EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 15·5 min read
"That's not SoC 2 compliant"
TL;DR
Amp's development process intentionally skips pull requests to enable continuous shipping, challenging the assumption that SOC 2 compliance requires them.
✦ Why It Matters
Evaluate your own development processes to ensure they align with risk management rather than outdated compliance assumptions.
Key Takeaways
- Understand that SOC 2 compliance doesn't require pull requests.
- Focus on risk management rather than standard processes.
- Evaluate your change management processes for efficiency.
- Consider alternative methods to manage risks effectively.
How It Works
Amp's approach allows all engineers to push to the main branch, with a focus on transparency regarding who has access and why. They established a set of controls that ensure changes are authorized, tested, and recorded, which satisfies SOC 2 requirements without traditional pull requests.