To require a second person to approve payment code on GitHub, combine a branch ruleset that requires pull requests and approvals with a CODEOWNERS file that names who owns the payment paths. Then turn on required code owner review so owners must approve changes to those files.
The two pieces
A ruleset sets what every change to a branch must satisfy. GitHub's rules reference says you can require that all changes arrive through a pull request, and that pull requests receive a specific number of approving reviews before merging. The approvals can be required from people with write permission or from a designated code owner.
A CODEOWNERS file says who is responsible for which code. GitHub's documentation says code owners are automatically requested for review when a pull request changes code they own, and that people with admin or owner permissions can require code owner approval before merging.
| Piece | What it does | What it does not do |
|---|---|---|
| Ruleset requiring a pull request | Stops direct pushes to the branch | Does not say who must review |
| Required approvals | Sets how many reviews are needed | Does not say which reviewers |
| CODEOWNERS | Names the owners of each path | Does nothing alone without required review |
| Required code owner review | Makes owner approval mandatory | Does not review the code for you |
Set it up
- Identify the payment paths: money movement, ledger code, payout logic, authorization checks, webhook handlers and key handling.
- Create a team for the owners. GitHub requires that code owner teams be visible and have write permission to the repository.
- Add a CODEOWNERS file mapping those paths to the team.
- In a ruleset for your main branch, require a pull request, at least one approval, and code owner review.
- Turn on dismissing stale approvals when new commits are pushed, so reviewers approve what actually merges. GitHub records the diff state at approval and can dismiss approvals when the diff changes.
- Add required status checks so tests must pass before merge.
Watch for these gaps
Draft pull requests do not automatically request code owners, according to the GitHub documentation. They are notified when the draft is marked ready for review. That is acceptable if merging requires owner approval anyway.
Approvals from the author do not count as a second person, so check whether your settings prevent self approval. Also confirm who can bypass the ruleset. If administrators can bypass it without a record, the control is weaker than it looks.
Another gap is ownership drift. Code owners must have write permission, and people change teams. Review the CODEOWNERS file when your team changes.
Be honest about what it proves
Two-person review is a control on the change process. It reduces the chance that one person's mistake or compromised account ships payment logic alone. It does not prove the code is correct. Pair it with tests and dependency checks, and keep records of approvals for anyone who later asks how changes are controlled.
A starter list for your CODEOWNERS file
Think in paths, not people:
- Directories for ledger and money movement
- Authorization and permission checks
- Webhook signature verification
- Encryption and key handling modules
- CI workflow files and deployment configuration
That last item matters. Anyone who can alter a workflow can often alter what gets deployed, so workflow files deserve owner review too.
Where Safeguard fits
Safeguard's policies, gates and guardrails apply at the pull request stage, alongside your repository rules, so dependency and vulnerability checks can run before a payment change merges. A free scan is available at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the gate and look at which checks must pass before the merge button unlocks.
Quick check
Does CODEOWNERS alone force a review?
No. You also need a rule that requires code owner review. Without it, owners are requested but not required.
Can the pull request author be the second person?
No. The point is a different person. Check your settings and bypass list so the rule holds in practice.
Sources
Last reviewed: 19 October 2026.
