Compare
GitHub’s branch protection, rulesets and environments are a good start, configured repo by repo inside GitHub. Aspian Cloud applies one rulebook across every repo, deploy tool, contractor and agent, and proves what reached production.
Checked on 8 November 2026 against GitHub’s built-in rules sources linked in each row. Products change; follow each source before relying on a row.
- What it is
GitHub’s built-in rules
Native repository and Actions controls: branch protection rules, rulesets, deployment environments with protection rules, and an organization audit log.
docs.github.comAspian Cloud
Change control for software: it approves, records and proves every production change, made by people, contractors or AI agents, on any deploy tool.
/product- Approval workflow
GitHub’s built-in rules
Branch protection can require a set number of approving reviews, code owner review, dismissal of stale approvals, and approval of the latest push by someone other than the pusher. Admin bypass is on unless disabled.
docs.github.comAspian Cloud
Built in. Policy approves routine changes; risky ones go to named approvers with the full card, by Slack, Teams, WhatsApp or email. The requester can never approve.
/product/approvals- Rules across repos
GitHub’s built-in rules
Docs state that rulesets are available on GitHub Team and Enterprise plans, with bypass lists by role, team or app. The 'Evaluate' (dry-run) enforcement status is only available with GitHub Enterprise.
docs.github.comAspian Cloud
One pack across every repo and tool, with Evaluate before Block on every tier.
/product/how-it-works- Production approvers
GitHub’s built-in rules
Up to six required reviewers per environment, one approval needed, optional prevent self-review. On Free, Pro and Team, required reviewers, wait timers and custom protection rules work only in public repositories.
docs.github.comAspian Cloud
Named approvers on any plan, private repos included, approving with a passkey.
/product/approvals- Deployment gates
GitHub’s built-in rules
Custom deployment protection rules are GitHub Apps that approve or reject a gated Actions job via API. Docs label them public preview and subject to change.
docs.github.comAspian Cloud
Aspian is the custom protection rule where GitHub allows one, and gates at the deploy target where it doesn’t.
/integrations/github- Approval bound to the change
GitHub’s built-in rules
Reviews attach to a pull request, and stale-approval dismissal resets them when the diff changes. Binding that approval to the artifact later deployed was not found in public docs.
docs.github.comAspian Cloud
A passkey signature over the change’s hash. If the change moves after approval, the approval no longer counts.
/product/approvals- Deploy tools covered
GitHub’s built-in rules
Environment protection rules gate GitHub Actions jobs that reference an environment. Gating a deploy run outside Actions, such as a manual CLI deploy from a laptop, was not found in public docs.
docs.github.comAspian Cloud
GitHub, GitLab, Bitbucket, Vercel, Netlify, Cloudflare, AWS and Kubernetes, each at Observe, Gate or Hold, stated per integration. Hold covers deploys made outside any pipeline.
/integrations- What is actually running
GitHub’s built-in rules
Not found in public docs: no built-in comparison of what is running in production against the approved commit.
docs.github.comAspian Cloud
Signed snapshots by artifact fingerprint, a drift item within minutes for anything unapproved, and Unknown never shown as compliant.
/product/runtime-proof- Evidence anyone can verify
GitHub’s built-in rules
The organization audit log covers 180 days of member actions, exportable as JSON or CSV. API access to the audit log is documented for Enterprise Cloud.
docs.github.comAspian Cloud
Hash-chained, signed hourly, with RFC 3161 timestamps; a published method lets an auditor verify offline without Aspian access.
/product/audits- Pricing
GitHub’s built-in rules
Included in GitHub plans, but key protections for private repos need paid tiers: rulesets are documented for Team and Enterprise; environment reviewers, wait timers and custom rules are public-repo-only on Free, Pro and Team; Evaluate mode needs Enterprise.
docs.github.comAspian Cloud
Published. Scan and Observe free; Team $24 / £18 / €21 / ₦15,000 a month; Business from $375 / £290 / €340 / ₦150,000.
/editions
When GitHub’s built-in rules fits better
- Small teams whose code and deploys all live in GitHub and GitHub Actions, where native branch rules and environment reviewers are enough and cost nothing extra.
- Open-source or public repositories, where environment reviewers, wait timers and custom protection rules are available on every plan.
- Enterprise Cloud customers who only need merge-time review controls and a platform audit log, not runtime verification.
Running both
- 1Keep your branch protection: the scan checks it and fixes gaps in one click.
- 2Add Aspian as a deployment protection rule where GitHub allows one.
- 3Gate at the deploy target for private repos on plans where GitHub’s environment rules don’t apply.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.