Passed a regulatory audit with segregation-of-duties policies enforced in the pipeline.

Every audit began with a two-week evidence-gathering exercise. Proof that the person who wrote a change was not the person who approved it lived across screenshots, ticket comments and email threads, assembled by hand each time. The control existed and was genuinely followed — it simply could not be demonstrated quickly, and an auditor's question about a specific change six months ago could take days to answer.

Segregation of duties became a policy the pipeline enforces rather than a convention people follow: the author of a change cannot approve its promotion, and production requires an approver from a named group mapped out of Okta. Deploy credentials are issued per promotion from Vault and expire, so a standing production credential no longer exists. Every promotion records the checks, the approver and the diff, retained for two years.

The audit passed with the pipeline itself submitted as the control evidence. A query about any individual change is answered from the release record in seconds rather than days, and every change in the retention window is attributable to a named approver.