The merge review (or pull request review) gives teams a regular place for guidance, validation, and knowledge transfer. SSEM attributes provide a shared basis for reviewing securability and help developers learn from one another.
Teams should treat merge reviews as guardrails, not gates. The goal is to grow the FIASSE mindset within the team and to make the review process a positive experience for developers, without introducing unnecessary friction or delay.
Merge reviews are also a practical venue for code-level threat awareness. Asking "What can go wrong?" about a changeset can reveal risks that are hard to isolate in a larger review. Escalate design-level concerns to the formal threat model. Sections 5.2.1 through 5.2.5 define how the review guardrail works.