The first SOC 2 audit I sat in on with an engineering team went sideways in about eleven minutes. Not because the pipeline was bad. It was a good pipeline. Trunk-based, tests gated on merge, deploys on green, everything in Terraform. The kind of setup an engineering lead is quietly proud of. The auditor asked one question: "Show me that the code deployed to production on 14 March was reviewed by someone other than the person who wrote it." Long pause. Everyone knew the answer was yes. N...