A product manager oversees a payments repository where pull requests need a security review for encryption changes, a backend review for API logic, and timely turnaround despite reviewers in three time zones. The team uses CODEOWNERS but reviews still stall. Which reviewer assignment practice should the manager enforce to ensure accountable and timely pull request reviews?
Select an answer to reveal the explanation.
Short Explanation
You need the right eyes, not every eye. Naming required-reviewers by expertise with due dates keeps things moving. Accountability beats broadcasting.
Full Explanation
The correct practice succeeds because it combines three controls required by the scenario: expertise-matched required reviewers ensure encryption changes receive security scrutiny and API logic receives backend scrutiny, named individual assignment creates clear accountability that CODEOWNERS groups alone cannot provide, and explicit turnaround expectations with reminders for unresponsive reviews sustain flow across three time zones where handoffs otherwise stall overnight. The named-expert approach without enforced expectations fails on timeliness by concept because best-effort promptness degrades under queue pressure and time-zone lag, leaving no trigger for reassignment or escalation when a required reviewer is asleep or overloaded. The rotation-based assignment with strict deadlines fails on expertise by concept because evenly distributing reviews optimizes fairness and coverage but can place encryption or API decisions with reviewers lacking the required security or backend context, increasing miss and rework risk. The CODEOWNERS-group approach with deadlines fails on accountability by concept due to diffusion of responsibility, where each member assumes another will review and the pull request waits despite the SLA clock running. An exam caveat is to distinguish commonly recommended load-balancing or group-ownership patterns from what the stem explicitly demands, choosing the choice that satisfies all stated constraints rather than the generally good practice. A practical check is to verify branch protection requires the named experts, turnaround and reminder rules are documented and automated, and review latency by expertise area improves without increasing bypasses.