Amp公司创始人Will Dollman近日分享了该公司在SOC 2审计中的发现，澄清了关于合规性要求的常见误解。[1]根据SOC 2的信任服务标准，合规性并不强制要求采用Pull Request工作流，而是要求变更经过授权、测试、批准和记录。[1]
信任服务标准对代码管理的规定从未提及Git或Pull Request，而是聚焦于确保变更得到授权、测试、批准和记录。[1]根据标准的要求，代码审查本身并非SOC 2合规的强制项。[1]
作为一家20人规模的公司，Amp采取了无PR直推主分支的模式，但通过其他控制措施来满足SOC 2的合规标准。[1]这些措施包括提交签名验证和访问权限追踪等。[1]只要企业能够通过适当的控制和风险管理措施实现变更授权、测试、批准和记录，不同的开发工作流同样可以满足合规性要求。[1]
Amp founder Will Dollman clarified a common misconception about SOC 2 compliance standards, asserting that the framework does not require pull request workflows as a mandatory practice [1]. Instead, the Trust Services Criteria focus on ensuring that code changes are authorized, tested, approved, and documented [1].
Dollman explained that Amp, a 20-person company where all engineers have direct push access to the main branch, achieves SOC 2 compliance through alternative control mechanisms rather than adopting a pull request-based development model [1]. The company implements change authorization and verification through other means, such as commit signature verification and access tracking, to satisfy the regulatory requirements [1]. According to Dollman, code review itself is not explicitly mandated by SOC 2 criteria [1]. He emphasized that SOC 2 compliance fundamentally requires organizations to evaluate their specific risks and implement appropriate safeguards, rather than prescribing a single technical workflow [1].