RecordsTasks, PRs, findings, controls, evidence
Control workbooks
Workbooks for the records that prove work is safe.
These are not generic spreadsheets. You get governed views over first-party records: findings, PRs, tasks, controls, evidence packets, procurement artifacts, connectors, budgets, and readiness actions.
Control workbook
Operational views over real Boetica records.
Workbooks turn findings, PRs, tasks, controls, evidence, procurement artifacts, connectors, budgets, and readiness actions into governed views with filters, rollups, references, and exports.
ViewsGrid, board, checklist, owner rollups
ControlsReferences, computed status, blockers
ExportCSV and JSON without secret leakage
view.filter(owner, risk, control) -> live rowsrollup.compute() -> overdue reviews and blockersexport.redact() -> payloads and secrets removedtenant scopedexport readysource linked
Source-linked rows
Every row resolves to a Boetica task, PR, evidence packet, connector, control, budget, artifact, or readiness action.
Operational views
Teams can switch between grids, boards, checklists, owner rollups, risk views, and filtered review queues.
Governed export
CSV and JSON exports preserve proof while redacting secrets, scanner payloads, webhook bodies, and cross-tenant data.
Records
Bring work, risk, proof, and ownership into one table.
Workbooks let platform and AppSec teams inspect active tasks, unresolved findings, reviewer SLAs, control mappings, budget exposure, connector health, and procurement blockers together.
- Task and PR records
- Findings and controls
- Evidence and artifacts
- Budgets and readiness
Rollups
Views answer operational questions without a BI project.
Owner, risk, repo, control, connector, and evidence filters make daily triage visible, while computed rollups show overdue reviews, blocked runs, and proof gaps.
- Owner rollups
- Risk filters
- Computed blockers
- Reference lookups
Signed remediation PR
boetica/auth-rate-limit-pr
@@ apps/web/src/app/api/login/route.ts- await password.verify(body.password)+ await limiter.consume(requestIp)+ await password.verify(body.password)+ await audit.append(evidencePacket)
evidence packetKMS + Sigstore (cosign)
- packet hash
- 91f4e2a0
- prev hash
- 5e1c8a44
- trust boundary
- sandbox attested · egress denied
- merge policy
- platform-eng / human merge
SOC 2 CC6.6signedNIST AC-6signed
Trust
Workbooks inherit the same trust boundary as the product.
Access, export, deletion, and audit behavior follow Boetica tenant controls, so a workbook never becomes a side channel around the security model.
- Tenant scoped
- Secret redaction
- Audit events
- Deletion coverage