Startups to know: Baz brings governance, planning, specs to AI-generated code

Baz, an agentic coding and AI code review platform, is aiming to move quality upstream in the AI software development lifecycle.

The startup specializes in engineering governance for AI-native software organizations. Its core products are AI Code Review and Planner. Those products are aimed at a new reality in the AI software development lifecycle. The bottleneck used to be writing code, but now engineering velocity is constrained by proving code is correct, secure and safe.

Another big issue is that enterprises can create coding agents and scale them, but maintaining those agents is going to be an issue. Baz learns how a development team decides what good looks like, steers agents toward it before code is written and after so developers get what they intended the first time.

In other words, Baz is looking to curb rework and install governance and security awareness into every coding session. Baz was founded in 2023, has raised $17 million in seed funding and has about 100 customers ranging from startups to large enterprises.

Guy Eisenkot, CEO of Baz, caught up with Constellation Research analyst Holger Mueller and me to talk shop. Eisenkot, co-founder of Baz, previously co-founded cloud security startup Bridgecrew, which was acquired by Palo Alto Networks for $200 million in 2021. Baz CTO Nimrod Kor is the other co-founder and previously was senior software engineering manager for Bridgecrew.

Here's a look at the takeaways.

The problem Baz is trying to solve. Eisenkot said AI-generated code is leading to rework and governance issues. The bottleneck in AI-native development is access to the most capable models and managing their output. He said:

"Up until two years ago, the constraint was very clear. They needed hands-on keyboards, spitting out new functions. The models have gotten to a point where hands on a keyboard don’t really matter anymore. What matters is access to the most capable and expensive models at any given time. We’re seeing 10x even 100x improvements in velocity, not in the lines of code written, but actual features that are delivered. The interesting thing for me is what happens downstream. People are spending less time reading the code."

Constellation Research's point of view: Mueller said Baz is focused on a real pain point. "Everything that helps companies stay on top of AI-generated code is valuable," said Mueller. "The concerns about maintenance, scalability, outcomes and cost are real."

Baz's product focus. Today, Baz is focused on AI-powered code review for any code that goes beyond correctness. Baz is positioned as a layer on top of compiler-grade generation and classical tools with a focus on logical bugs, security, breaking changes, specification fidelity and governance.

Eisenkot said Baz is looking to distinguish itself from AI lab-native tools with more precision and adherence to organization standards and a swarm of specialized agents for specific review tasks.

"We thought hard about building a data model that constantly corrects outputs and models to make them safe and sound like the code that already exists in the code base," said Eisenkot. "A second architectural decision we made was the swarm of agents. If we can name use cases and tasks and provide very scripted definitions of what a finished task means we get great results."

Purpose-built agents from Baz include:

• Spec Reviewer Agent, which validates code against product requirements, designs and expected behavior.
• Advanced Security Agent.
• SRE Agent, which correlates repository changes with production telemetry to identify reliability, performance and observability risks and the proposes fixes.
• Fixer Agent, which applies and validates safe code fixes in an isolated runtime.

Constellation Research's point of view: Baz has been crafting agents focused various issues for the last 18 months. The company is methodically working its way through the AI software development lifecycle. "While everyone is rushing to build agents, it is time to think about Day 2 issues and challenges, to make it successfully to Day 3. Baz agents with its governance capabilities ensure a successful start to Day 3 and lay the foundation for what's ahead," said Mueller.

Spec fidelity vs. vibe coding. Eisenkot said Baz's customers are split between those that think there is value in intent and specifications vs. those companies that have gone full vibe code and demo and skip specs and even design. Baz's focus on enforcing spec fidelity is a differentiator.

Eisenkot said it's likely that the vibe coding and spec fidelity approaches will converge. "I would assume that you're going to see more professionalization with the vibe coding subgroups. Some of the methodologies don't exist today," said Eisenkot, who said the maintenance of vibe coded apps is an emerging issue.

Constellation Research's point of view: Mueller said spec fidelity is critical to enterprises. "Every time there's a new developer paradigm, you think there's no need any more to document stuff and look at specs," explained Mueller. "Then they do the third or fourth project, and you get tied back into figuring out what you did a year ago. Then you come back to documentation, you come back to specs, and so on.”

Returns on investment. Baz recently launched Planner, a product that brings code-review intelligence into the planning and specification phase before any code is written.

The business case for Planner is minimizing the "rework tax" and the extra iterations after a pull request is ready. This rework burns tokens and time, said Eisenkot. "Those additional iterations are really where tokens go to die, because you can spend probably endless rework just iteratively getting feedback from the AI," he said.

AI code review helped lower token spend, but Baz is betting costs can be reduced more by shifting governance into the planning phase. Early returns from Baz Planner indicate a 20% to 60% reduction in token use on rework cycles.

Constellation Research's point of view: Mueller said moving specifications to the beginning of the process is going to save tokens and ensure fewer bugs and vulnerabilities downstream.

The future. Eisenkot said the vision is that Baz will enable hands-off, continuous steering of AI code. Ultimately, Baz is an engineering governance company that has a cybersecurity and app security pedigree and deep feedback loops to align AI output with org-specific standards.

“Enterprises are going implement these AI-coding tools at scale in a way that helps them continue to build software that's regulated and compliant and adhering to their standards and protocols,” said Eisenkot. “We saw this coming, and we're building toward that future.”

Constellation Research's point of view: Mueller said this "shift left" of planning into the AI-code development cycle can be critical to a problem that's likely to emerge: Maintenance of AI code. "You have to automate the entire value chain," said Mueller. "Maintenance has been a problem before and now enterprises have to find a way to maintain all the AI-generated code."