Intercom: auto-approval and auditability are compatible when evidence is built in
Intercom runs over 93% of pull requests across its two main codebases through agents, auto-approves over 19% with no human reviewer in the loop, and recorded zero reverts of AI-approved PRs in a controlled pilot of 100+ PRs. Their auditors, Schellman, confirmed the pipeline produces evidence that meets SOC 2, HIPAA, ISO 27001, ISO 42001, and AIUC-1.
AI-authored code reverts at roughly a tenth the rate of human-authored code in both codebases. Their sharpest observation cuts the other way: the product changes that did cause outages in the past "were all reviewed and approved by humans."
Intercom's framing is that the evidence an auditor expects is identical whether a human or an AI approved the change; "the 'who' may change, but the 'what' doesn't." Their conclusion, and this handbook's: "When you build for safety, compliance follows." Prove It Holds argues the same property in general form under evidence as a byproduct.