Claire Vo: Automating PR Merges and SOC 2 Audits

Key Takeaways

• Claire Vo built two specialized Grok Bots, named 'Look Good To Me' and 'Lockdown', to automate engineering management and SOC 2 compliance.
• 'Look Good To Me' clears stacked GitHub pull requests by triaging review comments, rebasing branches, and spinning up Cursor cloud agents to write code fixes.
• Vo cleared roughly 50 backlogged pull requests in a single Friday run by letting the bot handle routine triage and reviews.
• 'Lockdown' logs directly into a compliance dashboard, tracks monitors against SLAs, converts security alerts into GitHub PRs, and tracks offboarding tasks.

The Method

Most founders treat AI agents as conversational toys. Vo turned them into operational managers that handle two major productivity killers: engineering code review backlogs and continuous SOC 2 compliance.

Her first agent, 'Look Good To Me', handles GitHub maintenance. Code reviews stall when branches get out of sync with main or when minor reviewer comments sit untouched. Vo built the bot to scan open pull requests daily. As Vo describes it, the bot “goes through my PRs and sees what needs to be merged, what needs to be closed, what needs to be rebased, responds to comments, sends Slack, and does all the things to just basically be like an annoying engineer manager.”▶ 20:35

Instead of just pinging humans, the bot acts. When a branch needs a rebase or a minor revision, it assigns the work to Cursor cloud agents. “Grok Bot can kick off Cursor cloud agent coding jobs, and so you can see here that these rebases or feedback on different PRs can be done by Cursor,”▶ 21:19 Vo explains. During one Friday session, she used this setup to clear 50 pending PRs that were waiting on her review.

Her second agent, 'Lockdown', automates compliance operations. SOC 2 audits fail when teams fall behind on evidence collection, vendor access reviews, or security patches. Instead of hiring an external consultant or forcing engineers to manage checklists, Vo uses 'Lockdown' to run routine audits. “What this SOC 2 control bot does is it actually logs into that dashboard we use to manage our SOC 2 controls, looks through all the controls, makes sure that none of them need human attention,”▶ 22:31 Vo says.

When 'Lockdown' detects a code vulnerability, it opens a pull request with a remediation patch. When it finds an operational requirement, like offboarding a contractor or revoking unused access, it assigns a direct task to the right person. As Vo puts it, “We can put AI to work or we can have AI put us to work in a more effective way. And I really think that having AI put me to work against our SOC 2 controls and our compliance and security position is really nice.”▶ 23:21

Where This Breaks Down

This method fails when an organization lacks clear automated test suites or strict permission boundaries.

If your test coverage is weak, letting an autonomous bot trigger code updates and rebase branches will introduce silent regressions into production. Automated PR closers require deterministic integration tests and strict CI checks before any merge happens.

For compliance, bots only work if your tools offer clear dashboards or predictable interfaces. If vendor access management requires undocumented manual requests, an agent will stall. Autonomous compliance requires clean systems of record before you can delegate the monitoring.

What to Do With This

Audit your GitHub repository this week for PRs that have been open for more than five days. Identify every PR blocked purely on a merge conflict, a rebase, or a formatting comment. Connect a routine or cloud agent script to trigger Cursor on those branches, resolve the conflicts automatically, and run the test suite.