Works with · Claude Code · Anthropic

Does a Claude Code review count as the approval for SOC 2?

No. A Claude Code review, whether from Claude Code Review or the Claude Code GitHub Action, is a bot comment on the pull request. It is useful evidence that the change was examined; it is not an approval by a qualified person other than the author, which is what a SOC 2 auditor samples for under CC8.1. PSCO adds that person: a named Officer reads the PR, including what Claude posted, and signs the Approved Review.

How Claude Code reviews

Claude Code Review runs on each push, reads the diff in the context of the repository, and posts review comments with reasoning and suggested fixes. The Claude Code GitHub Action can also run a verification step that executes tests or scripts and reports the result as a comment or a check.

What it cannot do

Claude Code cannot be the independent human approver an auditor is looking for. SOC 2 CC8.1, ISO 27001 A.5.3, PCI DSS 6.2.3.1 and SOX program-change controls all assume a qualified person other than the author approved the change and understood it. A bot account posting "Approve" is a review record, not an accountable person, and as of mid-2026 no auditor reports accepting it as standard practice.

How PSCO reads its output

PSCO recognizes the Claude bot logins, parses each review comment and verification result into a structured finding (path, line, severity, summary), and folds them into the Officer’s packet. The Officer sees every Claude finding before deciding and the attestation records that Claude reviewed the PR.

Recognized asbot logins

claude[bot]Review comments · Verification step output

claude-code[bot]

anthropic-claude[bot]

Two-step setup

Keep Claude Code.

Keep Claude Code Review or the Claude Code GitHub Action running exactly as it is. No change to its configuration is required.

Add PSCO.

Install the PSCO GitHub App, pick the repos in scope, and add one required approval from @psco-officers plus the psco/approved check to branch protection. PSCO verifies the setting.

The shared-model tip

Point it at the same model the Officer uses.

Point Claude Code at the same rulebook the Officer uses. Add a section to CLAUDE.md that references psco.model.yaml, or paste the model’s forbidden patterns and sensitive paths into it. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.

psco.model.yamlv1 · customer-owned

frameworks: [soc2, iso27001]
sensitive_paths:
  auth/**: deep
  infra/**: deep
required_checks: [ci, tests, sast, secrets]
forbidden: [hardcoded_secret, tls_verify_off]

Other reviewers

Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All

Keep Claude Code. Add the human who signs.

Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.

Get a quote in 2 minutes Book a meeting