Because the code is written in pairs, there’s two pairs of eyes on all code. I’m not familiar with SOC 2 specifically, but that’s sufficient for other security

Because the code is written in pairs, there’s two pairs of eyes on all code. I’m not familiar with SOC 2 specifically, but that’s sufficient for other security controls I’ve seen. The purpose of this review is to create consistency across their large number of services. It’s really just a convoluted way of using GitHub’s PR system rather than doing a diff and talking it over. Personally, I think it’s overly complicated, but I think the root cause of that complexity is having over 40 microservices owned by a single team, each in its own repo. It’s resulted in a lot of boilerplate, aka duplication, that they might be able to factor out if they used a monorepo. (Or a modular monolith.)