Change approval
Every definition reaches production only through a merged Change, approved by a Worker at the required lineage distance from its author.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC8.1 | The entity authorizes, designs, develops, configures, documents, tests, approves and implements changes to infrastructure, data, software and procedures. |
| ISO27001 A.5.3 | Conflicting duties and conflicting areas of responsibility are segregated. |
| ISO27001 A.8.25 | Rules for the secure development of software and systems are established and applied. |
| ISO27001 A.8.32 | Changes to information processing facilities and systems follow change management procedures. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Change.merged Event in the report period. |
| Assert | Each Change has a passing verdict, a Decision, and an approver whose lineage distance from the author meets its stakes floor. |
Owner
Engineering Lead, Engineering Team.
Example
An Agent authors a Change to a SaaS's Price definition. A Worker of a different lineage approves it, the verdict passes, and only the merged Change reaches production.