Merge Record: SOX change-control evidence when an AI score approves the merge

The record-keeping product is not unclaimed. Kosli already sells cryptographic change-control evidence to banks and says it fingerprints its AI reviewers on every run. GitHub now lets Copilot approvals count toward merge requirements, and Entire captures the agent session behind each commit, so either could add an audit export. General ITGC evidence tools already gather pull request approvals for SOX. The verified gap is that nobody I found has an auditor-accepted position on whether an AI approval can count as the reviewer sign-off; most guidance still says keep a named human approver. I did not check closely what the evidence tools do with AI approvals, so the claim that none of them pack the AI reviewer's decision (model, version, threshold, score, tests) into the sample format auditors request is an inference, not confirmed. Threshold Drill looks open. The only seeded-bug work I found is benchmarks and evaluation guides for choosing a reviewer, and nothing runs recurring drills against the live scorer and keeps the results as evidence that the control works, which matters because auditors test whether automated controls are working. The best entry is probably drills as the main product with Merge Record as the export format, sold to public fintechs below the size where Kosli's bank deals happen. The risks are that Kosli adds drills cheaply, that GitHub or Entire adds logging and an export, and that auditors keep requiring a human approver, which would shrink the market.

• Kosli

  The closest competitor. A change-control evidence company focused on financial services, backed by Deutsche Bank (also a customer), and co-chair of the FINOS SDLC controls working group. In May 2026 it launched governance for AI-assisted delivery: policy-as-code, cryptographic evidence chains and automatic approval of low-risk changes. Its blog describes AI review runs saved as trails with the reviewer version fingerprinted on each run.

• GitHub Copilot code review approvals

  Since September 1, 2026, Copilot can submit opt-in approving reviews that count toward required approvals, limited to chosen file paths. This creates the AI-approved-merge problem, but I found nothing showing GitHub records the model, score or threshold in a form auditors would accept.

• Entire (Checkpoints)

  Thomas Dohmke's startup, $60M seed. Its open-source Checkpoints tool saves the full agent session behind each commit (prompts, tool calls, token usage) on a hidden git branch. That is the raw material for a merge record, and the company is well placed to add an audit export later.

• Microsoft SOX Change Management Testing Agent

  An auditor-side agent that pulls attributes from change tickets to fill in SOX change-management workpapers. It covers the testing step, not capturing what an AI reviewer did.

• Screenata / Scytale and ITGC evidence tools

  General SOX ITGC evidence collectors that gather pull request approvals, CI logs and deploy timestamps into audit packets. Nothing I read shows them handling the internals of an AI reviewer's decision.

• MergeWhy

  Seen only in an investor listing that read like auditor-facing evidence of why a change was made. A follow-up search found nothing, so this is unverified.

Checked 2026-10-27