review time, when you get it, goes to the questions code review already knows. Is the hotfix correct? Is it safe? Those are real questions. They are not the question 'did this change just delete the rule that a billing PR needs a domain owner.' A reviewer staring at invoice math will approve the CODEOWNERS edit as noise.
The kind of change
Treat this as illustrative: the kind of change that raises the question, not a customer incident. The hotfix in the rest of the PR can be clean. This line is the change-management rule going false.
# domain owners/infra/ @platform-owners-/billing/ @billing-owners+# /billing/ @billing-owners # unblocking the invoice hotfix/docs/ @docs-ownersNot a bug and not a vulnerability. CC8.1 is change management: changes authorized, reviewed, and approved through the process you wrote down. This line was the independent review for billing. Commenting it out means the next billing PR can merge on a generic approval. The screenshot will still exist. The written rule that billing changes need a domain owner will not.
Rewrite the control, not only the headcount
Ayoub's issue is a warning not to defend the PR ritual harder just because the screenshot still looks official. We agree. The extra failure is that the rewrite most teams will ship this quarter still asks for that screenshot, and the rule that defined the review can be edited away in a PR nobody read as a control change.
If you are rewriting change management for agent velocity, write down what 'reviewed' is allowed to mean, and treat edits to that definition as in-scope for the same control. A CODEOWNERS path, a required check, a CODEOWNERS exemption, a skip in branch protection: those are the control. They are not chore comments on a hotfix.
Where heygrc sits
heygrc is not the newsletter, the workshop, or a replacement for the bug and security reviews you already run. It is the layer that reads each pull request against the frameworks you picked and the context you gave it. When a change would make a change-management or review-path rule hard to defend, it says so on the diff. It does not merge anything. It asks the question on the pull request, before the audit samples a screenshot that no longer means what the control says it means.
Read Ayoub's issue. The decay of the screenshot is his. The extra question is what happens when you rewrite the control and still only collect the screenshot.