doc: release: update merge criteria

Document 4 eye principal for reviews and merges.

Signed-off-by: Anas Nashif <anas.nashif@intel.com>

doc/project/project_roles.rst

@@ -314,15 +314,37 @@ Release Activity
 Merge Criteria
 ++++++++++++++
 
-* All continuous integration checks have passed
+* Minimal of 2 approvals:
+
+  * A collaborator from the same subsystem.
+  * Alternately another maintainer of another subsystem
+  * Approval by the assignee
+
+* Four eye principle on the organisation level.
+
+  * Changes or additions to common and shared code shall have reviews from
+    different organisations (at least one review and approval from a different
+    submitters' organisation).
+  * Changes or additions to hardware support (driver, SoC, boards) shall at
+    least have the merger be from a different organisation.
+  * Release engineers shall not merge code changes originating from the same
+    organisation if all other reviewers are also from the same organisation.
+    To be able to merge such changes, at least one review shall be from a
+    different organisation.
+  * Exceptions can be made for areas with contributions largly coming from one
+    organisation and where reviewes from other organisations are not possible.
+
+* A minimum review period of 2 days, 4 hours for trivial changes (see
+  :ref:`review_time`). Hotfixes can be merged at any time after CI has passed.
+* All required checks are passing:
 
   * Codeowners
   * Device Tree
   * Documentation
   * Gitlint
   * Identity/Emails
   * Kconfig
-  * License
+  * License checks
   * Checkpatch (Coding Style)
   * Pylint
   * Integration Tests (Via twister) on emulation/simulation platforms
@@ -335,15 +357,3 @@ Merge Criteria
   * Coding Guidelines
   * Static Analysis (Coverity)
   * Documentation coverage (APIs)
-
-* PR template with checklist
-
-* Minimal of 2 approvals
-
-  * A collaborator from the same subsystem.
-  * Alternately another maintainer of another subsystem
-  * Approval by the assignee
-
-* A minimum review period of 2 days, 4 hours for trivial changes (see
-  :ref:`review_time`). Hotfixes can be merged at any time after CI passes.
-* All required checks are passing