Your AI agents already move money, and commit you to more. Reddix is the control layer in between.

Every financial action your agents take is recorded and tiered by how reversible it is. The ones you cannot take back wait for a person to approve them. The rest pass straight through, and where a reversal exists, Reddix arms it in advance.

See where it bites · See how it works
Record · Classify · Gate · Recover
The decision nobody governs

The decision that causes the loss is made hours before the money moves.

Conventional controls sit on the payment. By then the judgement that created the exposure is hours old, and nothing has looked at it.

Where the loss is created, and where controls sit One timeline with three points: the decision at T, the payment hours later, the close days after that. The loss is created at the decision. Conventional controls cover only the payment. Reddix covers the whole span, starting at the decision. T T + HOURS T + DAYS The decision The payment The close An agent approves an invoice, issues a purchase order, or changes bank details. Downstream automation, doing what it was told. No second judgement in it. On a wire or an instant rail, nothing is left to approve. THE LOSS IS CREATED HERE CONVENTIONAL CONTROLS COVER THIS ONE EVENT REDDIX COVERS THE OBLIGATION, FROM THE DECISION ONWARDS T The decision An agent approves an invoice, issues a purchase order, or changes bank details. THE LOSS IS CREATED HERE T + HOURS The payment Downstream automation, doing what it was told. No second judgement in it. T + DAYS The close On a wire or an instant rail, nothing is left to approve. CONVENTIONAL CONTROLS COVER ONE EVENT REDDIX COVERS THE OBLIGATION, FROM THE DECISION ONWARDS
Which is why Reddix governs the financial obligation — every promise to pay, not only every payment.
Reddix sits between your agents and your systems Four AI agents send financial actions downward into the Reddix control layer. The layer records every action, classifies each with a reversibility tier, gates the material ones, and arms recovery where the rail allows. Three actions continue to your systems; the Tier 2 treasury action is held for human approval. YOUR AI AGENTS Procurement Accounts payable Treasury Support RECORD append-only CLASSIFY tier + control ref GATE material ones held RECOVER where the rail allows TIER 1 TIER 1 TIER 0 TIER 2 HELD ERP Payment rails Processor Ledger YOUR EXISTING SYSTEMS Reddix sits between your agents and your systems Two AI agents send financial actions downward into the Reddix control layer. The layer records and classifies both. The Tier 1 accounts payable action passes through to your systems; the Tier 2 treasury action is held for human approval. Recovery is armed where the rail allows. YOUR AI AGENTS Accounts payable Treasury RECORD append-only CLASSIFY tier + ref GATE material held RECOVER where it can TIER 1 TIER 2 HELD Payment rails ERP · ledger YOUR EXISTING SYSTEMS
Every agent financial action passes through the layer. All of them are recorded and tiered; the material ones are held for a second person; recovery is armed where the rail still allows one. The Gate holds the instruction, never the money.
RECORD CLASSIFY GATE RECOVER
Record · the first band

Every action, sealed against the last.

Entries can be added. They cannot be quietly altered or removed.

The record is a sealed chain Four ledger entries, each sealed against the one before it. The third entry has been altered, and the seal joining it to the fourth is shown broken, because changing any entry breaks every seal after it. #4468 tier 0 · cleared $312.55 a7f3…9c21 #4469 tier 1 · reversed $1,240.00 4e08…bb17 #4470 tier 2 · released $8,240.00 ALTERED c1d5…07ae #4471 tier 2 · held $214,000.00 ✕ SEAL FAILS CHANGE ONE ENTRY AND EVERY SEAL AFTER IT FAILS. THAT IS WHAT TAMPER-EVIDENT MEANS. RECORD CLASSIFY GATE RECOVER #4468 tier 0 · cleared $312.55 a7f3…9c21 #4469 tier 1 · reversed $1,240.00 4e08…bb17 #4470 tier 2 · released ALTERED $8,240.00 c1d5…07ae #4471 tier 2 · held $214,000.00 ✕ SEAL FAILS CHANGE ONE ENTRY AND EVERY SEAL AFTER IT FAILS.
A complete export is available on request, without conditions. If you leave Reddix, the evidence leaves with you.
Classify · the second band

One scale, two ways onto it.

What fixes an action’s tier depends on which kind of action it is.

One scale, and the two properties that fix a position on it A commitment action is tiered by whether you can still withdraw on your own; a movement action by what the rail's finality law promises. Both land on the same tier 0 to 3 scale, along which the recovery left after the action has gone out drains to nothing. Tier 2 is where the gate starts. A control reference is issued at this point, before anything is gated or released. COMMITMENT Can you still withdraw on your own? MOVEMENT What the rail’s finality law honestly promises. GATE TIER 0 Freely reversible TIER 1 Compensable TIER 2 Hold before commit TIER 3 Irreversible RECOVERY LEFT ONCE IT HAS GONE OUT NONE CTL·REF a7f3…9c21 ISSUED HERE, BEFORE ANYTHING IS GATED OR RELEASED — SO IT CARRIES EITHER WAY THE GATE STARTS AT TIER 2. IN DOUBT, THE HIGHER TIER — CLASSIFICATION IS CONSERVATIVE BY DEFAULT. RECORD CLASSIFY GATE RECOVER COMMITMENT Can you still withdraw on your own? MOVEMENT What the rail promises, honestly. TIER 0 Freely reversible TIER 1 Compensable GATE TIER 2 Hold before commit TIER 3 Irreversible RECOVERY LEFT ONCE IT HAS GONE OUT → NONE CTL·REF a7f3…9c21
Every tier definition, and the examples that sit in each, are in §2 of the draft.
Gate · the third band

An agent stopped at the threshold, and a human deciding.

Amber always means the same thing: someone needs to look at this. That moment is the whole product.

What the gate actually does An agent's instruction arrives at the gate and is held as a durable state. The agent is answered immediately and carries on. A second person, never the one who initiated, approves or denies. The outcome is recorded with the true actor. The money is never held; only the instruction is. WHOEVER APPROVES IS NEVER WHOEVER INITIATED AP Agent · Fin-Ops INITIATED ≠ A second person APPROVES OR DENIES GATE TXN · 4471 · TIER 2 HELD NOT A BLOCKED CALL A durable state. The action gets an identifier that outlives the request. INSTRUCTION The agent ANSWERED IMMEDIATELY RELEASED DENIED EXPIRED RECORDED WITH THE TRUE ACTOR THE MONEY — NEVER HELD. THE GATE HOLDS THE INSTRUCTION. RECORD CLASSIFY GATE RECOVER The agent GATE TXN·4471 · TIER 2 HELD NOT A BLOCKED CALL An identifier that outlives the request. ↩ THE AGENT IS ANSWERED IMMEDIATELY WHOEVER APPROVES IS NEVER WHOEVER INITIATED AP Agent · Fin-Ops INITIATED ≠ A second person APPROVES OR DENIES RELEASED DENIED EXPIRED RECORDED WITH THE TRUE ACTOR — SILENCE IS NEVER A DECISION THE MONEY — NEVER HELD. THE GATE HOLDS THE INSTRUCTION.
The control reference issued at classification follows the action into the executing instruction and into the accounting entry, so an auditor can trace a sample back to the decision that authorised it.
Recover · the fourth band

And where it runs out, we say so.

Recovery is a property of the rail and the counterparty, never of the software.

Recovery degrades, step by step, until nothing is left Four steps, each narrower than the last. Armed compensation, where Reddix fires the inverse on trigger. Prepare-and-instruct, where Reddix assembles the request and you send it. A documented claim, where no mechanism exists and only the attempt is recorded. And nothing, at tier 3, where no recovery primitive exists at all. ARMED COMPENSATION The inverse is prepared at classification and fired on trigger. TIER 0–1 · REDDIX ACTS PREPARE AND INSTRUCT Reddix assembles the request. You send it. TIER 2 · YOU ACT DOCUMENTED CLAIM No mechanism. The attempt is recorded. FALLBACK NOTHING No recovery primitive exists. TIER 3 EACH STEP IS WHAT IS LEFT WHEN THE ONE ABOVE IT IS NOT AVAILABLE RECOVERY IS PER-RAIL AND BEST-EFFORT. IT IS NEVER A UNIVERSAL UNDO. RECORD CLASSIFY GATE RECOVER ARMED COMPENSATION Reddix fires the inverse on trigger. PREPARE AND INSTRUCT Reddix assembles it. You send it. DOCUMENTED CLAIM Only the attempt. NOTHING Tier 3. RECOVERY IS PER-RAIL AND BEST-EFFORT. IT IS NEVER A UNIVERSAL UNDO.
Which is why the pre-commit window is the product. There is no universal undo.

Start with the agent you already run.

Thirty days in shadow mode, read-only, no code in your payment path. You get your own exposure report before anything is ever gated. Draft 0.2 of the framework is open for comment, and every disposition is published.

See the four use cases · Or start with the exposure report on your own traffic →