agent-governance-audit

Auditing AI-assisted changes for governance compliance involves verifying classification, approvals, merge authority, validation, security review, and closeout accuracy against primary evidence like PR metadata, timeline events, git history, and CI logs.

A primary-evidence audit for AI-assisted code changes verifies whether the actual merged pull request followed the required governance process instead of merely claiming it did. It catches missing approvals, improper merge authority, weak validation, and incomplete closeouts.

To verify merge authority and auto-merge rules in a pull request, you trace who armed auto-merge, what checks ran, and whether the closeout matches the primary evidence. This ensures human approval and auto-merge rules were respected during the change.

Yes, you can use governance audits for post-incident reviews, autonomy spot-checks, and closeout verification where process compliance matters more than code quality. They verify whether a closeout report matches the real record before expanding agent autonomy.

For a pull request governance audit, you need to provide the PR number or commit range plus the policy baseline date if known. The audit requires PR metadata, timeline events, git history, CI logs, and policy-in-force context to issue evidence-cited verdicts.

You should not use a governance compliance audit when evaluating code quality or technical implementation, as it focuses exclusively on process compliance. It is designed for verifying classification, approvals, merge authority, validation, and closeout completeness against primary evidence.