Private beta becos is in private beta. To get access, join the waitlist — or .
becos.ai
Security & governance

A record built for security review

Grounding an agent in a shared store only helps if the store itself is defensible. Here is what becos records, what it leaves out, how cited sources resolve and how tenants are kept apart — including where the limits are.

What's in the record

  • Prompts and the agent's text replies (shell output run with ! and subagent results arrive as prompt text)
  • Commit id, branch, author
  • Changed file paths and the repositories touched
  • Commands, command output and code edits (Claude Code and opencode plugins) or code blocks from the agent's replies (Codex plugin) — secret-redacted and size-capped
  • Facts distilled from those sessions (decisions, reasons, rejected approaches), plus a dated ledger

Not sent by default

  • The agent's thinking blocks
  • Files such as .env, *.pem and id_rsa* — withheld entirely
  • Codex plugin: commands, command output and diffs (never sent)

Never returned to your agents

  • Repository memory from another tenant — dropped before the model

Commands, output and code edits are on by default. Set VONIC_CAPTURE_CODE, VONIC_CAPTURE_COMMANDS or VONIC_CAPTURE_OUTPUTS to 0 to turn each off (the Codex plugin has only VONIC_CAPTURE_CODE); turning all three off sends prompts, replies and file paths only. VONIC_CAPTURE_THINKING=1 adds the agent's thinking. Secret redaction is pattern-based defence in depth, not a guarantee, so treat a session like anything else you would not paste into a shared document.

Three properties

How the record is kept checkable and contained

1

Provenance you can check

A cited ledger event resolves via resolve_event to an exact excerpt of the stored source, with no model in the loop — so a grounded answer can be checked, not just trusted.

2

Tenant isolation

Repository memory lives under a normalised tenant path, and results are filtered by tenant prefix before content reaches a model. An earlier shared-tenant tool design was retired as a hazard.

3

Record treated as untrusted

Captured content is treated as untrusted input. The repository ingestion model runs with no tools, and its output schema has no slug, path or tool fields for injected text to set.

The governance gap

Teams adopted coding agents faster than they governed them

Industry numbers, for context. They describe how teams use coding agents today, not becos.

97%
of teams use AI coding assistants
~30%
have a fully-governed approach to them
29%
of developers trust AI output accuracy

Sources: Black Duck / UserEvidence 2026 (831 engineers) · Stack Overflow 2025 Developer Survey.

Mapping

Where it lines up with the frameworks

Framing for a controls conversation — not a certification claim. becos has not completed a SOC 2 examination. Clients sign in with per-user OAuth; server-side token verification on the runtime is still in progress.

SOC 2
Cited events resolve to their stored source with no model call, keyed by event_id with tenant, author, repository and time — an attributable record of what an agent was grounded in. Evidence your auditors can use for your own monitoring controls (e.g. CC7.2).
EU AI Act
Obligations for high-risk AI systems (Annex III) apply from 2 Dec 2027, after Regulation (EU) 2026/1744. If you build high-risk systems, Art. 12 requires record-keeping; per-fact provenance and attribution from becos can feed that documentation. becos itself is not a high-risk AI system.
NIST SSDF
SP 800-218: tenant isolation supports PO.5.1 (separate and protect development environments); cited, attributable ledger events provide evidence artifacts in the spirit of PO.3.3.
Team activity
Questions about a teammate's recent work are answered from the same tenant-scoped record: people on your team can ask, nobody outside it can. Answers contain only what agents captured in coding sessions — decisions, discoveries and rejected approaches — never hours, keystrokes or screen time.
Agent attribution
Each ledger event records when it happened and when it was recorded, with tenant, author and repository; event_id keys link a grounded claim back to that event.

Get the security narrative early

So the platform team's deal clears review instead of stalling in it.