> What they ask for is that changes are authorized, tested, approved, and recorded — and pull requests are just one way of doing that.

I'm pretty unclear how approvals are ensured in your system?

Authorisation and recording are pretty much out-of-the-box with a version control system, CI can guarantee testing, but how are we demonstrating approval without any evidence of change reviews?