SOC 2 gate

Every change to a product inside the SOC 2 scope passes this gate in addition to the compliance ship gate. The compliance gate asks whether the change is lawful and honest. This one asks whether the change leaves the evidence an auditor needs.

For products outside the scope, the gate is recommended, not required. Running it anyway is how a product becomes eligible for the next examination.

The gate (every change)#

1. Change record: Is the change in a pull request against the protected default branch, with a description of what and why? CHG-01
2. Review: Will someone other than the author approve it? A coding agent is never the reviewer. If the author is a coding agent, the human who directed the agent is the author, and a different human approves. CHG-02, ACC-18
3. Tests and scans: Do CI tests, dependency scan, secret scan and static analysis pass? Is there a test for the behaviour this change touches? CHG-03
4. Deploy path: Will it reach production only through the pipeline from the merged branch? No scp, no editing files on the server, no restarting production processes by hand to pick up uncommitted code. CHG-04
5. Access: Does it add a user, role, key, service account, or permission? Is it least privilege, approved, and in the access review list? ACC-04, ACC-07
6. Secrets: No secret in code, logs, test fixtures, or the PR description? New secrets added to the secrets store with an owner and rotation date? ACC-13, ACC-14
7. Data: Does it move confidential data to a new place, vendor, or model? Is that place in the vendor register and the app's data map? CNF-01, CNF-02, VND-01
8. Logging: Do new security-relevant actions (sign-in, permission change, export, delete, admin action) write an audit log line without personal data or secrets? OPS-01
9. Availability: Does it change capacity, a dependency, a schema, or a scheduled job? Backup taken before a migration? Rollback known? CHG-08, AVL-01
10. Customer commitments: Does it change anything promised in the terms, DPA, SLA, or security page? If yes, the document changes in the same PR and customers are told if it is material. COM-04, COM-05
11. Infrastructure: Firewall, DNS, tunnel, cloud config changes reviewed like code? CHG-07

Emergency changes#

Allowed when production is down or data is at risk. Label the PR emergency, merge with whatever review is available, and complete a full review within 2 business days. An emergency change made directly on a server must be committed back to the repository the same day, or it will be overwritten by the next deploy and leave no trace. CHG-05

How an AI agent reports the gate#

Print this block after the COMPLIANCE GATE block, at the end of a task that touched an in-scope product:

SOC 2 GATE
change: PR <url or branch> | not yet opened (reason)
review: needs approval from <human other than author> | n/a (out of scope product)
tests: <ci checks run, test names added>
deploy: via pipeline after merge | not deployed
access: none | added <role/key> for <who>, least privilege, approval <ref>
secrets: none | stored in <store>, rotation <date>
data: no new location | <data> now flows to <vendor/system>, register updated
logging: n/a | audit log added for <action>
availability: no impact | migration with backup at <ref>, rollback <how>
commitments: unchanged | <document> updated
open: <anything the human must do before merge>

An agent never prints review: approved. Only a human can approve.