Can someone, anyone, explain to me how this passes SOX scrutiny? I have issues with business/product team even commenting on PRs because auditors have said tha

Can someone, anyone, explain to me how this passes SOX scrutiny? I have issues with business/product team even commenting on PRs because auditors have said that access to GitHub=Access to Codebase. There are a select few people I would consider granting access to code within our product teams, but without "segregation of duties" clearly defined, I don't think it would fly.