AI code review and compliance · mid-market
Adopt AI code review without rewriting your change-management control.
Your CC8.1 control says a qualified reviewer other than the author approves every production change. It did not anticipate agents opening forty PRs a day. PSCO keeps that control true: risk-tiered human review against a model of your codebase, Deep Review on sensitive paths, US-persons staffing, evidence pushed into Vanta, Drata or Secureframe, and a contract your procurement team will recognize. Pilot on five repos for sixty days.
The velocity push and the control it runs into.
Engineering wants agents opening and reviewing PRs across 20 to 200 repos. Security holds a SOC 2 Type II, often ISO 27001 or PCI, and a change-management control that names a human approver. Both are right, and the DIY answer, a path classifier, a weekly retroactive review, and a negotiation with each new auditor, costs more than it looks.
PSCO is that design, pre-negotiated and staffed, with the tiering encoded in a model you own. Your AI reviewers keep running; the Officer reads their findings before deciding; the evidence drops into the GRC tool your auditors already pull from.
What mid-market security teams ask for
Risk tiering
Attest, Standard and Deep tiers set by the packet from your model: sensitive paths, migrations, new trust boundaries, PRs over 1,000 changed lines. The tier is recorded in every attestation.
Deep Review on sensitive paths
Auth, crypto, payments, PII handlers, infrastructure, CI. Read in full by a senior Officer, fifteen to thirty minutes, $35 per Deep-tier PR with an optional monthly cap.
Evidence into your GRC tool
Attestations satisfy the PR-approval tests in Vanta, Drata and Secureframe. Monthly Evidence Pack in CSV and PDF. Read-only auditor access.
US-persons staffing
Every Officer is a US citizen or permanent resident working from the US, with citizenship verified and recorded. Nothing is routed offshore.
Least-privilege access, no code at rest
Two GitHub Apps so the first install asks for metadata and pull requests only. Diffs are held in memory for the review session and never stored. PSCO holds its own SOC 2.
Contract your procurement team will recognize
An MSA that defines the Approved Review as a control activity, a liability cap, the three guarantee commitments, a DPA, and a certificate of insurance.
The approved review
What your auditor samples.
A review in state Approve from the Officer's account, a required status check, and an attestation recording commit, model version, Officer, tier and a signed digest. Your AI reviewers' findings are on the same timeline, folded into the Officer's packet.
Rotate signing keys on deploy #482
Approvedacme/platformfeat/key-rotation→main· 2 commits · 6 files changed · +148 −61
coderabbit[bot] reviewed · 2 findings, both addressed in commit 2 · folded into the Officer's packet
copilot[bot] reviewed · 1 suggestion · cannot count as the independent approver
psco assigned jane-okafor-psco · Deep tier · sensitive path infra/deploy
jane-okafor-psco requested changes on commit 1 · Model §4.2 · TLS verification disabled · fixed in commit 2
jane-okafor-psco approved these changes
Reviewed against Security & Compliance Model v3. Required checks green. Read infra/deploy in full: the KMS call now pins the CA bundle, rotation is gated behind the existing KMS role, and the old key is revoked in the same release. Meets the model.
attestation · commit a3f9c1e · model v3 · officer PSCO-0147 · tier deep · 2026-11-09 14:30 ET · digest sha256:9b2e…41c7
- ✓ ci / build2m 11s
- ✓ tests4m 02s
- ✓ sast / semgrep48s
- ✓ secrets scan12s
- ✓ psco/approved — Officer PSCO-0147 · model v3Required
The control mapping
One table your GRC lead can paste into the control narrative.
| Framework | Control | What it asks | How PSCO satisfies it |
|---|---|---|---|
| SOC 2 (2017 TSC) | CC8.1 Change management | Changes are authorized, designed, tested, approved and implemented; auditors sample merged PRs for an approver other than the author | Named Officer approval on every PR; attestation record per PR; monthly Evidence Pack laid out for sample testing |
| SOC 2 (2017 TSC) | CC6.1, CC6.3 Logical access and segregation | Ability to change production is restricted and segregated | Branch protection requires PSCO approval and the psco/approved check; authors cannot self-approve; PSCO never merges or deploys |
| ISO/IEC 27001:2022 | A.5.3 Segregation of duties | Conflicting duties are segregated | Developer and approver are different people in different organizations, recorded on every change |
| ISO/IEC 27001:2022 | A.8.32 Change management; A.8.25 Secure development life cycle; A.8.28 Secure coding | Changes follow a controlled process; secure coding principles are applied | The model encodes the secure-coding rules and required gates; every change is checked against them before release |
| PCI DSS v4.0.1 | 6.2.3, 6.2.3.1 Code review before release | Manual reviews by "individuals other than the originating code author" who know secure coding, approved by management; "knowledgeable third-party personnel" allowed | Officers are qualified third-party reviewers; the Approved Review is the review; the customer's release owner merging is the management approval |
| HIPAA Security Rule | 45 CFR 164.308(a)(1)(ii)(B) Risk management; 164.308(a)(8) Evaluation | No explicit code-review rule; assessors expect documented SDLC controls proportional to ePHI risk | ePHI-handling paths are Deep Review by default; evidence of review on every change touching them |
| NIST SP 800-53 (FedRAMP); NIST SP 800-171 (CMMC Level 2) | AC-5 Separation of duties; CM-3 Configuration change control; SA-11 Developer testing; 800-171 3.1.4, 3.4.3 | Separate duties; track, review, approve and log changes with security impact analysis | US-persons-only reviewers; documented approval with security review on each change |
| SOX ITGC | Program change management | Developers cannot approve or promote their own changes | Independent approver on every change; Evidence Pack maps to change-population testing |
Works alongside
Whatever your teams already run.
PSCO recognizes Claude Code, Codex, GitHub Copilot, Cursor Bugbot, CodeRabbit, Greptile, Graphite Diamond, Qodo, Macroscope, Devin Review and every other tool that posts a review, a comment or a check run.
The guarantee · in the contract
The audit-acceptance risk sits with PSCO.
If the finding stands, 100% of fees paid for that audit period are refunded.
Every in-scope PR is decided by a named human before psco/approved turns green. Coverage published monthly.
A missed SLA earns a 10% credit per incident, capped at 50% of the month.
The pilot
Five repos. Sixty days. A defined audit-readiness outcome.
Discovery, a quote from your real repos, then a 60-day pilot on three to five repos with the model built on the kickoff call and the Evidence Pack delivered monthly. Expand to the full estate when the auditor has seen it.
Bring your control narrative and your auditor's last management letter. We will tell you on the call whether the mapping holds for your scope.