# Change approval

URL: /systems/trust-and-governance/controls/change-approval · Id: `control:change-approval`

> Every definition reaches production only through a merged Change, approved by a Worker at the required lineage distance from its author.

Every definition reaches production only through a merged [Change](/business/nouns/change), approved by a [Worker](/business/nouns/worker) at the required lineage distance from its author.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC8.1](/systems/trust-and-governance/criteria/soc2/cc8-1) | The entity authorizes, designs, develops, configures, documents, tests, approves and implements changes to infrastructure, data, software and procedures. |
| [ISO27001 A.5.3](/systems/trust-and-governance/criteria/iso27001/a-5-3) | Conflicting duties and conflicting areas of responsibility are segregated. |
| [ISO27001 A.8.25](/systems/trust-and-governance/criteria/iso27001/a-8-25) | Rules for the secure development of software and systems are established and applied. |
| [ISO27001 A.8.32](/systems/trust-and-governance/criteria/iso27001/a-8-32) | Changes to information processing facilities and systems follow change management procedures. |

## Implemented by
- [Release](/workflows/processes/release)
- [Release a change](/workflows/processes/release/release-change)
- [Verification](/code/verification)
- [Change verdict](/code/verification/change-verdict)
- [Repositories](/code/systems/repositories)
- [Evals](/agents/evals-system)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every `Change.merged` Event in the report period. |
| Assert | Each Change has a passing verdict, a Decision, and an approver whose lineage distance from the author meets its stakes floor. |

## Owner
[Engineering Lead](/agents/engineering/engineering-lead), [Engineering Team](/agents/engineering).

## Example
An [Agent](/business/nouns/agent) authors a Change to a [SaaS](/products/templates/saas)'s [Price](/business/nouns/price) definition. A Worker of a different lineage approves it, the verdict passes, and only the merged Change reaches production.