So a while back Gene Kim and a few others wrote up the Devops Audit Defense Kit, which talks about this exact scenario (There's a link in https://itrevolution.c

So a while back Gene Kim and a few others wrote up the Devops Audit Defense Kit, which talks about this exact scenario (There's a link in https://itrevolution.com/devops-audit-defense-toolkit/ https://itrevolution.com/devops-audit-defense-toolkit/, then see page 12). Gene Kim also wrote the Phoenix Project, which is worth checking out, even if it feels outdated now Essentially, SOX requires separation of duties, it doesn't specify what that separation of duties should look like. That separation of duties control is to reduce the risk than an engineer could deploy unauthorized code. The most common answer is to require an approval prior to deployment at the code review/pull request step, and having automated test suites doing the quality checks. If you do end up having a change approval board, then you want to get most code changes authorized as standard changes. Major product or feature launches would go through the change approval board, but minor features wouldn't need to go through it.