✓ Survived Rank 2 of 14 proposedIndie Security Oct 17, 2026

Human-review attestation for agent-authored pull requests

Audit-grade proof that a human actually reviewed each agent-written change, mapped to SOC2 controls, with re-approval on unvouched commits.

Open the discussion ↗

A ready-to-paste brief for Claude Code, Cursor or any coding agent.

I want to build a small, bootstrappable product. Help me plan and start the MVP.

Product: Human-review attestation for agent-authored pull requests
What it is: Audit-grade proof that a human actually reviewed each agent-written change, mapped to SOC2 controls, with re-approval on unvouched commits.
Who pays: Compliance-minded engineering leads and GRC managers at SOC2-bound SaaS companies adopting coding agents, $300–1,500/mo on the compliance/security budget
Closest alternatives: GitHub CODEOWNERS + branch protection, LinearB / Swarmia (eng metrics, not audit), Vanta/Drata (control checklists, no per-commit evidence)
The gap: Branch protection proves an approval click happened, not that a human meaningfully reviewed an agent-written diff; GRC platforms track controls but collect no per-commit review evidence. Nothing ties agent provenance, risk tier, review depth, and flag-activation events into an auditor-ready trail.
Why now: Enterprises are rolling out coding agents in 2025 while auditors are only now encountering agent-authored code; SOC2 reviewers are beginning to ask how human review is enforced, and no tooling answers it.
Moat to build toward: Becomes the system of record for review compliance; historical attestation data and auditor integrations create switching costs.
Biggest risk: GitHub or the GRC platforms (Vanta/Drata) add a native 'AI-authored code' control and evidence collector, absorbing the feature.

First three steps:
1. GitHub App that tags PRs as human- or agent-authored, enforces a second-human approval rule for agent PRs, and invalidates approvals on post-approval agent pushes
2. Evidence capture: records review time-on-diff, comments, and reviewer identity into an exportable, tamper-evident audit log mapped to SOC2 CC controls
3. Flag-activation hook: turning on a feature flag for agent-written code triggers a required review checkpoint

Start by asking me up to five questions about constraints (stack, budget, timeline), then propose the smallest version a paying customer would use, and scaffold it.

Overall6.4/10

Pain6

Willingness to pay6

Timing8

Gap6

Moat5

Feasibility8

For

Who pays

Compliance-minded engineering leads and GRC managers at SOC2-bound SaaS companies adopting coding agents, $300–1,500/mo on the compliance/security budget

What people said · 2

Questions how author-only approval passes SOC2, noting their auditor required at least one other human to review code, and raises insider-threat concerns. Read the comment ↗
Points out that flag-gated 'low risk' merges defer real risk to flag activation, which current review tiers don't capture. Read the comment ↗

Paraphrased from the discussion. Follow the links for the original comments.

Competitors and gap

GitHub CODEOWNERS + branch protectionLinearB / Swarmia (eng metrics, not audit)Vanta/Drata (control checklists, no per-commit evidence)

Branch protection proves an approval click happened, not that a human meaningfully reviewed an agent-written diff; GRC platforms track controls but collect no per-commit review evidence. Nothing ties agent provenance, risk tier, review depth, and flag-activation events into an auditor-ready trail.

Why now

Enterprises are rolling out coding agents in 2025 while auditors are only now encountering agent-authored code; SOC2 reviewers are beginning to ask how human review is enforced, and no tooling answers it.

Moat · 5/10

Becomes the system of record for review compliance; historical attestation data and auditor integrations create switching costs.

Against

Red team: Auditors are only now meeting agent-authored code and no tool ties agent provenance to per-commit human-review evidence for SOC2, though GitHub could close much of the gap with provenance features.
What would kill it: GitHub or the GRC platforms (Vanta/Drata) add a native 'AI-authored code' control and evidence collector, absorbing the feature.

Start

First three steps: GitHub App that tags PRs as human- or agent-authored, enforces a second-human approval rule for agent PRs, and invalidates approvals on post-approval agent pushes
Evidence capture: records review time-on-diff, comments, and reviewer identity into an exportable, tamper-evident audit log mapped to SOC2 CC controls
Flag-activation hook: turning on a feature flag for agent-written code triggers a required review checkpoint
Source discussion: How the Claude Code team does code review ↗ 447 points438 commentsFrom the commentsLinked article

For

Against

Start

More from this issue