Compliance, wie sie wirklich im Code erscheint.
Field Notes zu alltäglichen Pull Requests, die leise einen Control brechen, und Engineering dazu, wie wir einen Compliance-Reviewer bauen, dem man vertrauen kann.
- Field notes
The TLS floor someone dropped to fix staging
Certificate verification gets turned off to unblock a self-signed cert in staging. The flag lives in a shared client, so it ships everywhere else too.
- Engineering
The approval still looks the same. The written rule does not.
Ayoub Fandi's new GRC Engineer issue is about PR-approval screenshots decaying under agent velocity. He is right. The control you will rewrite this quarter can still sample that screenshot, and the rule that says who must review can die in the same week.
- Engineering
Three risk entries. Only one can be quantified.
CTRL+F on the rebuilt GRC Engineer site turns GRC engineering into a daily two-minute rep. Tuesday's puzzle is about risk registers that wear costumes. heygrc is the complementary read at the pull request.
- Engineering
SOC 2 never said a human has to approve your pull requests
The change-management criterion asks that changes are authorized, tested, and approved through a process you wrote down. It does not say by whom. The real blockers are separation of duties, the policy, the evidence, and the fact that a green code review is not a compliance review.
- Engineering
Shift compliance left
Security shifted left, into the pull request. Most compliance work still waits for the audit, and controls drift one commit at a time in between.
- Engineering
The third question a pull request asks
Is the code correct? Is it secure? Does it still meet the frameworks you are audited on? Three different questions, and the third rarely has an owner.
- Engineering
Cite the exact clause, or say nothing
A compliance finding you cannot verify is worse than silence. The unit of trust is the clause.
- Engineering
The control-breaking five
The five pull-request patterns we built heygrc to catch first. Each one looks like a reasonable change, and each removes a control a framework depends on.
- Field notes
The one-line PR that quietly broke ISO 27001 A.8.15
Compliance does not fail in the audit. It fails in a five-line pull request that looked like a cleanup.
- Field notes
Your AI agent doesn't read your SOC 2 policy
Coding agents write code that compiles, passes tests, and quietly widens a control. The policy PDF is not in their context window.
- Engineering
False positives are the only metric that matters for a compliance bot
A reviewer that cries wolf gets muted, and a muted reviewer catches nothing. For a compliance tool, precision is the whole game.
- Field notes
The EU AI Act is a code review, whether you like it or not
For high-risk AI systems, the Act's obligations are not policy. They are properties of the running system, decided in a diff.