Works with · Macroscope
Does a Macroscope Approvability verdict count as approval for SOC 2?
No. Macroscope’s Approvability verdict can auto-approve low-risk PRs, and that is a merge-gate decision, not an audit-grade approval. An auditor wants a qualified person other than the author on the record. PSCO reads the verdict and the findings and adds the named Officer who signs.
How Macroscope reviews
Macroscope reviews each PR, posts findings, issues an Approvability verdict (and can approve low-risk PRs automatically), and runs Check Run Agents that post results as GitHub checks.
What it cannot do
Macroscope’s auto-approval cannot be the independent human approver. It is a useful risk signal and PSCO records it, but the accountable person is still missing until the Officer decides.
How PSCO reads its output
PSCO records the Approvability verdict and each finding on the Officer’s packet, and reads Check Run Agent results as required-check status. The attestation records the verdict alongside the Officer’s decision.
Two-step setup
Keep Macroscope.
Keep Macroscope on. You may leave auto-approval enabled; PSCO’s check gates the merge.
Add PSCO.
Install the PSCO GitHub App, pick the repos in scope, and add psco/approved and one approval from @psco-officers to branch protection.
The shared-model tip
Point it at the same model the Officer uses.
Point Macroscope at the same rulebook the Officer uses. Configure Macroscope’s rules from psco.model.yaml so its Approvability verdict and the Officer’s decision use the same sensitive paths. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep Macroscope. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.