Why Pull Requests Aren’t Required for SOC 2 Compliance
At Amp, engineers push directly to main and still passed SOC 2 because auditors care about documented change controls, not pull‑requests. The blog breaks down the exact controls they used and shows how small, high‑trust teams can meet compliance without adopting heavyweight processes. Scale the approach to your own risk profile.