Works with · Codex · OpenAI
Does a Codex code review count for SOC 2?
No. Codex code review posts comments from a bot account. An auditor testing change management wants a qualified person other than the author who approved the change, and Codex is neither a person nor accountable. PSCO puts a named Officer on the same PR who reads Codex’s comments and signs the approval.
How Codex reviews
Codex reviews a pull request on request or on each push, posting inline comments on bugs, risky changes and missing tests, often with a proposed patch.
What it cannot do
Codex cannot be the independent human approver an auditor is looking for. SOC 2 CC8.1, ISO 27001 A.5.3, PCI DSS 6.2.3.1 and SOX program-change controls all assume a qualified person other than the author approved the change and understood it. A bot account posting "Approve" is a review record, not an accountable person, and as of mid-2026 no auditor reports accepting it as standard practice.
How PSCO reads its output
PSCO parses Codex review comments into findings on the Officer’s packet, keyed by path and line. Where Codex proposes a patch, the Officer sees the proposal next to the clause of your model it touches.
Two-step setup
Keep Codex.
Leave Codex code review enabled on the repository.
Add PSCO.
Install the PSCO GitHub App, select the repos in scope, and require one approval from @psco-officers and the psco/approved check on the protected branch.
The shared-model tip
Point it at the same model the Officer uses.
Point Codex at the same rulebook the Officer uses. Reference psco.model.yaml from AGENTS.md so Codex applies the same forbidden patterns and sensitive paths. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep Codex. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.