Trust

Keep code access scoped and make every run auditable.

DexCode is built for teams that need AI coding work to leave a clear, reviewable record.

Boundary

What DexCode holds

DexCode stores run metadata and evidence. It does not need unlimited repository access.

Required

CLI and API tokens should be revocable, named and scoped to the account.

Required

Artifacts need configurable retention because traces and screenshots can contain sensitive context.

Required

Merge, deploy and customer-facing changes still need explicit owner approval.

Controls

Budgets, provider credentials, access controls and audit logs stay visible to the organization.

Control

Set weekly and monthly limits by account, user and provider.

Control

Export run history, actors, tokens, PRs and evidence for review.

Control

Separate public PR links from private account-only evidence.

Shared app

Every run should make ownership, credentials, cost, evidence and approval state easy to inspect.