Your agents merge hundreds of pull requests a month. Which one changes what you told your auditor?
heyGRC reviews pull requests against your frameworks and the policies you link to it, and flags the gap before merge.
A review, not a blocker. You decide what merges.
heygrcMediumAI system impact assessment not updated for model change
This PR changes the default model route for all new agent tasks to a new provider. It introduces a new subprocessor and data flow without visible evidence of transfer safeguards or an updated AI system impact assessment.
Fix Update the impact assessment and risk treatment before enabling it as the default route.
- Same reviewHighNew subprocessor live without visible transfer safeguards.
Compliance that lives where the code lives
Your policies and registers describe how the system works. Code changes that, hundreds of times a month. When agents write much of the code, nobody rereads the policy for each change, and the gap shows up at the audit.
We run it on ourselves
We build an AI compliance product. One of our repositories merged 812 pull requests in 30 days. heyGRC reviews them. The cases below are real findings from those reviews, trimmed, not invented.
- Switching AI models
The new model is live. The paperwork still describes the old one.
- Giving your agent more autonomy
Auto-approve changes how humans oversee your AI. Your impact assessment should know.
- Adding a vendor or an SDK
That new SDK may send personal data to a new processor. Who updated the record?
Your code reviewer reads the code. heyGRC reads what it changes in your compliance.