Works with · Graphite Diamond · Graphite
Does Graphite Diamond count as the reviewer for SOC 2?
No. Diamond reviews each PR in a stack and posts comments from a bot account. It does not make the PR approved by a qualified person other than the author. PSCO reviews each PR in the stack with a named Officer and signs each one.
How Graphite Diamond reviews
Diamond reviews pull requests, including every PR in a Graphite stack, and posts comments with suggested changes on each push.
What it cannot do
Graphite Diamond cannot be the independent human approver an auditor is looking for. SOC 2 CC8.1, ISO 27001 A.5.3, PCI DSS 6.2.3.1 and SOX program-change controls all assume a qualified person other than the author approved the change and understood it. A bot account posting "Approve" is a review record, not an accountable person, and as of mid-2026 no auditor reports accepting it as standard practice.
How PSCO reads its output
PSCO treats each stacked PR as its own review, reads Diamond’s comments into the packet for that PR, and posts one Approved Review and one psco/approved check per PR, so merging the stack in order keeps every merge covered.
Two-step setup
Keep Graphite Diamond.
Keep Diamond on.
Add PSCO.
Install the PSCO GitHub App, pick the repos in scope, and add the psco/approved check and one approval from @psco-officers to branch protection.
The shared-model tip
Point it at the same model the Officer uses.
Point Diamond at the same rulebook the Officer uses. Add the model’s rules to Diamond’s custom rules so each PR in the stack is checked against them. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep Graphite Diamond. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.