Approval required
An agent proposes a change covered by the policy.
Acceptance target: The protected path waits for the named reviewer.
Pilot example
One workflow.
A clear test.
Evidence you can review.
Illustrative pilot · not a customer case study
A team already reviews changes before deployment. It wants a portable record of who authorized each selected commit. Here is how a scoped GitHub pilot could test that requirement.
Discuss a workflow like this
One workflow. A clear scope. Pricing agreed before work begins. · 30 days · one gate
Engagement briefIllustrative
One GitHub workflow.
Can your reviewer verify who authorized the selected commit?
One workflow. A clear scope. Pricing agreed before work begins.30 days · one gate
- 01 Agree the scope
- 02 Test the configured path
- 03 Review the evidence
Proposed work. Acceptance criteria agreed before kickoff.
Before kickoff
A shared scope. A clear starting point.
What gets configured
- One gate: money out, agent code to prod, infra changes, PII or PHI export, or identity changes
- One repository or MCP client, in your environment
- Named signers and acceptance criteria agreed on day one
- Required checks and deployment rules for the selected path
- Receipt inspection and independent verification steps
What your team brings
- A workflow owner and a GitHub administrator
- Named approvers and access to a test environment
- A specific evidence requirement and someone who can judge it
- Agreement on test cases and acceptance criteria before kickoff
The test plan
Agree on what a useful result looks like.
These are proposed acceptance tests, not reported results. Enforcement depends on the integration version, configuration, and bypass permissions. Findings may include gaps that need further work.
Denied request
The reviewer denies that request.
Acceptance target: The selected action stays blocked on the configured path.
Approved request
The reviewer approves a fresh request for the intended commit.
Acceptance target: The gate recognizes that authorization and produces the expected receipt.
Changed commit
The commit changes after approval.
Acceptance target: The earlier approval cannot authorize the new change.
Service unavailable
The authorization service is unavailable during a test.
Acceptance target: Observe the actual behavior, compare it with the agreed requirement, and record any gap.
Evidence review
The reviewer inspects the artifact and verifies its signature.
Acceptance target: The record matches the action, approver, policy, and time; verification is reproducible.
The handoff
Leave with a reviewable evidence pack.
Workflow configuration
Test results
Signed artifacts
Acceptance readout
The agreed deliverables include the workflow configuration, test results, signed artifacts with verification instructions, and an acceptance readout documenting findings and open gaps. Your reviewer decides whether the evidence meets the requirement.
The 30-day clock starts once agreed access is available. Continuing after day 30 is the Annual plan; nothing auto-renews. This example does not promise certification, auditor acceptance, or coverage of other execution paths.